aboutsummaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* Prepare for 1.1.1xOpenSSL_1_1_1-stableTomas Mraz2023-09-114-3/+11
| | | | | Reviewed-by: Matt Caswell <[email protected]> Release: yes
* Prepare for release of 1.1.1wOpenSSL_1_1_1wTomas Mraz2023-09-114-5/+5
| | | | | Reviewed-by: Matt Caswell <[email protected]> Release: yes
* Copyright year updatesTomas Mraz2023-09-1111-11/+11
| | | | | Reviewed-by: Matt Caswell <[email protected]> Release: yes
* Add CVE-2023-4807 fix to CHANGES and NEWSTomas Mraz2023-09-112-2/+23
| | | | | | | Reviewed-by: Matt Caswell <[email protected]> Reviewed-by: Hugo Landau <[email protected]> Reviewed-by: Paul Dale <[email protected]> (Merged from https://github.com/openssl/openssl/pull/22034)
* remove unused Appveyour configDmitry Misharov2023-09-111-78/+0
| | | | | | | | Reviewed-by: Hugo Landau <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> (Merged from https://github.com/openssl/openssl/pull/22000) (cherry picked from commit 8ac32e1e1b1a786366333acf897d332339610e6b)
* Fix error handling in CMS_EncryptedData_encryptBernd Edlinger2023-09-117-4/+38
| | | | | | | | | | | | | That caused several memory leaks in case of error. Also when the CMS object that is created by CMS_EncryptedData_encrypt is not used in the normal way, but instead just deleted by CMS_ContentInfo_free some memory was lost. Fixes #21985 Reviewed-by: Dmitry Belyavskiy <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> (Merged from https://github.com/openssl/openssl/pull/22008)
* Fix a possbile memleak in rsa_pub_encodeBernd Edlinger2023-09-092-2/+13
| | | | | | | | | That seems to be only an issue for RSA-PSS with parameters. Spotted by code review, so it looks like there is no test coverage for this. Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Hugo Landau <[email protected]> (Merged from https://github.com/openssl/openssl/pull/22007)
* Fix a possible memleak in eckey_priv_encodeBernd Edlinger2023-09-091-6/+11
| | | | | | | | | Additionally use OPENSSL_clear_free on the private key data in case of error. Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Hugo Landau <[email protected]> (Merged from https://github.com/openssl/openssl/pull/22007)
* Bump actions/checkout from 2 to 4dependabot[bot]2023-09-056-25/+25
| | | | | | | | | | | | | | | | | | | | | | | | Bumps [actions/checkout](https://github.com/actions/checkout) from 2 to 4. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/v2...v4) --- updated-dependencies: - dependency-name: actions/checkout dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <[email protected]> CLA: trivial Reviewed-by: Hugo Landau <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> (Merged from https://github.com/openssl/openssl/pull/21953) (cherry picked from commit d4231af60a8d04196b3b873c2fa8638daff36173)
* Avoid clobbering non-volatile XMM registersBernd Edlinger2023-09-021-2/+2
| | | | | | | | | | | | | | | | This affects some Poly1305 assembler functions which are only used for certain CPU types. Remove those functions for Windows targets, as a simple interim solution. Fixes #21522 Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Paul Dale <[email protected]> (Merged from https://github.com/openssl/openssl/pull/21808) (cherry picked from commit 7b8e27bc2e02238986d89ef0ece067ec1b48e165)
* Fix EVP_PKEY_asn1_copyhangze2023-08-161-0/+9
| | | | | | | | | Add the copy of the omitted ASN1 public key method and other members. Reviewed-by: Bernd Edlinger <[email protected]> Reviewed-by: Dmitry Belyavskiy <[email protected]> (Merged from https://github.com/openssl/openssl/pull/21125)
* Fix typo in function nameTianjia Zhang2023-08-021-1/+1
| | | | | | | | | | | | Signed-off-by: Tianjia Zhang <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Paul Dale <[email protected]> Reviewed-by: Tom Cosgrove <[email protected]> Reviewed-by: Hugo Landau <[email protected]> (Merged from https://github.com/openssl/openssl/pull/21608) (cherry picked from commit 38c70a161cc6f96682bd77c8a935c5767355438c)
* A null pointer dereference occurs when memory allocation failsyangyangtiantianlonglong2023-08-021-1/+4
| | | | | | | | | Fixes #21605 Reviewed-by: Hugo Landau <[email protected]> Reviewed-by: Matthias St. Pierre <[email protected]> Reviewed-by: Paul Dale <[email protected]> (Merged from https://github.com/openssl/openssl/pull/21606)
* Prepare for 1.1.1wMatt Caswell2023-08-014-3/+11
| | | | | Reviewed-by: Tomas Mraz <[email protected]> Release: yes
* Prepare for release of 1.1.1vOpenSSL_1_1_1vMatt Caswell2023-08-014-5/+5
| | | | | Reviewed-by: Tomas Mraz <[email protected]> Release: yes
* Copyright year updatesMatt Caswell2023-08-013-3/+3
| | | | | Reviewed-by: Tomas Mraz <[email protected]> Release: yes
* Add CHANGES/NEWS for CVE-2023-3817Tomas Mraz2023-07-312-0/+17
| | | | | | Reviewed-by: Paul Dale <[email protected]> Reviewed-by: Matt Caswell <[email protected]> (Merged from https://github.com/openssl/openssl/pull/21551)
* dhtest.c: Add test of DH_check() with q = p + 1Tomas Mraz2023-07-311-0/+12
| | | | | | | | | This must fail with DH_CHECK_INVALID_Q_VALUE and with DH_CHECK_Q_NOT_PRIME unset. Reviewed-by: Paul Dale <[email protected]> Reviewed-by: Matt Caswell <[email protected]> (Merged from https://github.com/openssl/openssl/pull/21551)
* DH_check(): Do not try checking q properties if it is obviously invalidTomas Mraz2023-07-311-2/+9
| | | | | | | | | | | | | | | | | | | If |q| >= |p| then the q value is obviously wrong as q is supposed to be a prime divisor of p-1. We check if p is overly large so this added test implies that q is not large either when performing subsequent tests using that q value. Otherwise if it is too large these additional checks of the q value such as the primality test can then trigger DoS by doing overly long computations. Fixes CVE-2023-3817 Reviewed-by: Paul Dale <[email protected]> Reviewed-by: Matt Caswell <[email protected]> (Merged from https://github.com/openssl/openssl/pull/21551)
* Make DH_check set some error bits in recently added errorBernd Edlinger2023-07-261-0/+1
| | | | | | | | | | | | | | | | The pre-existing error cases where DH_check returned zero are not related to the dh params in any way, but are only triggered by out-of-memory errors, therefore having *ret set to zero feels right, but since the new error case is triggered by too large p values that is something different. On the other hand some callers of this function might not be prepared to handle the return value correctly but only rely on *ret. Therefore we set some error bits in *ret as additional safety measure. Reviewed-by: Paul Dale <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> (Merged from https://github.com/openssl/openssl/pull/21533)
* Update CHANGES/NEWS for CVE-2023-3446Matt Caswell2023-07-192-2/+17
| | | | | | | | Reviewed-by: Paul Dale <[email protected]> Reviewed-by: Tom Cosgrove <[email protected]> Reviewed-by: Bernd Edlinger <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> (Merged from https://github.com/openssl/openssl/pull/21452)
* Add a test for CVE-2023-3446Matt Caswell2023-07-191-2/+13
| | | | | | | | | | | | Confirm that the only errors DH_check() finds with DH parameters with an excessively long modulus is that the modulus is too large. We should not be performing time consuming checks using that modulus. Reviewed-by: Paul Dale <[email protected]> Reviewed-by: Tom Cosgrove <[email protected]> Reviewed-by: Bernd Edlinger <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> (Merged from https://github.com/openssl/openssl/pull/21452)
* Fix DH_check() excessive time with over sized modulusMatt Caswell2023-07-195-3/+15
| | | | | | | | | | | | | | | | | | | | | | | | | | | | The DH_check() function checks numerous aspects of the key or parameters that have been supplied. Some of those checks use the supplied modulus value even if it is excessively large. There is already a maximum DH modulus size (10,000 bits) over which OpenSSL will not generate or derive keys. DH_check() will however still perform various tests for validity on such a large modulus. We introduce a new maximum (32,768) over which DH_check() will just fail. An application that calls DH_check() and supplies a key or parameters obtained from an untrusted source could be vulnerable to a Denial of Service attack. The function DH_check() is itself called by a number of other OpenSSL functions. An application calling any of those other functions may similarly be affected. The other functions affected by this are DH_check_ex() and EVP_PKEY_param_check(). CVE-2023-3446 Reviewed-by: Paul Dale <[email protected]> Reviewed-by: Tom Cosgrove <[email protected]> Reviewed-by: Bernd Edlinger <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> (Merged from https://github.com/openssl/openssl/pull/21452)
* Prepare for 1.1.1vTomas Mraz2023-05-304-3/+11
| | | | | Reviewed-by: Richard Levitte <[email protected]> Release: yes
* Prepare for release of 1.1.1uOpenSSL_1_1_1uTomas Mraz2023-05-304-5/+5
| | | | | Reviewed-by: Richard Levitte <[email protected]> Release: yes
* Copyright year updatesTomas Mraz2023-05-3019-19/+19
| | | | | Reviewed-by: Richard Levitte <[email protected]> Release: yes
* Restrict the size of OBJECT IDENTIFIERs that OBJ_obj2txt will translateRichard Levitte2023-05-293-0/+47
| | | | | | | | | | | | | | | | | | | | | | | | OBJ_obj2txt() would translate any size OBJECT IDENTIFIER to canonical numeric text form. For gigantic sub-identifiers, this would take a very long time, the time complexity being O(n^2) where n is the size of that sub-identifier. To mitigate this, a restriction on the size that OBJ_obj2txt() will translate to canonical numeric text form is added, based on RFC 2578 (STD 58), which says this: > 3.5. OBJECT IDENTIFIER values > > An OBJECT IDENTIFIER value is an ordered list of non-negative numbers. > For the SMIv2, each number in the list is referred to as a sub-identifier, > there are at most 128 sub-identifiers in a value, and each sub-identifier > has a maximum value of 2^32-1 (4294967295 decimal). Fixes otc/security#96 Fixes CVE-2023-2650 Reviewed-by: Matt Caswell <[email protected]> Reviewed-by: Tomas Mraz <[email protected]>
* x509: Handle ossl_policy_level_add_node errorsClemens Lang2023-05-291-4/+15
| | | | | | | | | | | | | | | | | | | | | The invocation of ossl_policy_level_add_node in tree_calculate_user_set did not have any error handling. Add it to prevent a memory leak for the allocated extra policy data. Also add error handling to sk_X509_POLICY_NODE_push to ensure that if a new node was allocated, but could not be added to the stack, it is freed correctly. Fix error handling if tree->user_policies cannot be allocated by returning 0, indicating failure, rather than 1. Signed-off-by: Clemens Lang <[email protected]> Reviewed-by: Dmitry Belyavskiy <[email protected]> Reviewed-by: Matt Caswell <[email protected]> Reviewed-by: Bernd Edlinger <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> (Merged from https://github.com/openssl/openssl/pull/21066)
* x509: Fix possible use-after-free when OOMClemens Lang2023-05-291-2/+10
| | | | | | | | | | | | | | | | | | | | | | | ossl_policy_level_add_node() first adds the new node to the level->nodes stack, and then attempts to add extra data if extra_data is true. If memory allocation or adding the extra data to tree->extra_data fails, the allocated node (that has already been added to the level->nodes stack) is freed using ossl_policy_node_free(), which leads to a potential use after free. Additionally, the tree's node count and the parent's child count would not be updated, despite the new node being added. Fix this by either performing the function's purpose completely, or not at all by reverting the changes on error. Signed-off-by: Clemens Lang <[email protected]> Reviewed-by: Dmitry Belyavskiy <[email protected]> Reviewed-by: Matt Caswell <[email protected]> Reviewed-by: Bernd Edlinger <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> (Merged from https://github.com/openssl/openssl/pull/21066)
* util/mkdef.pl: Take shlib_variant into accountRichard Levitte2023-05-251-0/+1
| | | | | | | | | | | | For platforms using import libraries, the lack of this causes a disjoint between the name of the DLL that's produced, and the corresponding import library. Fixes #20942 (follows up #20732) Reviewed-by: Hugo Landau <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> (Merged from https://github.com/openssl/openssl/pull/20968)
* Add OpenSSL OMC key to list of key fingerprintsTomas Mraz2023-05-231-0/+5
| | | | | | Reviewed-by: Paul Dale <[email protected]> Reviewed-by: Richard Levitte <[email protected]> (Merged from https://github.com/openssl/openssl/pull/21030)
* Fix the padlock engineBernd Edlinger2023-05-211-2/+13
| | | | | | | | | | | | ... after it was broken for almost 5 years, since the first 1.1.1 release. Note: The last working version was 1.1.0l release. Fixes #20073 Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Ben Kaduk <[email protected]> (Merged from https://github.com/openssl/openssl/pull/20147)
* Fix stack corruption in ui_readBernd Edlinger2023-05-172-3/+5
| | | | | | | | | | | | | | | | This is an alternative to #20893 Additionally this fixes also a possible issue in UI_UTIL_read_pw: When UI_new returns NULL, the result code would still be zero as if UI_UTIL_read_pw succeeded, but the password buffer is left uninitialized, with subsequent possible stack corruption or worse. Reviewed-by: Richard Levitte <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> (Merged from https://github.com/openssl/openssl/pull/20957) (cherry picked from commit a64c48cff88e032cf9513578493c4536df725a22)
* Add negative integer check when using ASN1_BIT_STRINGmlitre2023-05-041-0/+6
| | | | | | | | | | | | | The negative integer check is done to prevent potential overflow. Fixes #20719. CLA: trivial Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Paul Dale <[email protected]> (Merged from https://github.com/openssl/openssl/pull/20862) (cherry picked from commit 1258a8e4361320cd3cfaf9ede692492ce01034c8)
* Drop invalid ERR_raise() call from incorrect cherry pickTomas Mraz2023-05-011-1/+0
| | | | | | | | Fixes #20849 Reviewed-by: Tom Cosgrove <[email protected]> Reviewed-by: Matt Caswell <[email protected]> (Merged from https://github.com/openssl/openssl/pull/20852)
* Have Windows and VMS build files use shlib_variantRichard Levitte2023-04-212-5/+8
| | | | | | | | | | | This is an omission, it should have been in place a long time ago. Fixes #20732 Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Tom Cosgrove <[email protected]> Reviewed-by: Hugo Landau <[email protected]> (Merged from https://github.com/openssl/openssl/pull/20734)
* Re-add BN_F_OSSL_BN_RSA_DO_UNBLIND which was incorrectly removedTomas Mraz2023-04-201-0/+1
| | | | | | | Reviewed-by: Dmitry Belyavskiy <[email protected]> Reviewed-by: Matt Caswell <[email protected]> Reviewed-by: Paul Dale <[email protected]> (Merged from https://github.com/openssl/openssl/pull/20784)
* Alternative fix for CVE-2022-4304Bernd Edlinger2023-03-316-69/+111
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This is about a timing leak in the topmost limb of the internal result of RSA_private_decrypt, before the padding check. There are in fact at least three bugs together that caused the timing leak: First and probably most important is the fact that the blinding did not use the constant time code path at all when the RSA object was used for a private decrypt, due to the fact that the Montgomery context rsa->_method_mod_n was not set up early enough in rsa_ossl_private_decrypt, when BN_BLINDING_create_param needed it, and that was persisted as blinding->m_ctx, although the RSA object creates the Montgomery context just a bit later. Then the infamous bn_correct_top was used on the secret value right after the blinding was removed. And finally the function BN_bn2binpad did not use the constant-time code path since the BN_FLG_CONSTTIME was not set on the secret value. In order to address the first problem, this patch makes sure that the rsa->_method_mod_n is initialized right before the blinding context. And to fix the second problem, we add a new utility function bn_correct_top_consttime, a const-time variant of bn_correct_top. Together with the fact, that BN_bn2binpad is already constant time if the flag BN_FLG_CONSTTIME is set, this should eliminate the timing oracle completely. In addition the no-asm variant may also have branches that depend on secret values, because the last invocation of bn_sub_words in bn_from_montgomery_word had branches when the function is compiled by certain gcc compiler versions, due to the clumsy coding style. So additionally this patch stream-lined the no-asm C-code in order to avoid branches where possible and improve the resulting code quality. Reviewed-by: Paul Dale <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> (Merged from https://github.com/openssl/openssl/pull/20284)
* Revert "Fix Timing Oracle in RSA decryption"Bernd Edlinger2023-03-319-684/+20
| | | | | | | | This reverts commit 43d8f88511991533f53680a751e9326999a6a31f. Reviewed-by: Paul Dale <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> (Merged from https://github.com/openssl/openssl/pull/20284)
* Fix documentation of X509_VERIFY_PARAM_add0_policy()Tomas Mraz2023-03-283-2/+13
| | | | | | | | | | The function was incorrectly documented as enabling policy checking. Fixes: CVE-2023-0466 Reviewed-by: Matt Caswell <[email protected]> Reviewed-by: Paul Dale <[email protected]> (Merged from https://github.com/openssl/openssl/pull/20564)
* Updated CHANGES and NEWS for CVE-2023-0465Matt Caswell2023-03-282-2/+11
| | | | | | | | | | Also updated the entries for CVE-2023-0464 Related-to: CVE-2023-0465 Reviewed-by: Hugo Landau <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> (Merged from https://github.com/openssl/openssl/pull/20588)
* Add a Certificate Policies TestMatt Caswell2023-03-281-1/+12
| | | | | | | | | | | | Test that a valid certificate policy is accepted and that an invalid certificate policy is rejected. Specifically we are checking that a leaf certificate with an invalid policy is detected. Related-to: CVE-2023-0465 Reviewed-by: Hugo Landau <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> (Merged from https://github.com/openssl/openssl/pull/20588)
* Ensure that EXFLAG_INVALID_POLICY is checked even in leaf certsMatt Caswell2023-03-281-2/+9
| | | | | | | | | | | | Even though we check the leaf cert to confirm it is valid, we later ignored the invalid flag and did not notice that the leaf cert was bad. Fixes: CVE-2023-0465 Reviewed-by: Hugo Landau <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> (Merged from https://github.com/openssl/openssl/pull/20588)
* Generate some certificates with the certificatePolicies extensionMatt Caswell2023-03-235-2/+72
| | | | | | | | Related-to: CVE-2023-0465 Reviewed-by: Hugo Landau <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> (Merged from https://github.com/openssl/openssl/pull/20588)
* Disable the policy tree exponential growth test conditionallyPauli2023-03-231-0/+2
| | | | | | | | | | If there is no EC specified, the test won't pass. Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Shane Lontis <[email protected]> (Merged from https://github.com/openssl/openssl/pull/20572) (cherry picked from commit f5935fcf8e4bc2191ac4a32e5b7ec32817642f1e)
* changes: note about policy tree size limits and circumventionPauli2023-03-221-1/+7
| | | | | | Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Shane Lontis <[email protected]> (Merged from https://github.com/openssl/openssl/pull/20569)
* test: add test cases for the policy resource overusePauli2023-03-225-0/+567
| | | | | | | | | | | These trees have pathological properties with respect to building. The small tree stays within the imposed limit, the large tree doesn't. The large tree would consume over 150Gb of RAM to process. Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Shane Lontis <[email protected]> (Merged from https://github.com/openssl/openssl/pull/20569)
* x509: excessive resource use verifying policy constraintsPauli2023-03-223-14/+43
| | | | | | | | | | | | | | | A security vulnerability has been identified in all supported versions of OpenSSL related to the verification of X.509 certificate chains that include policy constraints. Attackers may be able to exploit this vulnerability by creating a malicious certificate chain that triggers exponential use of computational resources, leading to a denial-of-service (DoS) attack on affected systems. Fixes CVE-2023-0464 Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Shane Lontis <[email protected]> (Merged from https://github.com/openssl/openssl/pull/20569)
* Fix Configure test for -mips in CFLAGSMike Gilbert2023-03-171-1/+1
| | | | | | | | | | | | | | | We want to add -mips2 or -mips3 only if the user hasn't already specified a mips version in CFLAGS. The existing test was a double-negative. CLA: trivial Fixes: https://github.com/openssl/openssl/issues/20214 Reviewed-by: Matt Caswell <[email protected]> Reviewed-by: Shane Lontis <[email protected]> Reviewed-by: Paul Dale <[email protected]> (Merged from https://github.com/openssl/openssl/pull/20536)
* Fix copyright disclaimer.Pauli2023-03-161-1/+1
| | | | | | | | | | The mention of the GPL shouldn't have been there. Reviewed-by: Tim Hudson <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> (Merged from https://github.com/openssl/openssl/pull/20517) (cherry picked from commit c879f8ac56170a5cf929fab8067beb2a5902be2b)
generated by cgit (git 2.51.2) at 2026-10-25 12:58:53 +0100