openssl, branch OpenSSL_1_0_2-stable

Prepare for 1.0.2v-dev

2019-12-20T13:10:12Z

Reviewed-by: Paul Yang

Prepare for 1.0.2u release

2019-12-20T13:09:21Z

Reviewed-by: Paul Yang

Update copyright year

2019-12-20T09:33:50Z

Reviewed-by: Richard Levitte (Merged from https://github.com/openssl/openssl/pull/10664)

Updates NEWS for new release

2019-12-19T17:28:18Z

Reviewed-by: Richard Levitte (Merged from https://github.com/openssl/openssl/pull/10663)

Add a CHANGES entry for CVE-2019-1551

2019-12-05T00:26:16Z

Reviewed-by: Paul Dale (Merged from https://github.com/openssl/openssl/pull/10576)

Improve the overflow handling in rsaz_512_sqr

2019-12-04T21:57:18Z

We have always a carry in %rcx or %rbx in range 0..2 from the previous stage, that is added to the result of the 64-bit square, but the low nibble of any square can only be 0, 1, 4, 9. Therefore one "adcq $0, %rdx" can be removed. Likewise in the ADX code we can remove one "adcx %rbp, $out" since %rbp is always 0, and carry is also zero, therefore that is a no-op. Reviewed-by: Paul Dale (Merged from https://github.com/openssl/openssl/pull/10576)

Fix an overflow bug in rsaz_512_sqr

2019-12-04T21:57:16Z

There is an overflow bug in the x64_64 Montgomery squaring procedure used in exponentiation with 512-bit moduli. No EC algorithms are affected. Analysis suggests that attacks against 2-prime RSA1024, 3-prime RSA1536, and DSA1024 as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH512 are considered just feasible. However, for an attack the target would have to re-use the DH512 private key, which is not recommended anyway. Also applications directly using the low level API BN_mod_exp may be affected if they use BN_FLG_CONSTTIME. CVE-2019-1551 Reviewed-by: Paul Dale Reviewed-by: Bernd Edlinger (Merged from https://github.com/openssl/openssl/pull/10576)

Fix an s_server arbitrary file read issue on Windows

2019-10-28T13:20:02Z

Running s_server in WWW mode on Windows can allow a client to read files outside the s_server directory by including backslashes in the name, e.g. GET /..\myfile.txt HTTP/1.0 There exists a check for this for Unix paths but it is not sufficient for Windows. Since s_server is a test tool no CVE is assigned. Thanks to Jobert Abma for reporting this. Reviewed-by: Richard Levitte (Merged from https://github.com/openssl/openssl/pull/10215) (cherry picked from commit 0a4d6c67480a4d2fce514e08d3efe571f2ee99c9)

[crypto/asn1/x_bignum.c] Explicit test against NULL

2019-10-16T13:01:58Z

As a fixup to https://github.com/openssl/openssl/pull/9779 to better conform to the project code style guidelines, this commit amends the original changeset to explicitly test against NULL, i.e. writing ``` if (p != NULL) ``` rather than ``` if (!p) ``` (This is a backport of https://github.com/openssl/openssl/pull/9881) Reviewed-by: Nicola Tuveri Reviewed-by: Matt Caswell (Merged from https://github.com/openssl/openssl/pull/9882)

[ec_asn1.c] Avoid injecting seed when built-in matches

2019-10-15T12:28:36Z

An unintended consequence of https://github.com/openssl/openssl/pull/9808 is that when an explicit parameters curve is matched against one of the well-known builtin curves we automatically inherit also the associated seed parameter, even if the input parameters excluded such parameter. This later affects the serialization of such parsed keys, causing their input DER encoding and output DER encoding to differ due to the additional optional field. This does not cause problems internally but could affect external applications, as reported in https://github.com/openssl/openssl/pull/9811#issuecomment-536153288 This commit fixes the issue by conditionally clearing the seed field if the original input parameters did not include it. Reviewed-by: Matt Caswell Reviewed-by: Tomas Mraz (Merged from https://github.com/openssl/openssl/pull/10141)