aboutsummaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* Provider compat CI: Force copy of fips.so and fipsmodule.cnfopenssl-3.0Tomas Mraz2026-09-071-2/+2
| | | | | | | | | | | If the target branch is >4.0 the destination files can be read-only. Reviewed-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Norbert Pocs <[email protected]> Merge-date: Mon Sep 7 18:16:30 2026 Merged-from: https://github.com/openssl/openssl/pull/32662 (cherry picked from commit e80b14876a69a758d2eb2a916937d846cba3967b)
* Do not advertise OPENSSL_INIT_LOAD_CONFIG in optsdone too soonPavol Žáčik2026-09-071-3/+11
| | | | | | | | | | | | | | | | | | | | | | | | If there was no explicit call to OPENSSL_init_crypto before starting threading, it would result in a race between loading the config in one thread, and attempting to use features dependent on the config, e.g., providers in other threads. The first thread that gets into OPENSSL_init_crypto would start loading the config and set `loading` to 1 The same thread may re-enter the function recursively and should do nothing, but it would actually update `optsdone` with OPENSSL_INIT_LOAD_CONFIG, even though the loading has not finished yet. This commit fixes the issue by masking the opts bit out if we re-enter OPENSSL_init_crypto. Assisted-by: Claude:claude-opus-4.8 (cherry picked from commit d115fd05e3986e90db18776ad49103fadccbe52f) Reviewed-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Dmitry Belyavskiy <[email protected]> MergeDate: Mon Sep 7 08:37:37 2026 (Merged from https://github.com/openssl/openssl/pull/32660) (cherry picked from commit 95f41f0ee0eafe1a694ae4607a18679f63b8299e)
* Document application defined security callbacksTim Perry2026-09-031-9/+102
| | | | | | | | | | Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Andrew Dinh <[email protected]> Reviewed-by: Frederik Wedel-Heinen <[email protected]> Reviewed-by: Neil Horman <[email protected]> Merge-date: Thu Sep 3 09:30:40 2026 Merged-from: https://github.com/openssl/openssl/pull/31917 (cherry picked from commit fe927d455c36e18aec731b45514220915e30c2f0)
* Fix memory leak in load_key_certs_crls() when add/push failsherbenderbler2026-09-031-6/+15
| | | | | | | | | | | | | | | | | | | When X509_add_cert() or sk_X509_CRL_push() failed, the cert or CRL from OSSL_STORE was not freed. Free on failure to avoid a leak. Issue #30364 Fixes: 6d382c74b375 "Use OSSL_STORE for load_{,pub}key() and load_cert() in apps/lib/apps.c" Fixes: d7fcee3b3b5fa "OSSL_HTTP_parse_url(): add optional port number return parameter and strengthen documentation" Reviewed-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Nikola Pajkovsky <[email protected]> (cherry picked from commit 9ac29bc8579dd9632bd50900675ff7900f5f7ef1) Reviewed-by: David von Oheimb <[email protected]> Reviewed-by: Nikola Pajkovsky <[email protected]> Merge-date: Thu Sep 3 09:17:33 2026 Merged-from: https://github.com/openssl/openssl/pull/30927
* doc: correct pkcs12 passin and passout descriptionsMounir IDRASSI2026-09-011-3/+8
| | | | | | | | | | | | | | | | | The pkcs12 documentation incorrectly says that -passin is used to encrypt output private keys. The implementation uses -passin for input and -passout for output, with direction-specific roles depending on -export. Describe both options explicitly and link -passout to the shared passphrase-options documentation. Assisted-by: Codex:gpt-5.6-sol Reviewed-by: Richard Levitte <[email protected]> Reviewed-by: Jakub Zelenka <[email protected]> Merge-date: Tue Sep 1 14:10:54 2026 Merged-from: https://github.com/openssl/openssl/pull/32315 (cherry picked from commit 2c5f67b894e4f0703ab23262800897b81586651a)
* TLS 1.3: Apply the cap to the lifetime hint in the sessionDaniel Kubec2026-09-011-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | Commit 5a85e41 added a 7 day cap on the TLSv1.3 ticket lifetime as required by RFC 9846, but applied it to a local variable after the value had already been stored in the session and after its last use, so it had no effect. The uncapped value was still returned by SSL_SESSION_get_ticket_lifetime_hint() and used by the client when deciding whether to offer the ticket for resumption. Apply the cap to the lifetime hint in the session. - RFC 9846 4.7.1: Servers MUST NOT use any value greater than 604800 seconds (7 days). The value of zero indicates that the ticket should be discarded immediately. Clients MUST NOT use tickets for longer than 7 days after issuance, regardless of the ticket_lifetime, and MAY delete tickets earlier based on local policy. Fixes #32244 Reviewed-by: Tom Cosgrove <[email protected]> Reviewed-by: Richard Levitte <[email protected]> Reviewed-by: Mounir Idrassi <[email protected]> Merge-date: Tue Sep 1 13:47:48 2026 Merged-from: https://github.com/openssl/openssl/pull/32240 (cherry picked from commit 66985198d23337651f48c3affbdc7564bcdb903a)
* remove redundant checksPauli2026-09-011-3/+0
| | | | | | Reviewed-by: Richard Levitte <[email protected]> Reviewed-by: Nikola Pajkovsky <[email protected]> (Merged from https://github.com/openssl/openssl/pull/32560)
* test: cover non-legacy cipher parameter decodersPauli2026-09-011-0/+71
| | | | | | | | | | Check parameter metadata exposed by common, CTS, multiblock and TDES cipher implementations. Assisted-by: ChatGPT:gpt-5.6Sol Reviewed-by: Richard Levitte <[email protected]> Reviewed-by: Nikola Pajkovsky <[email protected]> (Merged from https://github.com/openssl/openssl/pull/32560)
* aes-ctr-hmac: add range checking on AADPauli2026-09-011-3/+31
| | | | | | | | | | | Also correct parameter type from unsigned integer to octet string. This triggers fuzzing failures. Assisted-by: ChatGPT:gpt-5.6Sol Reviewed-by: Richard Levitte <[email protected]> Reviewed-by: Nikola Pajkovsky <[email protected]> (Merged from https://github.com/openssl/openssl/pull/32560)
* Fix EVP_CIPHER_CTX leak in BIO_f_cipher() on BIO_dup_chain()Mounir IDRASSI2026-08-312-3/+23
| | | | | | | | | | | | | | | | | | | | | | | | | BIO_dup_chain() builds each duplicate BIO via BIO_new(), which for a cipher BIO runs enc_new() and allocates a fresh EVP_CIPHER_CTX. The BIO_CTRL_DUP handler then allocated a second context and overwrote the pointer, orphaning (and leaking) the enc_new() allocation, one leaked EVP_CIPHER_CTX per duplicated cipher BIO. Reuse the context that enc_new() already allocated by copying into it, mirroring the digest filter (bio_md.c). This also removes the redundant allocation and its failure path. Add a regression test that dup is an initialized cipher BIO and frees it, exercising the leak path so it is caught under a leak sanitizer. Fixes #31803 Reviewed-by: Jakub Zelenka <[email protected]> Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Andrew Dinh <[email protected]> MergeDate: Sat Aug 29 12:47:08 2026 (Merged from https://github.com/openssl/openssl/pull/31854) (cherry picked from commit ff542b6de282b903d296e7a53c3bd3f495e3a7d3)
* providers: check OSSL_DECODER_CTX_set_construct_data() return valueNorbert Pocs2026-08-311-1/+2
| | | | | | | | | | | | | | | | | | | | | It may return a failure if the decoder is frozen, and its return value is checked elsewhere, as was pointed out by Coverity. Handle the return value. [ Only changes to file_store.c are applied, as winstore_store.c is not present in openssl-3.0, by virtue of winstore having been added during openssl-3.2 development window. ] Resolves: https://scan5.scan.coverity.com/#/project-view/65248/10222?selectedIssue=1700562 Complements: 63f187cfedd2 "STORE: Add a built-in 'file:' storemgmt implementation (loader)" Signed-off-by: Norbert Pocs <[email protected]> Reviewed-by: Paul Dale <[email protected]> Reviewed-by: Nikola Pajkovsky <[email protected]> Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> Merge-date: Mon Aug 31 05:19:13 2026 Merged-from: https://github.com/openssl/openssl/pull/32576 (cherry picked from commit acde7bc05a9979abce12c4f92d2a0aa0a3d61175)
* docs: fix doubled words in man pages and design docszaveshaa2026-08-276-7/+7
| | | | | | | | | | | | | Fix 23 occurrences of accidentally doubled words like 'in in', 'the the', 'been been' across man1/man3/man7 pages, internal documentation and design documents. CLA: trivial Reviewed-by: Frederik Wedel-Heinen <[email protected]> Reviewed-by: Paul Dale <[email protected]> Merge-date: Thu Aug 27 16:00:39 2026 Merged-from: https://github.com/openssl/openssl/pull/32461 (cherry picked from commit 6b736d031e9bc7df908292f7f0a09ed5fd562f5a)
* ocsp: Reject update times X509_cmp_time() cannot compareMounir IDRASSI2026-08-272-5/+68
| | | | | | | | | | | | | | | | | | | | | | | | | OCSP_check_validity() accepts GeneralizedTime forms that X509_cmp_time() cannot compare. The latter requires the canonical RFC 5280 form and returns 0 for numeric UTC offsets and fractional seconds. That error was treated as an in-range result, allowing OCSP freshness checks to be bypassed. Treat errors from the initial thisUpdate and nextUpdate comparisons as field errors. Run the optional maximum-age check only after the initial thisUpdate comparison succeeds, avoiding a duplicate field error. Add regression coverage for offset and fractional forms, including the maximum-age path. Fixes #32377 Assisted-by: Codex:gpt-5.6-sol Signed-off-by: Mounir IDRASSI <[email protected]> Reviewed-by: Bob Beck <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> Merge-date: Thu Aug 27 15:15:28 2026 Merged-from: https://github.com/openssl/openssl/pull/32396 (cherry picked from commit 6ceaf1dfe6729853961c6f53e97e635e82da9168)
* Restore the check for missing IV param in evp_cipher_asn1_to_param_exBernd Edlinger2026-08-274-3/+42
| | | | | | | | | | | | | | | STREAM ciphers (RC4) and WRAP MODE ciphers (CMS3DESwrap) do not have an IV parameter value, all other ciphers need an IV value, previously the missing IV param value was handled as an error condition. The check that an IV value is there was accidentally removed for all ciphers. This restores the check for all ciphers except RC4. Fixes: 114d99b46bfb ("Fix incomplete checks for EVP_CIPHER_asn1_to_param") Reviewed-by: Dmitry Belyavskiy <[email protected]> Reviewed-by: Mounir Idrassi <[email protected]> Merge-date: Thu Aug 27 15:07:58 2026 Merged-from: https://github.com/openssl/openssl/pull/32394 (cherry picked from commit 1671f994548a1a33246859ab6cc43200b1c65d87)
* update cms_pwri_kek_oob.der blob to use a 16 byte IV valueBernd Edlinger2026-08-271-0/+0
| | | | | | | | | | | | | | | | | | | | | | | | This changes the PWRI-KEK blob to use a 16 byte long IV value which is needed for AES-128-CFB. Thus ./test/recipes/80-test_cmsapi_data/cms_pwri_kek_oob.der changes from: 69:d=6 hl=2 l= 11 prim: OBJECT :id-alg-PWRI-KEK 82:d=6 hl=2 l= 11 cons: SEQUENCE 84:d=7 hl=2 l= 9 prim: OBJECT :aes-128-cfb 95:d=5 hl=2 l= 2 prim: OCTET STRING [HEX DUMP]:0000 to: 69:d=6 hl=2 l= 11 prim: OBJECT :id-alg-PWRI-KEK 82:d=6 hl=2 l= 29 cons: SEQUENCE 84:d=7 hl=2 l= 9 prim: OBJECT :aes-128-cfb 95:d=7 hl=2 l= 16 prim: OCTET STRING [HEX DUMP]:00000000000000000000000000000000 113:d=5 hl=2 l= 2 prim: OCTET STRING [HEX DUMP]:0000 Reviewed-by: Dmitry Belyavskiy <[email protected]> Reviewed-by: Mounir Idrassi <[email protected]> Merge-date: Thu Aug 27 15:07:57 2026 Merged-from: https://github.com/openssl/openssl/pull/32394 (cherry picked from commit 4cf673a3d50b0d04d65c54c6ebb6932bb9040cf4)
* .github/workflows: add openssl-4.0 and openssl-3.6 to CIMilan Broz2026-08-271-1/+13
| | | | | | | | | Add missing stable branches. Reviewed-by: Nikola Pajkovsky <[email protected]> Reviewed-by: Norbert Pocs <[email protected]> Merge-date: Thu Aug 27 14:54:29 2026 Merged-from: https://github.com/openssl/openssl/pull/32323
* doc: clarify X509_NAME_ENTRY get_object/get_data memory semanticskovan2026-08-271-6/+6
| | | | | | | | | | | | | | - Fix typos: "in and ASN1_OBJECT" -> "in an ASN1_OBJECT" - Clarify that returned pointers are internal and must not be freed Fixes https://github.com/openssl/openssl/issues/28156 Assisted-by: Claude:claude-opus-4-5 Reviewed-by: Andrew Dinh <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> Merge-date: Thu Aug 27 13:27:26 2026 Merged-from: https://github.com/openssl/openssl/pull/29887 (cherry picked from commit dadf861592f4374b4c6fe55ad43e508fc69e109b)
* CI: skip rejection-path test under fuzzing buildsDaniel Kubec2026-08-271-0/+11
| | | | | | | | | | Assisted-by: Claude:claude-fable-5 Reviewed-by: Jakub Zelenka <[email protected]> Reviewed-by: Milan Broz <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> Merge-date: Thu Aug 27 07:09:00 2026 Merged-from: https://github.com/openssl/openssl/pull/32521 (cherry picked from commit 3be64e3d8016161c19ebd86012936d121e208cc1)
* Prepare for 3.0.23openssl-machine2026-08-253-3/+11
| | | | | | | Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Milan Broz <[email protected]> MergeDate: Tue Aug 25 12:14:28 2026 Release: yes
* Prepare for release of 3.0.22openssl-3.0.22openssl-machine2026-08-253-4/+4
| | | | | | | Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Milan Broz <[email protected]> MergeDate: Tue Aug 25 12:14:23 2026 Release: yes
* make updateopenssl-machine2026-08-252-31/+31
| | | | | | | Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Milan Broz <[email protected]> MergeDate: Tue Aug 25 12:14:21 2026 Release: yes
* Copyright year updatesopenssl-machine2026-08-2568-68/+68
| | | | | | | Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Milan Broz <[email protected]> MergeDate: Tue Aug 25 12:12:41 2026 Release: yes
* CHANGES.md, NEWS.md: update for 3.0.22Eugene Syromiatnikov2026-08-252-1/+147
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 3.0.22 CHANGES.md includes the following: * CVE-2026-54874, CVE-2026-63072, CVE-2026-63074, CVE-2026-63076, CVE-2026-75803 * https://github.com/openssl/openssl/pull/31174 "Enforce RFC 8446 ticket lifetime limit for TLS 1.3 client" (already present) * https://github.com/openssl/openssl/pull/31578 "Backport PR #30313 into 3.0 branch." * https://github.com/openssl/openssl/pull/32417 "[3.0] Reject explicitly supplied invalid tags and generate tags for empty AEAD messages" (included as CVE-2026-75803) * https://github.com/openssl/openssl/pull/32427 "Backport #32256 openssl 4.0 to 3.0" 3.0.22 NEWS.md includes the following: * CVE-2026-54874, CVE-2026-63072, CVE-2026-63074, CVE-2026-63076, CVE-2026-75803 * https://github.com/openssl/openssl/pull/32417 "[3.0] Reject explicitly supplied invalid tags and generate tags for empty AEAD messages" (included as CVE-2026-75803) * https://github.com/openssl/openssl/pull/32427 "Backport #32256 openssl 4.0 to 3.0" Signed-off-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Milan Broz <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Bob Beck <[email protected]> Merge-date: Tue Aug 25 11:38:33 2026
* CHANGES.md, NEWS.md: reorder HollowByte change log record, add missing periodEugene Syromiatnikov2026-08-252-15/+16
| | | | | | | | | | | | | Move HollowByte change log record after records with assigned CVE numbers and severity ratings, add period at the end of the lead sentence, add a link to the PR in the comment. Complements: d01f86f21948 "Update CHANGES/NEWS to mention the HollowByte fix" Signed-off-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Milan Broz <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Bob Beck <[email protected]> Merge-date: Tue Aug 25 11:38:32 2026
* CHANGES.md: rephrase TLS 1.3 ticket lifetime cap change log recordEugene Syromiatnikov2026-08-251-9/+6
| | | | | | | | | Complements: 7e82c32134aa "Enforce RFC 8446 ticket lifetime limit for TLS 1.3 client" Signed-off-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Milan Broz <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Bob Beck <[email protected]> Merge-date: Tue Aug 25 11:38:30 2026
* ssl/record: lower the DTLS unprocessed_rcds queue limitMatt Caswell2026-08-243-7/+19
| | | | | | | | | | | | | | | | | | | | | | | | | 100 buffered next-epoch records is far more than a normal handshake ever needs. A peer that has already completed its side of the epoch transition may send more than one record under the new epoch before we catch up and bump our own receive epoch - for example, application data sent immediately once the peer considers the handshake done - but real-world bursts like that are still small. Now that each entry only costs as much memory as the record actually received, the limit mainly serves as a ceiling on worst-case per-connection memory use, so lower it to 16 to keep that ceiling smaller while still leaving ample headroom over legitimate usage. dtls1_buffer_record() serves three queues here, so take the limit as an argument rather than tightening all of them. Only unprocessed_rcds gets the lower limit: processed_rcds is filled from unprocessed_rcds and so cannot exceed it in any case, and buffered_app_data holds application data that arrived between ChangeCipherSpec and Finished, which is not the queue this ceiling is aimed at. Assisted-by: Claude:claude-opus-5 Reviewed-by: Milan Broz <[email protected]> Reviewed-by: Andrew Dinh <[email protected]> Merge-date: Mon Aug 24 15:40:45 2026
* Avoid full read buffer allocation when buffering DTLS recordsMatt Caswell2026-08-243-31/+87
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | dtls1_buffer_record() is used to hold onto a DTLS record across three different scenarios: a record arriving early for the next epoch while a handshake is in progress, re-queuing a record once the epoch catches up and it has been decrypted, and application data arriving between ChangeCipherSpec and Finished. In all three cases it took ownership of the entire live read buffer (sized for the largest possible record, ~16.7KB) and allocated a brand new one to carry on reading, regardless of how small the buffered record actually was. With each of the three queues capped at 100 entries, a peer could send a stream of tiny bogus records and force a disproportionate amount of heap allocation per connection. Instead, copy only the record's own on-wire bytes (header plus ciphertext, or header plus plaintext for an already-decrypted record) into the queue entry, and leave the live read buffer untouched. On retrieval, copy those bytes back into the live buffer and rebase any SSL3_RECORD data/input pointers that pointed into the original packet, rather than handing out a pointer to a standalone allocation. Memory use is now proportional to what the peer actually sends. Fixes CVE-2026-54874 Assisted-by: Claude:claude-sonnet-4-6 Assisted-by: Claude:claude-opus-5 Reviewed-by: Milan Broz <[email protected]> Reviewed-by: Andrew Dinh <[email protected]> Merge-date: Mon Aug 24 15:40:45 2026
* Fix heap buffer overflow (8-byte OOB write) in AES-WRAP-PAD unwrapDaniel Kubec2026-08-241-1/+8
| | | | | | | | | | | | On its integrity-failure paths that primitive writes and cleanses up to inlen bytes of the output buffer. Size the buffer for that worst case so a failed unwrap cannot write past the allocation. Fixes CVE-2026-63072 Reviewed-by: Milan Broz <[email protected]> Reviewed-by: Andrew Dinh <[email protected]> Merge-date: Mon Aug 24 14:44:55 2026
* Add test for CVE-2026-63072Daniel Kubec2026-08-242-3/+103
| | | | | | | Assisted-by: Claude:claude-fable-5 Reviewed-by: Milan Broz <[email protected]> Reviewed-by: Andrew Dinh <[email protected]> Merge-date: Mon Aug 24 14:44:54 2026
* Fix unbounded cert cache growth in cmpNeil Horman2026-08-241-1/+14
| | | | | | | | | | | | | | | | | | | | | | | If a remote user sends cmp messages to a server with a list of extraCerts and the message is rejected, the extraCerts from the message remain in the server contexts untrusted certificate stack. This exposes servers with long lived ctx objects to denial of service attacks in which an attacker sends messages intending to be rejected with a large list of additional cerificated repeatedly, forcing the server to store them indefinately. Fix it by rolling back the added extra certs if the message is rejected, using the same method we do when the context is configured to not do caching at all. Fixes openssl/srt#224 Fixes CVE-2026-63074 Reviewed-by: Milan Broz <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Igor Ustinov <[email protected]> Merge-date: Mon Aug 24 12:45:55 2026
* Add a test for restricting growth in cmp cert cacheNeil Horman2026-08-243-2/+359
| | | | | | | | | | | Test to ensure that if certs are rejected we don't add them unboundedly to the cmp contexts cert cache. Assisted-by: Claude sonnet 4.6 Reviewed-by: Milan Broz <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Igor Ustinov <[email protected]> Merge-date: Mon Aug 24 12:45:54 2026
* Fix Remote NULL deref in ossl_cmp_calc_protection() via crafted protectionAlgDaniel Kubec2026-08-221-1/+1
| | | | | | | | | | | | | | | | | ossl_cmp_calc_protection() only checked whether the protectionAlg parameter (ppval) was NULL before treating it as a PBMParameter ASN1_STRING. X509_ALGOR_get0() does not validate the ASN.1 type of the parameter against what the caller expects. For id-PasswordBasedMAC, a crafted message can encode the parameter as a BOOLEAN instead of the expected PBMParameter SEQUENCE. Because the ASN1_TYPE value union overlays the boolean int on the pointer field, ppval comes back as a bogus non-NULL pointer (e.g. 0xff). Fixes CVE-2026-63076 Reviewed-by: Milan Broz <[email protected]> Reviewed-by: Norbert Pocs <[email protected]> Merge-date: Sat Aug 22 06:12:04 2026
* Add test for CVE-2026-63076Daniel Kubec2026-08-221-0/+33
| | | | | | | Assisted-by: Claude:claude-fable-5 Reviewed-by: Milan Broz <[email protected]> Reviewed-by: Norbert Pocs <[email protected]> Merge-date: Sat Aug 22 06:12:03 2026
* cms: fix AuthEnvelopedData authAttrs tags and verify them as AEAD AADJakub Zelenka2026-08-217-5/+136
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The CMS_AuthEnvelopedData ASN.1 template used the implicit tags and the X509_ALGOR type copied from CMS_AuthenticatedData. Per RFC 5083 the authAttrs and unauthAttrs fields are [1] and [2] (not [2] and [3]) and are SET OF Attribute, so use X509_ATTRIBUTE with the correct tags, matching the STACK_OF(X509_ATTRIBUTE) members already declared in the structure. With the tags fixed, authEnvelopedData carrying authAttrs now parses, so the authenticated attributes must also be fed to the content cipher as the AEAD associated data required by RFC 5083 section 2.1. Encode their DER (with the universal SET OF tag) for both encryption and decryption; without this the GCM tag fails to verify against compliant senders such as BouncyCastle. RFC 5083 also requires that plaintext is not released until its integrity has been verified. The AEAD tag is only checked once all the ciphertext has been processed, so buffer the decrypted content and forward it to the output BIO only after that check succeeds; a tampered message then leaks nothing to -out. Add an interop test using a BouncyCastle-generated AES-128-GCM message with authenticated and unauthenticated attributes, plus a tampered copy that must fail the tag check and leave -out empty. Closes #31635 Closes #26101 Closes #31629 Assisted-by: Claude:claude-opus-4-8 Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Igor Ustinov <[email protected]> Reviewed-by: Norbert Pocs <[email protected]> Merge-date: Fri Aug 21 10:38:28 2026 Merged-from: https://github.com/openssl/openssl/pull/32076
* file_store_any2obj.c: validate blob length before allocationAbel Thomas2026-08-211-4/+2
| | | | | | | | | | | | | | | | | Both msblob2obj_decode() and pvk2obj_decode() computed an attacker-influenced buffer size (from `bitlen`, or from `saltlen + keylen`) and passed it to BUF_MEM_grow() without an upper bound. Resolves #31684 Fixes: f40c5f2c53b9 "PROV & STORE: Make the 'file:' store loader understand more binary formats" Fixes: 0f5493e60b9e "storemgmt: Validate msblob length before buffer allocation" Reviewed-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Matt Caswell <[email protected]> Merge-date: Fri Aug 21 10:11:10 2026 Merged-from: https://github.com/openssl/openssl/pull/31704
* test: cover CCM empty Final without a payload UpdateMounir IDRASSI2026-08-211-0/+184
| | | | | | | | | | | | | | Declare a zero payload length and supply AAD while deliberately omitting the payload Update. Check that streaming and one-shot Final generate the same tag, accept the correct tag, and reject a modified tag for every available built-in CCM cipher. Assisted-by: Codex:gpt-5.6-sol Reviewed-by: Milan Broz <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Nikola Pajkovsky <[email protected]> Merge-date: Fri Aug 21 10:04:28 2026 Merged-from: https://github.com/openssl/openssl/pull/32427
* CCM: authenticate empty Final when payload Update is skippedMounir IDRASSI2026-08-211-3/+12
| | | | | | | | | | | | | | | | | | | | | | CCM Final was routed through an update helper whose pointer-based dispatch treats a NULL-input call as a no-op or a length declaration. If an empty message skips payload Update, decryption can therefore skip tag verification and encryption does not generate a tag. Process an empty payload during Final only when the existing state flags show that no payload operation took place. Route the NULL-input EVP_Cipher() form through the same Final path. Fixes #32253 Assisted-by: Codex:gpt-5.6-sol (cherry picked from commit 493a46c61983195c2b49bfde75ffba0321e5e69d) Reviewed-by: Milan Broz <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Nikola Pajkovsky <[email protected]> Merge-date: Fri Aug 21 10:04:26 2026 Merged-from: https://github.com/openssl/openssl/pull/32427
* Fix get_cert_by_subject_ex() to gracefully handle broken symlinks (but not ↵Dr. David von Oheimb2026-08-191-13/+23
| | | | | | | | | | | | | | | on Windows) Also gloss over errors reading cert/CRL contents from existing symlinked files. Fixes #23882 Reviewed-by: Andrew Dinh <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> MergeDate: Wed Aug 19 19:29:03 2026 (Merged from https://github.com/openssl/openssl/pull/31594) (cherry picked from commit 38dd8ec5e3be47325b09f08abdef5dbebe89100f)
* Add tests for empty AEAD EVP_Cipher() finalizationMounir IDRASSI2026-08-191-0/+120
| | | | | | | | | | | | | | Generate an empty-message tag with the streaming path, then check that EVP_Cipher() decryption accepts the correct tag and rejects a corrupted one. Also verify that EVP_Cipher() encryption produces the same tag. Cover AES-OCB and ChaCha20-Poly1305, with and without AAD. Assisted-by: Codex:gpt-5.6-sol Reviewed-by: Bob Beck <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> Merge-date: Wed Aug 19 17:43:25 2026 Merged-from: https://github.com/openssl/openssl/pull/32417
* Check the tag on EVP_Cipher() finalize: Poly1305 and OCB AEADsBilly Brumley2026-08-192-7/+24
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | For the affected OpenSSL built-in provider AEAD implementations, EVP_Cipher(ctx, out, NULL, 0) reaches the ccipher callback as a NULL-input terminal call. OCB and ChaCha20-Poly1305 took an early exit on an empty message, with or without AAD, and returned success without comparing an explicitly supplied tag. Consequently a corrupted tag was accepted before this change. Make these built-in callbacks perform their terminal tag operation, aligning their explicit-tag handling with the streaming Final path without defining NULL input as part of the generic EVP_Cipher() contract. AES-GCM-SIV also failed to generate a tag when Final was its first empty-message operation. Generate the tag in that case and propagate failures from the matching empty-message decrypt operation. The stable ChaCha20-Poly1305 implementation aliases Update to the one-shot cipher callback, so this backport introduces a dedicated Update callback to preserve zero-length Update as a no-op. Follow-up to #31555 Fixes #32258 Fixes CVE-2026-75803 Assisted-by: Claude:claude-opus-4-8 Assisted-by: Codex:gpt-5.6-sol (cherry picked from commit 5741d29a5f356e05262cd0936a472a9961398d53) Co-authored-by: Mounir IDRASSI <[email protected]> Reviewed-by: Bob Beck <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> Merge-date: Wed Aug 19 17:43:24 2026 Merged-from: https://github.com/openssl/openssl/pull/32417
* Fix system resource leak in TerminalSocket()YZL0v3ZZ2026-08-191-0/+2
| | | | | | | | | | | | | | | | When establishing a terminal socket on OpenVMS, if the async I/O read operation (sys$qio) fails, the error path returns early without freeing the allocated channel via sys$dassgn. Add sys$dassgn(TerminalDeviceChan) in the sys$qio error path during creation. Also ensure dassgn executes regardless of whether sys$cancel succeeds during deletion to avoid exhausting the I/O channel quota. Reviewed-by: Nikola Pajkovsky <[email protected]> Reviewed-by: Richard Levitte <[email protected]> Merge-date: Wed Aug 19 15:37:03 2026 Merged-from: https://github.com/openssl/openssl/pull/30375 (cherry picked from commit ee7c64fbcd24276233d238aff1cdf9996be943cd)
* Reject DSA parameters where N exceeds 512Simo Sorce2026-08-181-0/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Update the FFC parameter validation to explicitly reject DSA configurations where the N parameter is greater than 512. Previously, the logic accepted any N >= 256 if L >= 3072. This change enforces the maximum supported limit for N and raises an error to prevent the use of invalid or unsupported parameter combinations. This is needed because generate_q_fips186_4() allocates a `md` buffer that is at most `EVP_MAX_MD_SIZE` long (64 bytes). If N is greater than 512 then the qsize parameter passed in input to generate_q_fips186_4() will be greater than 64 causing internal operations on the buffer to overflow. This was found by Red Hat with AISLE, but deemed not a security issue because there is no reasonable way to cause an attacket to set the qbits values directly, if this ever happen it is just misuse of an API by an application. Signed-off-by: Simo Sorce <[email protected]> Reviewed-by: Richard Levitte <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Dmitry Belyavskiy <[email protected]> MergeDate: Tue Aug 18 12:41:55 2026 (Merged from https://github.com/openssl/openssl/pull/32271) (cherry picked from commit 1bf213943b0f422ced4b0c2db51f626f488f89c7)
* pkcs7: use PKCS7_get_octet_string in PKCS7_stream signed armAbel Thomas2026-08-182-1/+46
| | | | | | | | | | | | | | | | | | | | | | | Direct access to `p7->d.sign->contents->d.data` skips the content-type check: if the inner eContentType is a non-standard OID the ADB sets d.other (16 bytes) instead of d.data (24 bytes), and the subsequent os->flags write lands out of bounds. Replace with `PKCS7_get_octet_string()`, which returns NULL for any type that is not `NID_pkcs7_data`, matching the guard already used by `PKCS7_ctrl()` and `PKCS7_dataDecode()`. Added a unit-test (`pkcs7_stream_non_data_test`) to validate the change. Fixes #31681 Reviewed-by: Bob Beck <[email protected]> Reviewed-by: Jakub Zelenka <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> Merge-date: Tue Aug 18 07:47:41 2026 Merged-from: https://github.com/openssl/openssl/pull/31722 (cherry picked from commit eedaf1c2c46b5e511a603833a65a742085c01bb2) (cherry picked from commit 56c1e4fc7625295283c22108746cb974229d9575)
* README-FIPS: clarify provider and library cross-version compatibilityAnton Arapov2026-08-181-2/+8
| | | | | | | | | | | | | | | | | | | | | | State that a FIPS provider built from any validated version may be used together with an OpenSSL library built from any supported release from OpenSSL 3.0 onwards, backward and forward, including future major release series. The downloads page references in the updated paragraph now point at https://openssl-library.org/source/, which www.openssl.org/source/ redirects to. Aligns the documentation with the OpenSSL Library FIPS Module Support Policy. Assisted-by: Claude Code:claude-fable-5 Reviewed-by: Nikola Pajkovsky <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Richard Levitte <[email protected]> Merge-date: Tue Aug 18 07:21:24 2026 Merged-from: https://github.com/openssl/openssl/pull/32105 (cherry picked from commit 93a175f15adfad7f469f98cd2455cd65551e4eb6)
* doc: FIPS provider is compatible with releases from 3.0 onwardsAnton Arapov2026-08-181-3/+6
| | | | | | | | | | | | | | | | | | | | | | | State in fips_module(7) that a FIPS provider built from a validated version can be used with libcrypto and libssl from any supported release from OpenSSL 3.0 onwards, backward and forward, including future major release series, replacing the narrower wording that limited this to the same major release series. The downloads page reference in the same paragraph now points at https://openssl-library.org/source/, which www.openssl.org/source/ redirects to. Aligns the documentation with the OpenSSL Library FIPS Module Support Policy. Assisted-by: Claude Code:claude-fable-5 Reviewed-by: Nikola Pajkovsky <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Richard Levitte <[email protected]> Merge-date: Tue Aug 18 07:21:22 2026 Merged-from: https://github.com/openssl/openssl/pull/32105 (cherry picked from commit 090868518bbff01f8e9590444aed3c06a254a3b2)
* Fix ASN1_TYPE memory leak in asn1_multi()Greensi72026-08-141-1/+4
| | | | | | | | | | | | | | | | | | | | | | In asn1_gen.c `asn1_multi()` function variable allocated as `ASN1_TYPE *typ = generate_v3()` is not freed if `if (!sk_ASN1_TYPE_push(sk, typ))` branch fails. Bug found by x509v3 fuzzer MFAIL test. Example input: ``` [default] 1.2.3.4 = ASN1:SEQUENCE:items [items] value = INTEGER:1 ``` Reviewed-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Milan Broz <[email protected]> Reviewed-by: Nikola Pajkovsky <[email protected]> Merge-date: Fri Aug 14 10:29:08 2026 Merged-from: https://github.com/openssl/openssl/pull/32206
* cms: clear temporary key buffers on failureunjuno2026-08-143-5/+12
| | | | | | | | | | | | Use OPENSSL_clear_free() with the original allocation length on the KARI, KEKRI, and PWRI failure paths. This is defense-in-depth hardening at the CMS/provider boundary. Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Dmitry Belyavskiy <[email protected]> Merge-date: Fri Aug 14 06:38:29 2026 Merged-from: https://github.com/openssl/openssl/pull/32303 (cherry picked from commit 57b84ed1cf9b6c6fe8230be85869351ce2e8e839)
* Deal with riscv64 qemu-user stderr noiseViktor Dukhovni2026-08-131-0/+4
| | | | | | | | | | | | | | | | When the RISCV vector extensions version is not explicitly specified, qemu issues warnings to stderr when running each program. This broke some CI jobs. Pin the version to the (current) "v1.0" default. Reviewed-by: Nikola Pajkovsky <[email protected]> Reviewed-by: Saša Nedvědický <[email protected]> Reviewed-by: Igor Ustinov <[email protected]> MergeDate: Thu Aug 13 06:32:59 2026 (Merged from https://github.com/openssl/openssl/pull/32345) (cherry picked from commit 31e93626b5f24b84947a954929106b4cfd5a03e7)
* .github/workflows: remove openssl-3.1, openssl-3.2 and openssl-3.3 from CI jobsMilan Broz2026-08-121-13/+1
| | | | | | | | | These branches are EOL, so there is no need to keep running CI jobs for them. Reviewed-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> Merge-date: Wed Aug 12 10:17:15 2026 Merged-from: https://github.com/openssl/openssl/pull/32265
* storemgmt: Validate msblob length before buffer allocationLoganaden Velvindron2026-08-121-0/+6
| | | | | | | | | Reviewed-by: Paul Dale <[email protected]> Reviewed-by: Dmitry Belyavskiy <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> Merge-date: Wed Aug 12 09:54:12 2026 Merged-from: https://github.com/openssl/openssl/pull/32102 (cherry picked from commit 0f5493e60b9e8ec500de5812fe28b9f564408608)
generated by cgit (git 2.51.2) at 2026-10-25 11:47:14 +0100