summaryrefslogtreecommitdiffstats
AgeCommit message (Collapse)Author
2023-02-07Prepare for release of 3.0.8openssl-3.0.8Richard Levitte
Reviewed-by: Tomas Mraz <tomas@openssl.org> Release: yes
2023-02-07make updateRichard Levitte
Reviewed-by: Tomas Mraz <tomas@openssl.org> Release: yes
2023-02-07Update copyright yearRichard Levitte
Reviewed-by: Tomas Mraz <tomas@openssl.org> Release: yes
2023-02-03Internaly declare the DSA type for no-deprecated buildsTomas Mraz
Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (cherry picked from commit 7a21a1b5fa2dac438892cf3292d1f9c445d870d9)
2023-02-03Add CHANGES.md and NEWS.md entries for the 3.0.8 releaseTomas Mraz
Reviewed-by: Mark J. Cox <mark@awe.com> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org>
2023-02-03Add testcase for missing return check of BIO_set_md() callsTomas Mraz
Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
2023-02-03pk7_doit.c: Check return of BIO_set_md() callsTomas Mraz
These calls invoke EVP_DigestInit() which can fail for digests with implicit fetches. Subsequent EVP_DigestUpdate() from BIO_write() or EVP_DigestFinal() from BIO_read() will segfault on NULL dereference. This can be triggered by an attacker providing PKCS7 data digested with MD4 for example if the legacy provider is not loaded. If BIO_set_md() fails the md BIO cannot be used. CVE-2023-0401 Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
2023-02-03CVE-2023-0286: Fix GENERAL_NAME_cmp for x400Address (3.0)Hugo Landau
Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org>
2023-02-03Add test for DSA pubkey without param import and checkTomas Mraz
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org>
2023-02-03Do not create DSA keys without parameters by decoderTomas Mraz
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org>
2023-02-03Prevent creating DSA and DH keys without parameters through importTomas Mraz
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org>
2023-02-03Fix NULL deference when validating FFC public key.slontis
Fixes CVE-2023-0217 When attempting to do a BN_Copy of params->p there was no NULL check. Since BN_copy does not check for NULL this is a NULL reference. As an aside BN_cmp() does do a NULL check, so there are other checks that fail because a NULL is passed. A more general check for NULL params has been added for both FFC public and private key validation instead. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org>
2023-02-03Add test for d2i_PKCS7 NULL dereferenceTomas Mraz
Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Paul Dale <pauli@openssl.org>
2023-02-03Do not dereference PKCS7 object data if not setTomas Mraz
Fixes CVE-2023-0216 Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Paul Dale <pauli@openssl.org>
2023-02-03Check CMS failure during BIO setup with -stream is handled correctlyMatt Caswell
Test for the issue fixed in the previous commit Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org>
2023-02-03Fix a UAF resulting from a bug in BIO_new_NDEFMatt Caswell
If the aux->asn1_cb() call fails in BIO_new_NDEF then the "out" BIO will be part of an invalid BIO chain. This causes a "use after free" when the BIO is eventually freed. Based on an original patch by Viktor Dukhovni and an idea from Theo Buehler. Thanks to Octavio Galland for reporting this issue. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org>
2023-02-03Add a test for CVE-2022-4450Matt Caswell
Call PEM_read_bio_ex() and expect a failure. There should be no dangling ptrs and therefore there should be no double free if we free the ptrs on error. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org>
2023-02-03Avoid dangling ptrs in header and data params for PEM_read_bio_exMatt Caswell
In the event of a failure in PEM_read_bio_ex() we free the buffers we allocated for the header and data buffers. However we were not clearing the ptrs stored in *header and *data. Since, on success, the caller is responsible for freeing these ptrs this can potentially lead to a double free if the caller frees them even on failure. Thanks to Dawei Wang for reporting this issue. Based on a proposed patch by Kurt Roeckx. CVE-2022-4450 Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org>
2023-02-03Fix Timing Oracle in RSA decryptionDmitry Belyavskiy
A timing based side channel exists in the OpenSSL RSA Decryption implementation which could be sufficient to recover a plaintext across a network in a Bleichenbacher style attack. To achieve a successful decryption an attacker would have to be able to send a very large number of trial messages for decryption. The vulnerability affects all RSA padding modes: PKCS#1 v1.5, RSA-OEAP and RSASVE. Patch written by Dmitry Belyavsky and Hubert Kario CVE-2022-4304 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org>
2023-02-02Add testcase for nc_match_single type confusionTomas Mraz
Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org>
2023-02-02Fix type confusion in nc_match_single()Viktor Dukhovni
This function assumes that if the "gen" is an OtherName, then the "base" is a rfc822Name constraint. This assumption is not true in all cases. If the end-entity certificate contains an OtherName SAN of any type besides SmtpUtf8Mailbox and the CA certificate contains a name constraint of OtherName (of any type), then "nc_email_eai" will be invoked, with the OTHERNAME "base" being incorrectly interpreted as a ASN1_IA5STRING. Reported by Corey Bonnell from Digicert. CVE-2022-4203 Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org>
2023-02-02doc/man1/{storeutl,gendsa}: point out that extra options/arguments are ignoredDr. David von Oheimb
... and therefore all options must be given before the final file/URI arg. This is essentially a backport of the doc portion of #20156 to 3.0 and 3.1, where the missing error checking/reporting likely will not be added. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20179)
2023-02-02Fix incomplete check on EVP_CIPHER_param_to_asn1()ndossche
That function is a wrapper around evp_cipher_param_to_asn1_ex() which can return 0 as an error value via its ret <= 0 check [1]. Furthermore, all other callers of this function check against <= 0 instead of < 0 and this is also in line with what the documentation tells us. Fix the incomplete check by changing it to <= 0 as well. CLA: trivial [1] https://github.com/openssl/openssl/blob/114d99b46bfb212ffc510865df317ca2c1542623/crypto/evp/evp_lib.c#L164-L165 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20180) (cherry picked from commit e3663717fc16bd140f54ee7f1600bdced7f9ea66)
2023-02-01Use $config{build_file} instead of $target{build_file}Richard Levitte
If the user specifies an alternative build file than the default, this alternative is recorded in $config{build_file}, not $target{build_file}. Therefore, the former should be used, leaving the latter as a mere default. This is a bug. While fixing it, document it better too. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20173) (cherry picked from commit aa2d7e0ee15d1b7015479c38f370a25ceec690fc)
2023-02-01Fix a potential memory leak in crypto/provider_child.cRuili Fang
Fix issue #20063. CLA: trivial Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20163) (cherry picked from commit e788c772b12eea5ced4ce46619e13acf0e0eb6ba)
2023-01-31BIO_read.pod: fix small typoAndrea Pappacoda
Add missing `I` to `<b>` CLA: trivial Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20169) (cherry picked from commit 0414899887b98f973067f286ac126d8b529873e3)
2023-01-31Do not include sparse_array.o in libssl with no-sharedTomas Mraz
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20137) (cherry picked from commit aea9b0e4b6c35c7f90b2e5a3475084500488775d) (cherry picked from commit 984d28b9fe191ac9dfcd214b3a421d915b77ebf8)
2023-01-31Avoid duplicating symbols in legacy.a with some build optionsTomas Mraz
If no-module or no-shared is used, the symbols from libcrypto should not be duplicated in legacy.a Also the BIGNUM functions are currently not needed in legacy.a at all. Fixes #20124 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20137) (cherry picked from commit f6a6f7b6aa84dab44384780cb77050d15c5f575e) (cherry picked from commit 58e8162e73d9061bd056f041bf07a1573d202d7a)
2023-01-31Fix incomplete check on X509V3_add1_i2d()ndossche
X509V3_add1_i2d() can return both -1 and 0 as an error code. This check only checked for 0. Change it into <= 0 to also catch the -1 error code. CLA: trivial Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20157) (cherry picked from commit ecd445464a73bb3f125327a604dd13ad16303ebc)
2023-01-30ChaCha20-Poly1305 no longer supports truncated IV's.slontis
Fixes #20084 In the 3.0 provider implementation the generic code that handles IV's only allows a 12 byte IV. Older code intentionally added the ability for the IV to be truncated. As this truncation is unsafe, the documentation has been updated to state that this in no longer allowed. The code has been updated to produce an error when the iv length is set to any value other than 12. NOTE: It appears that this additional padding may have originated from the code which uses a 12 byte IV, that is then passed to CHACHA which zero pads it to 16 bytes. Note that legacy behaviour in e_chacha20_poly1305.c has not been updated. Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20151) (cherry picked from commit a01152370676e7e11fb461cff8628eb50fa41b81)
2023-01-30coverity 1520506: error handlingPauli
Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/20132) (cherry picked from commit a4347a9a57dcb985283bba03dd3b16294b55945b)
2023-01-30coverity 1520505: error handlingPauli
Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/20132) (cherry picked from commit 00407fbf0b25d65f5e6d99defdb081432e810449)
2023-01-27Add notes about ignoring initialization failures on contextsTomas Mraz
Fixes #20130 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/20136) (cherry picked from commit d4c5d8ff483d99f94d649fb67f1f26fce9694c92)
2023-01-26Document that the RSA e value is mandatory when importing.slontis
The lab tried doing a RSA decryption primitive using just n (using p, q) and d. This failed for 2 reasons: (1) e is required when importing (2) Internally e is used for blinding. Note n and e can be calculated using: n = pq e = (1/d) mod (p-1)(q-1) Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20133) (cherry picked from commit 6e3b1c81736b1829584e3f40c2d00040fe1aa881)
2023-01-26Fix Coverity 1520485: logically dead codePauli
The check is unnecessary as the condition is already checked before the switch statement. Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20121) (cherry picked from commit 01a17b24f6649fc192ba6bb9ea34e28ce9678e6c)
2023-01-26Clarify the change of enc -S behavior in 3.0Viktor Dukhovni
Fixes #19730 Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19732) (cherry picked from commit a4aa977d3a8049d5386dc583e16c17727c712eaa)
2023-01-25Fix incomplete checks for EVP_CIPHER_asn1_to_paramNiels Dossche
EVP_CIPHER_asn1_to_param() returns a value <= 0 in case of an error, and a value greater than 0 in case of success. Two callsites only check for < 0 instead of <= 0. The other callsites perform this check correctly. Change the two callsites to <= 0. Additionally correctly handle a zero return value from EVP_CIPHER_get_asn1_iv as success. Fixes: #20116 CLA: trivial Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/201213) (cherry picked from commit 114d99b46bfb212ffc510865df317ca2c1542623)
2023-01-24OSSL_trace_set_channel(): add important statement that it takes BIO ownershipDr. David von Oheimb
Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19959) (cherry picked from commit bfd5680e6be789fd554acf2ad34428816a644eec)
2023-01-24set_trace_data(): prevent double free on OPENSSL_strdup() failureDr. David von Oheimb
Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19959) (cherry picked from commit 0fec2121c0c40d8b098896c9bdf629a48fbafa63)
2023-01-24Fix corruption when searching for CRLs in hashed directoriesHugo Landau
The by_dir certificate/CRL lookup code uses an OPENSSL_STACK to track how many sequentially numbered CRL files have been loaded for a given X509_NAME hash which is being requested. This avoids loading already loaded CRL files and repeated stat() calls. This OPENSSL_STACK is searched using sk_find, however this mutates the OPENSSL_STACK unless it is known to be sorted. This operation therefore requires a write lock, which was not taken. Fix this issue by sorting the OPENSSL_STACK whenever it is mutated. This guarantees no mutation will occur during sk_find. This is chosen over taking a write lock during sk_find as retrieving a CRL by X509_NAME is assumed to be a hotter path than the case where a new CRL is installed. Also optimise the code by avoiding creating the structure to track the last CRL file sequence number in the circumstance where it would match the initial value, namely where no CRL with the given hash is installed. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20076) (cherry picked from commit 3147785eb23bb27080a0b7accbbff46ac471e86c)
2023-01-24Add DTLS support to the large app data testMatt Caswell
Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20086) (cherry picked from commit d36a9d66dc72fb2262f6e7491f658fb1da8242d7)
2023-01-24Ensure our buffer allocation allows for the Explicit IVMatt Caswell
Some ciphers/protocol versions have an explicit IV. We need to make sure we have sufficient room for it in the underlying buffer. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20086) (cherry picked from commit 3be93f1b264d35ad93ceb71affacdef1b930c3c6)
2023-01-24Add a test for large app dataMatt Caswell
Test that sending large app data records works correctly. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20086) (cherry picked from commit 5e73bf03d78da6a635a0a48e1e584f5b9ead45e2)
2023-01-23MD5.pod: Recommend SHA-2 or SHA-3 family hashes instead of legacy onesTomas Mraz
Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20095) (cherry picked from commit 61222b95ff20f6a7bb20668e43b657561efdb922)
2023-01-23X509_V_ERR_INVALID_PURPOSE: fix misleading text; Fix omission in ↵Dr. David von Oheimb
X509_VERIFY_PARAM_clear_flags doc Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/20052) (cherry picked from commit ec6cbda0f2e435ae0efaec308dc5569c75bb759b)
2023-01-23cmp_client.c: fix handling of total_timeout for RR and GENM transactionsDr. David von Oheimb
Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/19391) (cherry picked from commit d7d1d0928af2f14e7e187fa8c78115d0d1aa28eb)
2023-01-23cmp_client_test.c: add tests for end_time being initialized for RR/GENMDr. David von Oheimb
To this end, tweak the internal handling of ctx->total_timeout. Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/19391) (cherry picked from commit b908ec0f217da0a23f9d81442f81d44c94c98f23)
2023-01-23CMP docs: clarify behavior on message/total timeout values givenDr. David von Oheimb
Clarify behavior of OSSL_CMP_CTX_set_option() when given (negative) values for OSSL_CMP_OPT_MSG_TIMEOUT or OSSL_CMP_OPT_TOTAL_TIMEOUT. Fix doc of -msg_timeout and -total_timeout in openssl-cmp.pod.in Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: David von Oheimb <david.von.oheimb@siemens.com> (Merged from https://github.com/openssl/openssl/pull/19391) (cherry picked from commit 5acd4007a0646ef1f9d0015ce438b891d1b24a62)
2023-01-23Fixes wrong return type in BIO_do_connect man page.Thib
Current man page indicates the function returns an int while it returns a long. Fixes #20096. CLA: trivial Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20097) (cherry picked from commit 2bde260ac0e30da39f4453e972c461cd9d1342e0)
2023-01-23Fix incorrect check on RAND_bytes_ex() in generate_q_fips186_4()Niels Dossche
RAND_bytes_ex() can also return 0 on failure. Other callers do check this correctly. Change the check from <0 to <=0. Fixes: #20100 CLA: trivial Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20106) (cherry picked from commit a2b01ae1c84ccc250d5d5cb5f2f8714573e3f11b)
generated by cgit v1.2.3 (git 2.25.1) at 2024-06-21 00:39:32 +0000