openssl, branch OpenSSL_1_0_2m

Prepare for 1.0.2m release

2017-11-02T14:33:44Z

Reviewed-by: Andy Polyakov

make update

2017-11-02T14:33:44Z

Reviewed-by: Andy Polyakov

Update CHANGES and NEWS for new release

2017-11-02T12:03:59Z

Reviewed-by: Andy Polyakov

bn/asm/x86_64-mont5.pl: fix carry bug in bn_sqrx8x_internal.

2017-11-02T11:06:40Z

Credit to OSS-Fuzz for finding this. CVE-2017-3736 Reviewed-by: Rich Salz

Address a timing side channel whereby it is possible to determine some

2017-11-01T16:43:06Z

information about the length of the scalar used in ECDSA operations from a large number (2^32) of signatures. Thanks to Neals Fournaise, Eliane Jaulmes and Jean-Rene Reinhard for reporting this issue. Refer to #4576 for further details. Reviewed-by: Andy Polyakov Reviewed-by: Matt Caswell (Merged from https://github.com/openssl/openssl/pull/4623)

Address a timing side channel whereby it is possible to determine some

2017-11-01T16:41:59Z

information about the length of a value used in DSA operations from a large number of signatures. This doesn't rate as a CVE because: * For the non-constant time code, there are easier ways to extract more information. * For the constant time code, it requires a significant number of signatures to leak a small amount of information. Thanks to Neals Fournaise, Eliane Jaulmes and Jean-Rene Reinhard for reporting this issue. Original commit by Paul Dale. Backported to 1.0.2 by Matt Caswell Reviewed-by: Andy Polyakov Reviewed-by: Matt Caswell (Merged from https://github.com/openssl/openssl/pull/4642)

Fix weak digest in TLS 1.2 with SNI.

2017-11-01T12:35:19Z

1ce95f19601bbc6bfd24092c76c8f8105124e857 was incomplete and did not handle the case when SSL_set_SSL_CTX was called from the cert_cb callback rather than the SNI callback. The consequence is any server using OpenSSL 1.0.2 and the cert_cb callback for SNI only ever signs a weak digest, SHA-1, even when connecting to clients which use secure ones. Fix this and add regression tests for both this and the original issue. Fixes #4554. Reviewed-by: Emilia Käsper Reviewed-by: Matt Caswell (Merged from https://github.com/openssl/openssl/pull/4577)

Use malloc/memset not calloc for WinCE portability

2017-10-26T20:34:32Z

Fixes: #2539 Reviewed-by: Rich Salz (Merged from https://github.com/openssl/openssl/pull/4594)

Don't use strcasecmp and strncasecmp for IA5 strings

2017-10-26T13:57:01Z

The functions strcasecmp() and strncasecmp() will use locale specific rules when performing comparison. This could cause some problems in certain locales. For example in the Turkish locale an 'I' character is not the uppercase version of 'i'. However IA5 strings should not use locale specific rules, i.e. for an IA5 string 'I' is uppercase 'i' even if using the Turkish locale. This fixes a bug in name constraints checking reported by Thomas Pornin (NCCGroup). This is not considered a security issue because it would require both a Turkish locale (or other locale with similar issues) and malfeasance by a trusted name-constrained CA for a certificate to pass name constraints in error. The constraints also have to be for excluded sub-trees which are extremely rare. Failure to match permitted subtrees is a bug, not a vulnerability. Reviewed-by: Richard Levitte (Merged from https://github.com/openssl/openssl/pull/4570)

Don't make any changes to the lhash structure if we are going to fail

2017-10-25T10:12:05Z

The lhash expand() function can fail if realloc fails. The previous implementation made changes to the structure and then attempted to do a realloc. If the realloc failed then it attempted to undo the changes it had just made. Unfortunately changes to lh->p were not undone correctly, ultimately causing subsequent expand() calls to increment num_nodes to a value higher than num_alloc_nodes, which can cause out-of-bounds reads/ writes. This is not considered a security issue because an attacker cannot cause realloc to fail. This commit moves the realloc call to near the beginning of the function before any other changes are made to the lhash structure. That way if a failure occurs we can immediately fail without having to undo anything. Thanks to Pavel Kopyl (Samsung) for reporting this issue. Reviewed-by: Rich Salz (Merged from https://github.com/openssl/openssl/pull/4551)