summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* Prepare for release of 4.0.1openssl-4.0.1openssl-machine2026-06-093-4/+4
| | | | | | | Reviewed-by: Saša Nedvědický <[email protected]> Reviewed-by: Neil Horman <[email protected]> MergeDate: Tue Jun 9 11:36:43 2026 Release: yes
* make updateopenssl-machine2026-06-092-34/+34
| | | | | | | Reviewed-by: Saša Nedvědický <[email protected]> Reviewed-by: Neil Horman <[email protected]> MergeDate: Tue Jun 9 11:36:41 2026 Release: yes
* Copyright year updatesopenssl-machine2026-06-09120-120/+120
| | | | | | | Reviewed-by: Saša Nedvědický <[email protected]> Reviewed-by: Neil Horman <[email protected]> MergeDate: Tue Jun 9 11:34:24 2026 Release: yes
* CHANGES.md, NEWS.md: update for 4.0.1Eugene Syromiatnikov2026-06-092-2/+470
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 4.0.1 CHANGES.md includes the following: * CVE-2026-7383, CVE-2026-9076, CVE-2026-34180, CVE-2026-34181, CVE-2026-34182, CVE-2026-34183, CVE-2026-35188, CVE-2026-42764, CVE-2026-42765, CVE-2026-42766, CVE-2026-42767, CVE-2026-42768, CVE-2026-42769, CVE-2026-42770, CVE-2026-42771, CVE-2026-45445, CVE-2026-45446, CVE-2026-45447 * https://github.com/openssl/openssl/pull/30626 "TLSv1.3: Fix server not sending NewSessionTicket after ciphersuite mismatch" * https://github.com/openssl/openssl/pull/30904 "pkey(1) missing setup for interactive pass prompt" * https://github.com/openssl/openssl/pull/31058 "Validate that a PSK identity is at least one byte long" * https://github.com/openssl/openssl/pull/31146 "ktls: Fix invalid memory access on retry with moving write buffer" * https://github.com/openssl/openssl/pull/31413 "apps/s_client.c: read one byte less to avoid triggerring overflow protection" 4.0.1 NEWS.md includes the following: * CVE-2026-7383, CVE-2026-9076, CVE-2026-34180, CVE-2026-34181, CVE-2026-34182, CVE-2026-34183, CVE-2026-35188, CVE-2026-42764, CVE-2026-42765, CVE-2026-42766, CVE-2026-42767, CVE-2026-42768, CVE-2026-42769, CVE-2026-42770, CVE-2026-42771, CVE-2026-45445, CVE-2026-45446, CVE-2026-45447 * https://github.com/openssl/openssl/pull/30904 "pkey(1) missing setup for interactive pass prompt" * https://github.com/openssl/openssl/pull/31413 "apps/s_client.c: read one byte less to avoid triggerring overflow protection" Signed-off-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Milan Broz <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> MergeDate: Tue Jun 9 11:18:04 2026
* Fix potential NULL dereference in OSSL_CRMF_ENCRYPTEDVALUE_decrypt()Igor Ustinov2026-06-081-4/+6
| | | | | | | | | | | | | Check that 'parameter' != NULL before dereferencing in OSSL_CRMF_ENCRYPTEDVALUE_decrypt(). Fixes CVE-2026-42767 Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Norbert Pocs <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> MergeDate: Mon Jun 8 20:38:27 2026 (cherry picked from commit 309db711d13a6fdc6f8a719d8b4415a04dbf3bc5)
* Test for CVE-2026-45447 (UAF in PKCS7_verify)Igor Ustinov2026-06-082-1/+63
| | | | | | | | | | The test data were created with a tool developed by Thai Duong <[email protected]>. Reviewed-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> MergeDate: Mon Jun 8 20:22:52 2026 (cherry picked from commit a60763a01490bd747ab716342b87d55bd0a27a39)
* Fix possible use-after-free in OpenSSL PKCS7_verify()Igor Ustinov2026-06-081-3/+6
| | | | | | | | | Fixes CVE-2026-45447 Reviewed-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> MergeDate: Mon Jun 8 20:22:50 2026 (cherry picked from commit b4fbcf9fd25f781b17b763e3ec84d6b6dc096f6e)
* Fix handling of empty-ciphertext messages in AES-GCM-SIV and AES-SIVDmitry Belyavskiy2026-06-083-11/+159
| | | | | | | | | | | | | | | | AES-GCM-SIV: EVP_DecryptFinal_ex Accepts All-Zero Tag for Empty-Ciphertext Messages. AES-SIV: EVP_DecryptUpdate_ex Accepts All-Zero Tag for Empty-Ciphertext Messages on context reuse. Fixes CVE-2026-45446 Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> MergeDate: Mon Jun 8 20:12:25 2026 (cherry picked from commit aeb5000b0c66772bad600e9cc241a4c902e6d8b9)
* Apply the buffered IV on the AES-OCB EVP_Cipher() pathViktor Dukhovni2026-06-082-0/+279
| | | | | | | | | | | | | | | | | | | | | | | | | aes_ocb_cipher(), the OCB provider's OSSL_FUNC_CIPHER_CIPHER slot, processed input without flushing the buffered IV into the OCB context. Effective nonce was 0 regardless of the caller's IV; EVP_*Final_ex() then emitted a tag depending only on (key, iv). This gave (key, nonce) reuse and single-query universal forgery on the EVP_Cipher() path. Apply update_iv() at the head of aes_ocb_cipher() to mirror the streaming handler. The matching GCM one-shot does this already. Add a cross-driver round-trip test for AES-{GCM,CCM,OCB} and ChaCha20-Poly1305 in test/evp_extra_test.c. Each cipher is exercised with and without AAD; the no-AAD case is needed because any prior EVP_CipherUpdate(NULL, aad, ...) routes through the streaming handler and applies the IV itself, masking the bug. Fixes CVE-2026-45445 Reviewed-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> MergeDate: Mon Jun 8 20:02:00 2026 (cherry picked from commit 50c95c5d1e83f4f46a555dfa7fd9c632d3eba9dc)
* Add further unit tests for e-mail validationBob Beck2026-06-081-0/+39
| | | | | | | | | Ensure we correctly catch misformed things. Reviewed-by: Viktor Dukhovni <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> MergeDate: Mon Jun 8 19:59:29 2026 (cherry picked from commit 17c86073c97951c1799449d2a3697c391cfd085d)
* Fix length miscalculation in validate_emailBob Beck2026-06-081-3/+3
| | | | | | | | | | | | We incorrectly used the length of the domain part for the local part when validating e-mail for X509_VERIFY_PARAM_set1_email(). Fixes CVE-2026-42771 Reviewed-by: Viktor Dukhovni <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> MergeDate: Mon Jun 8 19:59:28 2026 (cherry picked from commit 9ee2ad5a2b30e5ddd1cdf7ab6156d7922dd1e427)
* Match the local q DHX parameter against the peer's qNorbert Pocs2026-06-081-1/+4
| | | | | | | | | | | | | | | As FFC/DH peer public key validation uses the peer's q value instead of checking against the local q, we must also check that these q values match when setting the peer's public key. Fixes CVE-2026-42770 Signed-off-by: Norbert Pocs <[email protected]> Reviewed-by: Viktor Dukhovni <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> MergeDate: Mon Jun 8 19:56:27 2026 (cherry picked from commit 29b9df160cc5f20ee3907cce0cb271b982846bce)
* Use the correct issuer when validating rootCAKeyUpdateBob Beck2026-06-081-2/+4
| | | | | | | | | | | | | | | | This correctly uses the existing root, and not the same certificate as the root of the chain to validate. While we are here, we also turn on self signed certificate signature checking as this case is actually bringing in trust anchors as self signed certs, and fix a possible NULL deref. Fixes CVE-2026-42769 Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> MergeDate: Mon Jun 8 19:54:01 2026 (cherry picked from commit 8b6c5dacb6ade54f30778cf344600d4a9df1f032)
* Enforce implicit rejection for CMS/PKCS#7 decryptionDmitry Belyavskiy2026-06-084-17/+11
| | | | | | | | | | | | | | Drop the disablement of the implicit rejection for RSA PKCS#1 v1.5 decryption. Fixes CVE-2026-42768 Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Milan Broz <[email protected]> Reviewed-by: Alicja Kario <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> MergeDate: Mon Jun 8 19:49:19 2026 (cherry picked from commit 33def545a0c173aec43891f24c3df4f7d2e4fd87)
* Test for CVE-2026-42766Igor Ustinov2026-06-083-1/+157
| | | | | | | | | | | | | The script make_missing_kdf_der.py was developed by Mayank Jangid and Kushal Khemka. Co-Authored-by: Mayank Jangid <[email protected]> Co-Authored-by: Kushal Khemka <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> MergeDate: Mon Jun 8 18:57:53 2026 (cherry picked from commit 7020987c162fe81e12e10101dd32f57bdfc7ff5e)
* Fix potential NULL dereference processing CMS PasswordRecipientInfoIgor Ustinov2026-06-081-0/+5
| | | | | | | | | | | | Avoid NULL dereferencing when keyDerivationAlgorithm is absent in CMS PasswordRecipientInfo. Fixes CVE-2026-42766 Reviewed-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> MergeDate: Mon Jun 8 18:57:52 2026 (cherry picked from commit f019b72c589071a73acda9812775389a857884c9)
* Fix NULL Dereference in Certificate Verification with OCSP CheckingDaniel Kubec2026-06-081-0/+10
| | | | | | | | | | | | | | | | | | | | | | When performing OCSP response checking for certificates in the verification chain, the code always tries to access the next certificate as the issuer. There is a check for a self-signed certificate. However with the partial chain verification enabled when the chain does not have a self-signed trusted anchor, the issuer will be NULL for the last certificate in the chain. A NULL pointer dereference then happens. This issue affects only applications which enable both OCSP verification of the certificate chain (X509_V_FLAG_OCSP_RESP_CHECK_ALL) and partial chain verification (X509_V_FLAG_PARTIAL_CHAIN) in the certificate verification. Both flags are disabled by default. For that reason, we have assigned Low severity to the issue. Fixes CVE-2026-42765 Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> MergeDate: Mon Jun 8 18:55:29 2026 (cherry picked from commit 1b5b3379bad0aaff7ed21096c28872dc19ad3cbc)
* Fix NULL dereference in QUIC address validationAlexandr Nedvedicky2026-06-081-2/+4
| | | | | | | | | | | | | | | QUIC server crashes when address validation (RFC 9000, Section 8.1) is disabled and client sends initial packet with invalid token. Issue reported and fix submitted by Sunwoo Lee (KENTECH), Hyuk Lim (KENTECH) and Seunghyun Yoon (KENTECH) Fixes CVE-2026-42764 Reviewed-by: Norbert Pocs <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> MergeDate: Mon Jun 8 14:50:48 2026 (cherry picked from commit e74289062ca6ff778807aa79c03eae4cfc9635b7)
* Fix Double-free When Checking OCSP Stapled ResponseDaniel Kubec2026-06-081-0/+1
| | | | | | | | | | | | | | | | | | | If OCSP stapling is enabled and the TLS client connects to a malicious server, a crafted OCSP stapled response can trigger a double free in the TLS client when the stapled response is checked. The OCSP stapling is not enabled by default. Reliable code execution through a double-free is technically complex and highly environment-dependent but the Denial of Service impact is straightforward to achieve, warranting Moderate severity. Fixes CVE-2026-35188 Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> MergeDate: Mon Jun 8 14:44:58 2026 (cherry picked from commit ac4b7adc4e8208b27a12b2e345b067ca49e3c451)
* Add test for path challenge flood mitigationAlexandr Nedvedicky2026-06-085-1/+212
| | | | | | | | | | | | | | | | | | | | | Client injects 16 path challenge frames. Those are received by server. Only one challenge frame of 16 received triggers path challenge response. Remaining challenge frames are discrded/ignored. Test introduces two counters to channel object: - path_challenge_rx which is bumped for every patch challenge frame received - path_response_tx which is bumped for every path response frame transmitted Succesuful test verifies server receives 16 path challenge frames, but sends just one path response frmae as response. Reviewed-by: Nikola Pajkovsky <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> MergeDate: Mon Jun 8 14:38:29 2026
* QUIC stack must limit the number of PATH_CHALLENGE frames processed in RXAlexandr Nedvedicky2026-06-089-24/+145
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Currently local QUIC stack allocates PATH_RESPONSE frame for every PATH_CHALLENGE frame it receives in single packet from its remote peer. The memory with PATH_RESPONSE frame is released after local QUIC stack receives an ACK which confirms reception of PATH_RESPONSE by remote peer. This gives remote peer too much control over memory resources local QUIC stack may consume. Quoting RFC 9000 section 9.2.1: ...an endpoint SHOULD NOT send multiple PATH_CHALLENGE frames in a single packet. Limiting the number of PATCH_CHALLENGE frames to 1 per QUIC packet received helps to reduce heap memory overhead required to process PATH_CHALLENGE frame. Currently QUIC ACKM (ACK-manager) keeps all frames in retransmission buffer until ACK is received. It can be changed such frames which don't need to be ACKed don't need to be kept in retrans buffer, those can be released right after transmission. Fixes CVE-2026-34183 Reviewed-by: Nikola Pajkovsky <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> MergeDate: Mon Jun 8 14:38:28 2026
* Add tests for CVE-2026-34182Neil Horman2026-06-081-0/+188
| | | | | | | | | | | | | | | Test to ensure that for a given CMS message: 1) We do not allow the creation of a CMS message containing AuthEnvelopedData with a non-AEAD cipher. 2) We do not accept a message containing AuthEnvelopedData with a non-AEAD cipher specified in the AlgorithmIdentifier. 3) We do not allow tag lengths less that 4 bytes. Reviewed-by: Norbert Pocs <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> MergeDate: Mon Jun 8 14:27:03 2026 (cherry picked from commit d11787af723d8230f98a34d9ba5e43229982795a)
* Reject potentially forged encrypted CMS AuthEnvelopedData messagesNeil Horman2026-06-081-4/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | 1. Adjust ossl_cms_EncryptedContent_init_bio to not accept non-AEAD ciphers. If a forged CMS message with AuthEnvelopedData is received with a non-AEAD cipher specified, we silently accept that and decrypt the message, skipping any authentication, which violates RFC 5083. We also add checks to ensure we fail if we try to encrypt AuthEnvelopedData without using an AEAD cipher. 2. Ensure that tag lengths on cms AEAD data is the recommended size. RFC 5084 recommends that mac tags be at least 12 bytes for AES-GCM and 4 bytes for AES-CCM on AuthEnvelopedData. As this code is not algorith-specific we add a check for a minimal size and just use the lower limit which is sufficient to prevent this attack. Without this check, its possible to set the tag length to 1 and within 256 guesses, forge a CMS message. Fixes CVE-2026-34182 Reviewed-by: Norbert Pocs <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> MergeDate: Mon Jun 8 14:27:02 2026 (cherry picked from commit b9258b3ed7304cc2f749f79a09d18602fd51a4a2)
* pkcs12: verify that the pbmac1 key length is safeAlicja Kario2026-06-084-8/+12
| | | | | | | | | | | | | | | | | Short mac keys (as short as 1 byte) can be used to probe the system under attack to accept a PKCS#12 file created by an attacker even if the attacker doesn't know the password used for MAC protection. Fixes CVE-2026-34181 (also update the reference to the PBMAC1 PKCS#12 RFC) Signed-off-by: Alicja Kario <[email protected]> Reviewed-by: Dmitry Belyavskiy <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> MergeDate: Mon Jun 8 14:18:59 2026 (cherry picked from commit 84d226e59bbe4e72b73d855a1d6c8795130bc851)
* Avoid length truncation in ASN1_STRING_setViktor Dukhovni2026-06-081-7/+17
| | | | | | | | | | | | | | The ASN1_STRING_set() function takes an `int` length, make sure the argument is not inadvertently truncated when it is called from asn1_ex_c2i(). Fixes CVE-2026-34180 Reviewed-by: Nikola Pajkovsky <[email protected]> Reviewed-by: Norbert Pocs <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> MergeDate: Mon Jun 8 14:13:56 2026 (cherry picked from commit 5f525cace61a53311ee533374919356c700847d9)
* cms: kek_unwrap_key: test for fix out-of-bounds read in check-byte validationNikola Pajkovsky2026-06-083-3/+48
| | | | | | | | | | | | | | | | | added EnvelopedData blob with a PasswordRecipientInfo using id-alg-PWRI-KEK and an AES-128-CFB key encryption cipher. CFB's 1-byte effective block size let the inlen >= 2 * blocklen guard in kek_unwrap_key() accept a wrapped key shorter than the seven octets the check-byte test reads from tmp[1..6]; the encryptedKey OCTET STRING here is only two bytes. Signed-off-by: Nikola Pajkovsky <[email protected]> Reviewed-by: Daniel Kubec <[email protected]> Reviewed-by: Milan Broz <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> MergeDate: Mon Jun 8 14:06:38 2026 (cherry picked from commit fd1e1078df9e68affcaaa88be75e343c1db3d1a4)
* cms: kek_unwrap_key: Fix out-of-bounds read in check-byte validationNikola Pajkovsky2026-06-081-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | the check-byte test in kek_unwrap_key() reads tmp[1] through tmp[6] unconditionally, so the decrypted buffer must hold at least seven octets. The pre-decryption size check enforces inlen >= 2 * blocklen, which yields the required seven octets only when blocklen >= 4. For a KEK cipher with a smaller block size, inlen can be as small as 2 * blocklen and the check-byte read overruns the inlen-sized tmp allocation. Reject blocklen < 4 in the early sanity check. All block ciphers appropriate for CMS PasswordRecipientInfo key wrapping have a block size of at least 8 octets (DES/3DES = 8, AES = 16), so this only forbids ciphers that would not be valid KEK choices anyway, and the existing inlen >= 2 * blocklen check then guarantees the seven-octet lower bound the check-byte test relies on. Fixes CVE-2026-9076 Signed-off-by: Nikola Pajkovsky <[email protected]> Reviewed-by: Daniel Kubec <[email protected]> Reviewed-by: Milan Broz <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> MergeDate: Mon Jun 8 14:06:36 2026 (cherry picked from commit 1a653f2176434e6ec94f4b70e6796e911a3e607f)
* Reject oversized inputs in ASN1_mbstring_ncopy()Viktor Dukhovni2026-06-081-3/+28
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In ASN1_mbstring_ncopy() the destination size for BMPSTRING and UNIVERSALSTRING output was computed by a signed left shift on an int: outlen = nchar << 1; /* MBSTRING_BMP */ outlen = nchar << 2; /* MBSTRING_UNIV */ For nchar large enough the result is not representable in int. In the worst case (nchar == 0x40000000) nchar << 2 wraps to zero, OPENSSL_malloc(1) is called, and traverse_string() then writes 4*nchar bytes into the one-byte allocation: a heap buffer overflow. The MBSTRING_UTF8 path computes outlen by summing per-character byte counts in out_utf8(), and that sum can overflow the same int under similarly large inputs. Neither path is reachable from code that processes X.509 certificates through the DIRSTRING_TYPE mask used by ASN1_STRING_set_by_NID(): UNIVERSALSTRING is absent from that mask, and the UTF-8 sum requires inputs on the order of half a gigabyte. Reaching them needs an application that calls ASN1_mbstring_copy()/ASN1_mbstring_ncopy() directly, or registers a custom NID via ASN1_STRING_TABLE_add(), with an oversized attacker-controlled input. Add range checks before each shift and in out_utf8(), raising ASN1_R_STRING_TOO_LONG at the point of detection. Move the existing ASN1_R_INVALID_UTF8STRING raise into out_utf8() too so the two failure modes report distinct codes; the MBSTRING_UTF8 caller is left with cleanup only and now frees dest on error, matching the BMP/UNIV branches. Fixes CVE-2026-7383 Reviewed-by: Nikola Pajkovsky <[email protected]> Reviewed-by: Norbert Pocs <[email protected]> Reviewed-by: Daniel Kubec <[email protected]> MergeDate: Mon Jun 8 13:59:47 2026
* pkey(1) missing setup for interactive pass promptViktor Dukhovni2026-06-081-4/+8
| | | | | | | | | | | | | | | | | The changes in #29324 neglected some setup needed for interactive password prompting, leading to a segfaul when pkey(1) is asked to encrypt, but not given an explicit `-pass` argument. The required plumbing is added. Fixes: #30889 Reviewed-by: Matt Caswell <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> MergeDate: Wed Apr 22 07:04:47 2026 (Merged from https://github.com/openssl/openssl/pull/30904) (cherry picked from commit 9406cf1a82ab9c7f644cf08f837ecd3ad77b10aa)
* apps/s_client.c: read one byte less to avoid triggerring overflow protectionEugene Syromiatnikov2026-06-081-2/+2
| | | | | | | | | | | | | | | | | | | Commit e0e276b50a1e "Fix a one byte buffer overflow in s_client" added a check for the buffer size before adding a terminating \0, which led to full reads of BUFSIZZ resulting in session termination. Avoid that by requesting one byte less. Co-Autherd-by: Tomas Mraz <[email protected]> Resolves: https://github.com/openssl/openssl/issues/30925 Fixes: e0e276b50a1e "Fix a one byte buffer overflow in s_client" Signed-off-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Matt Caswell <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> MergeDate: Mon Jun 8 09:12:53 2026 (Merged from https://github.com/openssl/openssl/pull/31413) (cherry picked from commit 037ed103129e6ae7bf5d15d8dc8bf3573f05ac50)
* quic: cleanse derived IV on setup failureMinh Vu2026-06-081-1/+1
| | | | | | | | | | | | | | | | | el_build_keyslot() derives the QUIC IV before the success path stores *out_iv_len. If a later step fails, the error cleanup currently uses *out_iv_len and ends up cleansing zero bytes. Cleanse the caller buffer using the local iv_len instead so the derived IV is cleared on all post-derivation failure paths. Reviewed-by: Saša Nedvědický <[email protected]> Reviewed-by: Daniel Kubec <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> MergeDate: Mon Jun 8 08:53:50 2026 (Merged from https://github.com/openssl/openssl/pull/31346) (cherry picked from commit c920796adf607fb7b626bb06e55b0bc9762ad4e2)
* add fingerprint of the new PGP keyDmitry Misharov2026-06-081-0/+3
| | | | | | | | | | Reviewed-by: Milan Broz <[email protected]> Reviewed-by: Richard Levitte <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> MergeDate: Mon Jun 8 08:27:39 2026 (Merged from https://github.com/openssl/openssl/pull/31353) (cherry picked from commit b99b3566e2b566bebefb4251c0a8258c35fdec20)
* Check custom extensions are handled correct with 3rd party QUICMatt Caswell2026-06-081-0/+69
| | | | | | | | | | | | We have some code to handle the case where we have custom 3rd party extension and 3rd party QUIC. Test that this doesn't cause any problems. Reviewed-by: Bob Beck <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> MergeDate: Mon Jun 8 07:51:56 2026 (Merged from https://github.com/openssl/openssl/pull/31238) (cherry picked from commit 0d6164b9f09cd3703e1d8e0cc903b5c5cac87d60)
* There is no need to call custom_ext_copy_old_cb after reallocing dst->methsMatt Caswell2026-06-081-3/+0
| | | | | | | | | | | | | | | | | | In custom_exts_copy_conn we realloc'd the dst->meths buffer, and then called `custom_ext_copy_old_cb` to transfer ownership of the all style API wrapper allocations to the newly realloc'd buffer. But this makes no sense. The buffer is realloc'd, and the old buffer is no longer freed, so ownership of the old style API wrapper allocations transfer as well. This is actually a use-after-free (we can no longer access the old buffer once its been realloc'd), and also causes a leak. We just delete this code. Reviewed-by: Bob Beck <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> MergeDate: Mon Jun 8 07:51:55 2026 (Merged from https://github.com/openssl/openssl/pull/31238) (cherry picked from commit ff08a2c6d10cdd143259619b7f8eed564713458c)
* Reapply "Preserve connection custom extensions in SSL_set_SSL_CTX()"Matt Caswell2026-06-084-3/+84
| | | | | | | | | | | | | This reverts commit 7836b7d5b6a6b27a441c4e4c8564be6b270580c4. Fixes #31193 Reviewed-by: Bob Beck <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> MergeDate: Mon Jun 8 07:51:54 2026 (Merged from https://github.com/openssl/openssl/pull/31238) (cherry picked from commit efff9b82788c561d7033ed043f22b9a11d04b29f)
* aes_wrap: prevent crash on update without a key007bsd2026-06-032-0/+34
| | | | | | | | | | | | | | | | | | | | | EVP_CipherInit_ex2 with a NULL key followed by EVP_CipherUpdate on AES-WRAP/WRAP-PAD/WRAP-INV ciphers dereferenced an uninitialised function pointer because aes_wrap_init installs ctx->block only when a key is supplied. aes_wrap_cipher_internal had no guard before dispatching. Track key state in ctx->key_set, matching OCB/CCM/GCM/Poly1305, and refuse update if no key has been installed. Added a regression test covering AES-256-WRAP, AES-256-WRAP-PAD and AES-256-WRAP-INV. CLA: trivial Reviewed-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> MergeDate: Wed Jun 3 11:56:51 2026 (Merged from https://github.com/openssl/openssl/pull/31292)
* doc: Clarify SSL_CERT_DIR uses semicolon separator on Windowskovan2026-06-032-2/+4
| | | | | | | | | | | | | | | | | | The documentation for SSL_CERT_DIR stated that directories are colon-separated, but on Windows the separator is semicolon. Updated: - openssl-rehash.pod.in: Added note about semicolon separator on Windows - openssl-env.pod: Added note about multiple directories and Windows separator Fixes: #27698 Co-Authored-By: Claude Opus 4.5 <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Nikola Pajkovsky <[email protected]> MergeDate: Wed Jun 3 11:50:34 2026 (Merged from https://github.com/openssl/openssl/pull/29894)
* statem: fix missing fatal if valid_flags mfail in process cert reqJakub Zelenka2026-06-031-2/+4
| | | | | | | | | | | | | | | | | It is a contract of tls process functions to trigger fatal error if they fail. This is not being done in checking result of s->s3.tmp.valid_flags allocation. If this happens, it triggers alert in read_state_machine() for READ_STATE_BODY state that calls this process function. It calls check_fatal() if MSG_PROCESS_ERROR is returned and the assert in it fails because no error is triggered. The fix just adds the fatal and also uses MSG_PROCESS_ERROR macro as return value instead of hard coded 0. Reviewed-by: Milan Broz <[email protected]> Reviewed-by: Paul Yang <[email protected]> MergeDate: Wed Jun 3 11:34:24 2026 (Merged from https://github.com/openssl/openssl/pull/31338)
* crypto/hpke/hpke_util: Fixes redundant mdname is valid check.Abel Tom2026-06-031-3/+2
| | | | | | | | | | | Removed the redundant `mdname` is not NULL check. Fixes #31299 Reviewed-by: Milan Broz <[email protected]> Reviewed-by: Frederik Wedel-Heinen <[email protected]> MergeDate: Wed Jun 3 11:31:30 2026 (Merged from https://github.com/openssl/openssl/pull/31321)
* Fix broken hex data by reformattingNorbert Pocs2026-06-0343-34824/+3690
| | | | | | | | | | | | | | | | The clang format broke some data in hexadecimal format. To make the tool obedient, the trailing comma needs to be removed, then it interpretes the data differently and therefore does not reformat it. The format can then be changed to the correct form. Fixes: https://github.com/openssl/project/issues/1959 Signed-off-by: Norbert Pocs <[email protected]> Reviewed-by: Milan Broz <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> MergeDate: Wed Jun 3 08:48:01 2026 (Merged from https://github.com/openssl/openssl/pull/31350)
* rsa_sig: reject short buffers in raw verify_recoverrootvector22026-06-021-0/+8
| | | | | | | | | | | | | | | | | | | The md==NULL path of rsa_verify_recover passed the caller buffer to RSA_public_decrypt without checking routsize, while the X9.31 and PKCS#1 paths already reject undersized output buffers. RSA_public_decrypt writes up to RSA_size() bytes, so a short rout overflows. Validate routsize against RSA_size() before the call. Fixes: 6f4b7663150e "PROV: add RSA signature implementation" Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Dmitry Belyavskiy <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Paul Yang <[email protected]> MergeDate: Tue Jun 2 11:55:00 2026 (Merged from https://github.com/openssl/openssl/pull/31340) (cherry picked from commit 78dd79823215ff37a51d977b47cf0bcb4798cee2)
* doc: Add a missing comma in -traditional option explanation.Cristian Yxen2026-06-021-1/+1
| | | | | | | | | | | CLA: trivial Reviewed-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Paul Yang <[email protected]> MergeDate: Tue Jun 2 11:48:05 2026 (Merged from https://github.com/openssl/openssl/pull/31342) (cherry picked from commit e29a7e027c0556cb129f9fc77c6c142a818b6607)
* test: fix unreachable code in test_kdf_pbkdf2_large_output in evp_kdf_test.cAnton Moryakov2026-06-021-1/+1
| | | | | | | | | | | | | | | | | | | | | | | The condition `if (sizeof(len) > 32)` was intended to set `len` to SIZE_MAX on platforms where size_t can hold values larger than 32 bits. However, sizeof() returns the size in bytes, not bits. Since sizeof(size_t) is typically 4 or 8 bytes on all current platforms, the condition was always false, leaving len at 0 and skipping the large-output test. This commit fixes the check by comparing SIZE_MAX directly against 0xFFFFFFFFU, which correctly detects whether size_t can represent values exceeding 32-bit range. This ensures the test properly validates PBKDF2 behavior when requested output length is excessively large. Fixes: 1cae59d14b9e "Make KDFs fail if requesting a zero-length key." Signed-off-by: Anton Moryakov <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Daniel Kubec <[email protected]> MergeDate: Tue Jun 2 11:10:23 2026 (Merged from https://github.com/openssl/openssl/pull/31344) (cherry picked from commit d4c900174ceaacf413600b1c97b03e8991b1966d)
* poly1305: prevent crash on final without a key007bsd2026-06-012-0/+32
| | | | | | | | | | | | | | | | | | | | | | | | | | EVP_MAC_init with a NULL key followed by EVP_MAC_final on a Poly1305 context crashed with a NULL function-pointer dispatch because poly1305_init accepted the no-key case as success, and poly1305_final had no guard before dispatching through the uninitialised Poly1305 state. Add a key_set field to struct poly1305_data_st (matching OCB/CCM/GCM), set it in poly1305_setkey, and refuse init and final if no key has been installed. Added a regression test asserting EVP_MAC_init with a NULL key returns 0. ##### Checklist - [ ] documentation is added or updated - [x] tests are added or updated CLA: trivial Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> MergeDate: Mon Jun 1 07:36:08 2026 (Merged from https://github.com/openssl/openssl/pull/31298)
* quic: fix keyslot cctx leak by not checking EL state in teardownJakub Zelenka2026-06-011-3/+0
| | | | | | | | | | | | | | | | el_teardown_keyslot() decided whether to free a keyslot by calling ossl_qrl_enc_level_set_has_keyslot() against the EL's current state. On error paths the state does not yet match the slots that were provisioned, so the check returned 0 and the cctx and iv were leaked. The fix drops the state check and rely on the existing cctx != NULL check which is sufficient for all callers of el_teardown_keyslot(). Reviewed-by: Matt Caswell <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Saša Nedvědický <[email protected]> MergeDate: Mon Jun 1 07:33:07 2026 (Merged from https://github.com/openssl/openssl/pull/31323)
* ktls: Fix invalid memory access on retry with moving write bufferIlya Maximets2026-06-013-12/+171
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | kTLS write is using application buffer always without a memory copy. And it completely ignores SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER as a result. If the user frees or re-uses the original buffer and retries the send on SSL_ERROR_WANT_WRITE, the code will read and send the data from the original already freed buffer sending whatever happens to be in that memory now and corrupting the message, potentially crashing the application as well. Fix by making a copy if we can't send the whole thing right away and the moving write buffer is configured. This preserves the zero-copy semantics for the happy path and avoids the invalid memory access and data corruption when retry is necessary. The copy is done in the common code as it is hard to preserve the zero-copy behavior otherwise. Test is added that reproduces the issue. It may be possible to modify the existing kTLS test to conditionally enable the modes and do the BIO swap, but it feels like the issue deserves a separate one. The test doesn't rely on any specific cypher or TLS version, so only one combination is checked, but it should be enough. There is no TLS_BUFFER_set_len() and the original kTLS code never sets it, so not setting it on the copy either for now. Fixes: 50ec750567e0 "ssl: Linux TLS Tx Offload" Fixes #21202 Assisted-by: claude-opus-4.6 Reviewed-by: Matt Caswell <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> MergeDate: Mon Jun 1 07:30:12 2026 (Merged from https://github.com/openssl/openssl/pull/31146)
* CHANGES.md: reissue session ticket on ciphersuite mismatchDaniel Kubec2026-06-011-1/+4
| | | | | | | | | | Complements: c64fa2f3af "TLSv1.3: reissue session ticket after full handshake on ciphersuite mismatch" References: #30626 Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> MergeDate: Mon Jun 1 07:24:02 2026 (Merged from https://github.com/openssl/openssl/pull/31309)
* crypto/evp: fix double free of tmp_keymgmt in sig/kem/asym initrootvector22026-05-313-0/+6
| | | | | | | | | | | | | | | | | | | | | Commit ecb4757b377f "crypto/evp/m_sigver.c: fix potential double free on error path in do_sigver_init" has fixed double-free of tmp_keymgmt in do_sigver_init() by setting it to NULL after EVP_KEYMGMT_free() call; the same issue present in evp_kem_init(), evp_pkey_asym_cipher_init(), and evp_pkey_signature_init(). Address it similarly, by setting the pointers to NULL after *_free() calls. Complements: ecb4757b377f "crypto/evp/m_sigver.c: fix potential double free on error path in do_sigver_init" Fixes: 839ffdd11cd4 "EVP: Allow a fallback for operations that work with an EVP_PKEY" CLA: trivial Reviewed-by: Kurt Roeckx <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> MergeDate: Sun May 31 11:03:15 2026 (Merged from https://github.com/openssl/openssl/pull/31312) (cherry picked from commit a21f77dbc99c242b73b5b420714a2cd36bee084a)
* quic: fix handling of the first rxe mfail in qrx_process_pktJakub Zelenka2026-05-291-1/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | When qrx_ensure_free_rxe() fails at the start of qrx_process_pkt() the function returned 0 without advancing the PACKET cursor and, for the first packet in the datagram, without setting first_dcid. The qrx_process_datagram() loop then re-entered qrx_process_pkt() for the same bytes with pkt_idx >= 1 and the sentinel first_dcid (id_len = 255), tripping the assertion in qrx_validate_hdr_early() that asserts first_dcid->id_len to be lower than QUIC_MAX_CONN_ID_LEN. The fix goes to malformed label instead. The header has not been decoded at this point so eop is NULL, which makes the malformed path discard the rest of the datagram. This is because without an RXE we can process neither this packet nor any that follow it. This also advances the cursor and, when the failure is on the first packet, avoids leaving first_dcid unset for the next iteration. It is consistent with the other allocation-failure site in the function, which already routes through malformed. Reviewed-by: Matt Caswell <[email protected]> Reviewed-by: Saša Nedvědický <[email protected]> MergeDate: Fri May 29 14:08:56 2026 (Merged from https://github.com/openssl/openssl/pull/31316) (cherry picked from commit 31d61a1ceb1556d729410d4ae59503f49e58cf22)
* test/stack_test.c: Change structure SS typedef into TST_SSWolfgang Beck2026-05-291-31/+31
| | | | | | | | | | | | | | The original name of the structure SS collides with a define set in a Solaris system header. Reviewed-by: Dmitry Belyavskiy <[email protected]> Reviewed-by: Saša Nedvědický <[email protected]> Reviewed-by: Eugene Syromiatnikov <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> MergeDate: Fri May 29 07:56:28 2026 (Merged from https://github.com/openssl/openssl/pull/31224) (cherry picked from commit 0c1194718301808d48db78355c03c6f5e884e4a3)
generated by cgit (git 2.51.2) at 2026-10-25 12:35:59 +0100