openssl, branch openssl-3.2.1

Prepare for release of 3.2.1

2024-01-30T13:14:56Z

Reviewed-by: Richard Levitte Release: yes

make update

2024-01-30T13:14:55Z

Reviewed-by: Richard Levitte Release: yes

Copyright year updates

2024-01-30T13:13:27Z

Reviewed-by: Richard Levitte Release: yes

Update CHANGES.md and NEWS.md for new release

2024-01-30T12:53:15Z

Reviewed-by: Tomas Mraz Release: yes (Merged from https://github.com/openssl/openssl/pull/23422)

Have OSSL_PARAM_allocate_from_text() fail on odd number of hex digits

2024-01-25T15:37:32Z

The failure would be caught later on, so this went unnoticed, until someone tried with just one hex digit, which was simply ignored. Fixes #23373 Reviewed-by: Tom Cosgrove Reviewed-by: Tomas Mraz (Merged from https://github.com/openssl/openssl/pull/23374) (cherry picked from commit ea6268cfceaba24328d66bd14bfc97c4fac14a58)

Add some tests for various PKCS12 files with NULL ContentInfo

2024-01-25T15:30:12Z

PKCS7 ContentInfo fields held within a PKCS12 file can be NULL, even if the type has been set to a valid value. CVE-2024-0727 is a result of OpenSSL attempting to dereference the NULL pointer as a result of this. We add test for various instances of this problem. Reviewed-by: Tomas Mraz Reviewed-by: Hugo Landau Reviewed-by: Neil Horman (Merged from https://github.com/openssl/openssl/pull/23361) (cherry picked from commit 8a85df7c60ba1372ee98acc5982e902d75f52130)

Add NULL checks where ContentInfo data can be NULL

2024-01-25T15:30:12Z

PKCS12 structures contain PKCS7 ContentInfo fields. These fields are optional and can be NULL even if the "type" is a valid value. OpenSSL was not properly accounting for this and a NULL dereference can occur causing a crash. CVE-2024-0727 Reviewed-by: Tomas Mraz Reviewed-by: Hugo Landau Reviewed-by: Neil Horman (Merged from https://github.com/openssl/openssl/pull/23361) (cherry picked from commit 041962b429ebe748c8b6b7922980dfb6decfef26)

Fix a possible memory leak in req_main

2024-01-24T10:54:51Z

if the private key is output to stdout using the HARNESS_OSSL_PREFIX, out is a stack of BIOs and must therefore free'd using BIO_free_all. Steps to reproduce: $ HARNESS_OSSL_PREFIX=x OPENSSL_CONF=apps/openssl.cnf util/shlib_wrap.sh apps/openssl req -new -keyout - -passout pass: Reviewed-by: Tomas Mraz (Merged from https://github.com/openssl/openssl/pull/23365) (cherry picked from commit ff78d94b131d7bb3b761509d3ce0dd864b1420e3)

ci.yml: Replace actions-rs/toolchain@v1 with dtolnay/rust-toolchain

2024-01-23T17:20:47Z

actions-rs/toolchain is unmaintained and generates warnings Reviewed-by: Shane Lontis Reviewed-by: Hugo Landau (Merged from https://github.com/openssl/openssl/pull/23232) (cherry picked from commit cd5911a6b300453eefb4b6d9d797c9d1cdefb956)

tlsfuzzer.sh: Use python3

2024-01-23T17:10:11Z

Reviewed-by: Hugo Landau Reviewed-by: Tom Cosgrove (Merged from https://github.com/openssl/openssl/pull/23342) (cherry picked from commit 15f479e25f9591a2749fabb436dcdfb9304c5c7b)