openssl/crypto, branch OpenSSL_1_1_1j

Update copyright year

2021-02-16T15:17:22Z

Reviewed-by: Richard Levitte

Don't overflow the output length in EVP_CipherUpdate calls

2021-02-16T11:42:35Z

CVE-2021-23840 Reviewed-by: Paul Dale

Fix the RSA_SSLV23_PADDING padding type

2021-02-16T11:38:22Z

This also fixes the public function RSA_padding_check_SSLv23. Commit 6555a89 changed the padding check logic in RSA_padding_check_SSLv23 so that padding is rejected if the nul delimiter byte is not immediately preceded by at least 8 bytes containing 0x03. Prior to that commit the padding is rejected if it *is* preceded by at least 8 bytes containing 0x03. Presumably this change was made to be consistent with what it says in appendix E.3 of RFC 5246. Unfortunately that RFC is in error, and the original behaviour was correct. This is fixed in later errata issued for that RFC. This has no impact on libssl for modern versions of OpenSSL because there is no protocol support for SSLv2 in these versions. However applications that call RSA_paddin_check_SSLv23 directly, or use the RSA_SSLV23_PADDING mode may still be impacted. The effect of the original error is that an RSA message encrypted by an SSLv2 only client will fail to be decrypted properly by a TLS capable server, or a message encrypted by a TLS capable client will fail to decrypt on an SSLv2 only server. Most significantly an RSA message encrypted by a TLS capable client will be successfully decrypted by a TLS capable server. This last case should fail due to a rollback being detected. Thanks to D. Katz and Joel Luellwitz (both from Trustwave) for reporting this issue. CVE-2021-23839 Reviewed-by: Paul Dale

Fix Null pointer deref in X509_issuer_and_serial_hash()

2021-02-16T11:34:02Z

The OpenSSL public API function X509_issuer_and_serial_hash() attempts to create a unique hash value based on the issuer and serial number data contained within an X509 certificate. However it fails to correctly handle any errors that may occur while parsing the issuer field (which might occur if the issuer field is maliciously constructed). This may subsequently result in a NULL pointer deref and a crash leading to a potential denial of service attack. The function X509_issuer_and_serial_hash() is never directly called by OpenSSL itself so applications are only vulnerable if they use this function directly and they use it on certificates that may have been obtained from untrusted sources. CVE-2021-23841 Reviewed-by: Richard Levitte Reviewed-by: Paul Dale (cherry picked from commit 8130d654d1de922ea224fa18ee3bc7262edc39c0)

check_sig_alg_match(): weaken sig nid comparison to base alg

2021-01-28T18:27:42Z

This (re-)allows RSA-PSS signers Fixes #13931 Reviewed-by: Tomas Mraz (Merged from https://github.com/openssl/openssl/pull/13982)

Ensure SRP BN_mod_exp follows the constant time path

2021-01-20T16:27:10Z

SRP_Calc_client_key calls BN_mod_exp with private data. However it was not setting BN_FLG_CONSTTIME and therefore not using the constant time implementation. This could be exploited in a side channel attack to recover the password. Since the attack is local host only this is outside of the current OpenSSL threat model and therefore no CVE is assigned. Thanks to Mohammed Sabt and Daniel De Almeida Braga for reporting this issue. Reviewed-by: Tomas Mraz (Merged from https://github.com/openssl/openssl/pull/13889)

x509_vfy.c: Fix a regression in find_isser()

2021-01-14T13:44:21Z

...in case the candidate issuer cert is identical to the target cert. Fixes #13739 Reviewed-by: Tomas Mraz (Merged from https://github.com/openssl/openssl/pull/13749)

X509_cmp(): Fix comparison in case x509v3_cache_extensions() failed to due to invalid cert

2021-01-14T13:36:09Z

This is the backport of #13755 to v1.1.1. Fixes #13698 Reviewed-by: Tomas Mraz (Merged from https://github.com/openssl/openssl/pull/13756)

Skip BOM when reading the config file

2021-01-14T10:23:50Z

Fixes #13840 Reviewed-by: Richard Levitte (Merged from https://github.com/openssl/openssl/pull/13857) (cherry picked from commit 4369a882a565c42673b28c586a5c46a8bca98d17)

OPENSSL_cpuid_setup FreeBSD arm update.

2021-01-14T08:37:19Z

when possible using the getauxval equivalent which has similar ids as Linux, instead of bad instructions catch approach. Reviewed-by: Ben Kaduk Reviewed-by: Matt Caswell (Merged from https://github.com/openssl/openssl/pull/13650) (cherry picked from commit 5eb24fbd1c3e0d130ba7f81f1ccf457a2b9d75ad)