openssl, branch openssl-3.3.2

Prepare for release of 3.3.2

2024-09-03T12:46:38Z

Reviewed-by: Neil Horman Release: yes

make update

2024-09-03T12:46:36Z

Reviewed-by: Neil Horman Release: yes

Copyright year updates

2024-09-03T12:44:27Z

Reviewed-by: Neil Horman Release: yes

Add CVE-2024-5535 to CHANGES and NEWS

2024-09-03T12:25:51Z

Reviewed-by: Neil Horman Release: yes (cherry picked from commit abcb0f83d060eb816503a6a36959ce8498a24111)

Updated CHANGES and NEWS for CVE-2024-6119 fix

2024-09-03T10:06:16Z

Reviewed-by: Neil Horman Reviewed-by: Tomas Mraz

Avoid type errors in EAI-related name check logic.

2024-09-03T10:03:11Z

The incorrectly typed data is read only, used in a compare operation, so neither remote code execution, nor memory content disclosure were possible. However, applications performing certificate name checks were vulnerable to denial of service. The GENERAL_TYPE data type is a union, and we must take care to access the correct member, based on `gen->type`, not all the member fields have the same structure, and a segfault is possible if the wrong member field is read. The code in question was lightly refactored with the intent to make it more obviously correct. Fixes CVE-2024-6119 Reviewed-by: Richard Levitte Reviewed-by: Tomas Mraz (cherry picked from commit 0890cd13d40fbc98f655f3974f466769caa83680)

endecode_test.c: Fix !fips v3.0.0 check

2024-08-30T09:43:20Z

The fips_provider_version_* functions return true if the FIPS provider isn't loaded. This is somewhat counterintuitive and the fix in #25327 neglected this nuance resulting in not running the SM2 tests when the FIPS provider wasn't being loaded. Reviewed-by: Viktor Dukhovni Reviewed-by: Tom Cosgrove Reviewed-by: Tomas Mraz (Merged from https://github.com/openssl/openssl/pull/25331) (cherry picked from commit c6c6af18ea5f8dd7aa2bd54b63fcb813ee6c2394)

exporters for pkg-config: align with the changes for CMake

2024-08-30T03:22:56Z

The latest CMake exporter changes reworked the the variables in builddata.pm and installdata.pm. Unfortunately, the pkg-config exporter templates were forgotten in that effort. Fixes #25299 Reviewed-by: Matt Caswell Reviewed-by: Neil Horman (Merged from https://github.com/openssl/openssl/pull/25308) (cherry picked from commit 15b748496faeebb3b6d8021049bccc93903ee322)

endecode_test.c: Avoid running the SM2 tests with 3.0.0 FIPS provider

2024-08-29T17:46:00Z

Fixes #25326 Reviewed-by: Richard Levitte Reviewed-by: Neil Horman (Merged from https://github.com/openssl/openssl/pull/25327) (cherry picked from commit 0b97a5505efa8833bb7b8cabae45894ad6d910a2)

Check for excess data in CertificateVerify

2024-08-29T17:32:14Z

As reported by Alicja Kario, we ignored excess bytes after the signature payload in TLS CertificateVerify Messages. These should not be present. Fixes: #25298 Reviewed-by: Matt Caswell Reviewed-by: Tomas Mraz (Merged from https://github.com/openssl/openssl/pull/25302) (cherry picked from commit b4e4bf29ba3c67662c60ceed9afa2dd301e93273)