diff options
author | Matt Caswell <matt@openssl.org> | 2021-12-14 13:15:58 +0000 |
---|---|---|
committer | Matt Caswell <matt@openssl.org> | 2021-12-14 13:42:49 +0000 |
commit | 5eef9e1deb11d769dff3b76a21634e39bd533336 (patch) | |
tree | ee17405fda7dff8efcc067fa7c387ffeff82424f /CHANGES.md | |
parent | 32a3b9b766315a799982ddda82dc40c338b614f7 (diff) |
Update CHANGES and NEWS for new release
Reviewed-by: Richard Levitte <levitte@openssl.org>
Diffstat (limited to 'CHANGES.md')
-rw-r--r-- | CHANGES.md | 26 |
1 files changed, 25 insertions, 1 deletions
diff --git a/CHANGES.md b/CHANGES.md index 11e5864c83..8fd7e7288a 100644 --- a/CHANGES.md +++ b/CHANGES.md @@ -72,13 +72,37 @@ OpenSSL 3.1 ### Changes between 3.0.0 and 3.0.1 [xx XXX xxxx] + * Fixed invalid handling of X509_verify_cert() internal errors in libssl + Internally libssl in OpenSSL calls X509_verify_cert() on the client side to + verify a certificate supplied by a server. That function may return a + negative return value to indicate an internal error (for example out of + memory). Such a negative return value is mishandled by OpenSSL and will cause + an IO function (such as SSL_connect() or SSL_do_handshake()) to not indicate + success and a subsequent call to SSL_get_error() to return the value + SSL_ERROR_WANT_RETRY_VERIFY. This return value is only supposed to be + returned by OpenSSL if the application has previously called + SSL_CTX_set_cert_verify_callback(). Since most applications do not do this + the SSL_ERROR_WANT_RETRY_VERIFY return value from SSL_get_error() will be + totally unexpected and applications may not behave correctly as a result. The + exact behaviour will depend on the application but it could result in + crashes, infinite loops or other similar incorrect responses. + + This issue is made more serious in combination with a separate bug in OpenSSL + 3.0 that will cause X509_verify_cert() to indicate an internal error when + processing a certificate chain. This will occur where a certificate does not + include the Subject Alternative Name extension but where a Certificate + Authority has enforced name constraints. This issue can occur even with valid + chains. + ([CVE-2021-4044]) + + *Matt Caswell* + * Corrected a few file name and file reference bugs in the build, installation and setup scripts, which lead to installation verification failures. Slightly enhanced the installation verification script. *Richard Levitte* - OpenSSL 3.0 ----------- |