openssl/include, branch openssl-3.3.3

Copyright year updates

2025-02-11T14:32:03Z

Reviewed-by: Tomas Mraz Reviewed-by: Matt Caswell Release: yes

Fix timing side-channel in ECDSA signature computation

2025-01-20T08:37:18Z

There is a timing signal of around 300 nanoseconds when the top word of the inverted ECDSA nonce value is zero. This can happen with significant probability only for some of the supported elliptic curves. In particular the NIST P-521 curve is affected. To be able to measure this leak, the attacker process must either be located in the same physical computer or must have a very fast network connection with low latency. Attacks on ECDSA nonce are also known as Minerva attack. Fixes CVE-2024-13176 Reviewed-by: Tim Hudson Reviewed-by: Neil Horman Reviewed-by: Paul Dale (Merged from https://github.com/openssl/openssl/pull/26429) (cherry picked from commit 63c40a66c5dc287485705d06122d3a6e74a6a203)

Fix CMS encryption with key agreement when originator set

2025-01-06T10:45:45Z

OpenSSL currently does not support encryption with originator flag so it should fail nicely instead of segfaulting. Reviewed-by: Hugo Landau Reviewed-by: David von Oheimb Reviewed-by: Tomas Mraz (Merged from https://github.com/openssl/openssl/pull/26014) (cherry picked from commit 894e69e747a93a1f166891f5f029b78c68088f50)

safe_math.h: Check if GNUC is defined

2024-12-19T16:47:01Z

REF:https://bugzilla.tianocore.org/show_bug.cgi?id=4880 Facing the below issue after openssl is upgraded Edk2\CryptoPkg\Library\OpensslLib\openssl\include\internal/safe_math.h(19): warning C4668: '__GNUC__' is not defined as a preprocessor macro, replacing with '0' for '#if/#elif' CLA: trivial Reviewed-by: Gerd Hoffmann Signed-off-by: Kalavakolanu Hema Anmisha Reviewed-by: Paul Dale Reviewed-by: Tom Cosgrove Reviewed-by: Tomas Mraz (Merged from https://github.com/openssl/openssl/pull/26204) (cherry picked from commit 53b34561b56b60a812f8f65c777d469e18151e8d)

Fix potential use-after-free in REF_PRINT_COUNT

2024-12-10T13:59:01Z

We use REF_PRINT_COUNT to dump out the value of various reference counters in our code However, we commonly use this macro after an increment or decrement. On increment its fine, but on decrement its not, because the macro dereferences the object holding the counter value, which may be freed by another thread, as we've given up our ref count to it prior to using the macro. The rule is that we can't reference memory for an object once we've released our reference, so lets fix this by altering REF_PRINT_COUNT to accept the value returned by CRYPTO_[UP|DOWN]_REF instead. The eliminates the need to dereference the memory the object points to an allows us to use the call after we release our reference count Reviewed-by: Richard Levitte Reviewed-by: Tomas Mraz (Merged from https://github.com/openssl/openssl/pull/25664) (cherry picked from commit dc10ffc2834e0d2f5ebc1c3e29bd97f1f43a0ead)

Fix memory ordering guarantees and TSAN errors

2024-12-10T13:59:00Z

If we had refcounted object allowing lockless writes the relaxed semantics on DOWN_REF would allow scheduling these writes after simultaneous release of the object by another thread. We do not have any such objects yet, but better to make the refcount correct just in case we will have them in future. TSAN doesn't properly understand this so we use even stronger acq_rel semantics if building with TSAN. Fixes #25660 Reviewed-by: Neil Horman Reviewed-by: Richard Levitte (Merged from https://github.com/openssl/openssl/pull/25664) (cherry picked from commit 3bf273b21b3e21cca9cd143ed9016397bd7dbb57)

Increase limit for CRL download

2024-10-08T14:00:10Z

Reviewed-by: Matt Caswell Reviewed-by: Tom Cosgrove Reviewed-by: Tomas Mraz (Merged from https://github.com/openssl/openssl/pull/25608) (cherry picked from commit cdbe47bf3c02979183d1f66b42c511a18a63c61d)

Rename list macros

2024-09-26T08:03:02Z

The quic implementation defined a set of LIST_* macros for list manipulation, which conflicts with the generally support BSD api found in the queue.h system header. While this isn't normally a problem, A report arrived indicating that MacOSX appears to implicitly include queue.h from another system header which causes definition conflicts. As the openssl macros are internal only, it seems the most sensible thing to do is place them in a well known namespace for our library to avoid the conflict, so add an OSSL_ prefix to all our macros Fixes #25516 Reviewed-by: Paul Dale Reviewed-by: Tim Hudson Reviewed-by: Tom Cosgrove Reviewed-by: Saša Nedvědický Reviewed-by: David von Oheimb (Merged from https://github.com/openssl/openssl/pull/25519) (cherry picked from commit c4ec708bd58715fab10b8a6085ac89d79615b250)

Copyright year updates

2024-09-03T12:44:27Z

Reviewed-by: Neil Horman Release: yes

Fix '--strict-warnings' build breakage

2024-08-21T13:41:24Z

... due to a missing const. Reviewed-by: Tom Cosgrove Reviewed-by: Paul Dale Reviewed-by: Tomas Mraz (Merged from https://github.com/openssl/openssl/pull/25111)

openssl/include, branch openssl-3.3.3

Copyright year updates

Fix timing side-channel in ECDSA signature computation

Fix CMS encryption with key agreement when originator set

safe_math.h: Check if __GNUC__ is defined

Fix potential use-after-free in REF_PRINT_COUNT

Fix memory ordering guarantees and TSAN errors

Increase limit for CRL download

Rename list macros

Copyright year updates

Fix '--strict-warnings' build breakage

safe_math.h: Check if GNUC is defined