From a26dd3da33ba4a36ee2028385a5b322ba5032fdc Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Mon, 18 May 2026 14:45:38 +0200 Subject: [PATCH] openssl: Check that EC keys don't have explicit params for internally loaded keys Keys loaded via generic loader (KEY_ANY) or from a PKCS#12 file (or an engine) don't go through the openssl_ec_private_key_load() constructor that checks for explicit parameters. --- src/libstrongswan/plugins/openssl/openssl_ec_private_key.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/libstrongswan/plugins/openssl/openssl_ec_private_key.c b/src/libstrongswan/plugins/openssl/openssl_ec_private_key.c index 21df4c035..9f9319024 100644 --- a/src/libstrongswan/plugins/openssl/openssl_ec_private_key.c +++ b/src/libstrongswan/plugins/openssl/openssl_ec_private_key.c @@ -319,7 +319,8 @@ private_key_t *openssl_ec_private_key_create(EVP_PKEY *key, bool engine) { private_openssl_ec_private_key_t *this; - if (EVP_PKEY_base_id(key) != EVP_PKEY_EC) + if (EVP_PKEY_base_id(key) != EVP_PKEY_EC || + openssl_check_explicit_params(key)) { EVP_PKEY_free(key); return NULL;