openssl, branch OpenSSL_1_1_1k

Prepare for 1.1.1k release

2021-03-25T13:28:38Z

Reviewed-by: Tomas Mraz

Update copyright year

2021-03-25T13:21:32Z

Reviewed-by: Tomas Mraz

Update CHANGES and NEWS for new release

2021-03-25T13:19:29Z

Reviewed-by: Tomas Mraz

Ensure buffer/length pairs are always in sync

2021-03-25T09:43:33Z

Following on from CVE-2021-3449 which was caused by a non-zero length associated with a NULL buffer, other buffer/length pairs are updated to ensure that they too are always in sync. Reviewed-by: Tomas Mraz Reviewed-by: Paul Dale

ssl sigalg extension: fix NULL pointer dereference

2021-03-25T09:43:33Z

As the variable peer_sigalgslen is not cleared on ssl rehandshake, it's possible to crash an openssl tls secured server remotely by sending a manipulated hello message in a rehandshake. On such a manipulated rehandshake, tls1_set_shared_sigalgs() calls tls12_shared_sigalgs() with the peer_sigalgslen of the previous handshake, while the peer_sigalgs has been freed. As a result tls12_shared_sigalgs() walks over the available peer_sigalgs and tries to access data of a NULL pointer. This issue was introduced by c589c34e61 (Add support for the TLS 1.3 signature_algorithms_cert extension, 2018-01-11). Signed-off-by: Peter Kästle Signed-off-by: Samuel Sapalski CVE-2021-3449 CLA: trivial Reviewed-by: Tomas Mraz Reviewed-by: Paul Dale Reviewed-by: Matt Caswell

Add a test for CVE-2021-3449

2021-03-25T09:43:33Z

We perform a reneg handshake, where the second ClientHello drops the sig_algs extension. It must also contain cert_sig_algs for the test to work. Reviewed-by: Tomas Mraz Reviewed-by: Paul Dale

Teach TLSProxy how to encrypt <= TLSv1.2 ETM records

2021-03-25T09:43:33Z

Previously TLSProxy only knew how to "repack" messages for TLSv1.3. Most of the handshake in <= TLSv1.2 is unencrypted so this hasn't been too much of restriction. However we now want to modify reneg handshakes which are encrypted so we need to add that capability. Reviewed-by: Tomas Mraz Reviewed-by: Paul Dale

check_chain_extensions: Do not override error return value by check_curve

2021-03-25T09:36:37Z

The X509_V_FLAG_X509_STRICT flag enables additional security checks of the certificates present in a certificate chain. It is not set by default. Starting from OpenSSL version 1.1.1h a check to disallow certificates with explicitly encoded elliptic curve parameters in the chain was added to the strict checks. An error in the implementation of this check meant that the result of a previous check to confirm that certificates in the chain are valid CA certificates was overwritten. This effectively bypasses the check that non-CA certificates must not be able to issue other certificates. If a "purpose" has been configured then a subsequent check that the certificate is consistent with that purpose also checks that it is a valid CA. Therefore where a purpose is set the certificate chain will still be rejected even when the strict flag has been used. A purpose is set by default in libssl client and server certificate verification routines, but it can be overriden by an application. Affected applications explicitly set the X509_V_FLAG_X509_STRICT verification flag and either do not set a purpose for the certificate verification or, in the case of TLS client or server applications, override the default purpose to make it not set. CVE-2021-3450 Reviewed-by: Matt Caswell Reviewed-by: Paul Dale

Fix missing INVALID_EXTENSION

2021-03-22T07:29:28Z

Reviewed-by: Matt Caswell Reviewed-by: Ben Kaduk Reviewed-by: Tomas Mraz (Merged from https://github.com/openssl/openssl/pull/14639)

ASN1: Reset the content dump flag after dumping

2021-03-21T11:30:01Z

When encountering a badly coded item, the DER printer (ASN1_print_dump()) sets a flag to ensure that an additional hex dump of the offending content is printed as part of the output. Unfortunately, this flag is never reset, which means that all following items are printed with the extra hex dump, whether they are faulty or not. Resetting the flag after hex dumping ensures that only the faulty contents are printed with the additional hex dump. Fixes #14626 Reviewed-by: Tim Hudson (Merged from https://github.com/openssl/openssl/pull/14627) (cherry picked from commit 6e34a1048ce4871371eac224b995c3b4338f6166)