summaryrefslogtreecommitdiffstats
path: root/CHANGES.md
AgeCommit message (Collapse)Author
2024-01-30Prepare for release of 3.1.5openssl-3.1.5Matt Caswell
Reviewed-by: Richard Levitte <levitte@openssl.org> Release: yes
2024-01-30Update CHANGES.md and NEWS.md for new releaseMatt Caswell
Reviewed-by: Tomas Mraz <tomas@openssl.org> Release: yes (Merged from https://github.com/openssl/openssl/pull/23423)
2024-01-15Add CHANGES.md and NEWS.md entries for CVE-2023-6237Tomas Mraz
Reviewed-by: Neil Horman <nhorman@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23243) (cherry picked from commit 38b2508f638787842750aec9a75745e1d8786743)
2024-01-12Fix the encoding of SM2 keysRichard Levitte
OpenSSL's encoding of SM2 keys used the SM2 OID for the algorithm OID where an AlgorithmIdentifier is encoded (for encoding into the structures PrivateKeyInfo and SubjectPublicKeyInfo). Such keys should be encoded as ECC keys. Fixes #22184 Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22529) (cherry picked from commit 1d490694dfa790d8e47f8f2ea62ea1d9b1251179)
2024-01-09Add CHANGES.md and NEWS.md entries for CVE-2023-6129Tomas Mraz
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/23200) (cherry picked from commit 858c7bc210a406cc7f891ac2aed78692d2e02937)
2023-11-08Add CHANGES.md and NEWS.md entry for CVE-2023-5678Tomas Mraz
Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22647) (cherry picked from commit 4ee71b4c302a06c24b46a5def1cff2096bd57f0b)
2023-10-24Prepare for 3.1.5Matt Caswell
Reviewed-by: Tomas Mraz <tomas@openssl.org> Release: yes
2023-10-24Prepare for release of 3.1.4openssl-3.1.4Matt Caswell
Reviewed-by: Tomas Mraz <tomas@openssl.org> Release: yes
2023-10-24changes and news entries for CVE-2023-5363Pauli
Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
2023-09-19Prepare for 3.1.4Richard Levitte
Reviewed-by: Matt Caswell <matt@openssl.org> Release: yes
2023-09-19Prepare for release of 3.1.3openssl-3.1.3Richard Levitte
Reviewed-by: Matt Caswell <matt@openssl.org> Release: yes
2023-09-11Add CVE-2023-4807 fix to CHANGES.md and NEWS.mdTomas Mraz
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/22033) (cherry picked from commit 0be7510f49e498532708fd03628fc3fc62ee7875)
2023-08-01Prepare for 3.1.3Matt Caswell
Reviewed-by: Tomas Mraz <tomas@openssl.org> Release: yes
2023-08-01Prepare for release of 3.1.2openssl-3.1.2Matt Caswell
Reviewed-by: Tomas Mraz <tomas@openssl.org> Release: yes
2023-07-27Add CHANGES.md and NEWS.md entries for CVE-2023-3817Tomas Mraz
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Todd Short <todd.short@me.com> (Merged from https://github.com/openssl/openssl/pull/21550) (cherry picked from commit 4b29762802c05fa871f0e1efcf804e86db0ddaa2)
2023-07-19Update CHANGES/NEWS for CVE-2023-3446Matt Caswell
Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/21451) (cherry picked from commit 4ec53ad6e1791daafbe26bdbd539f2ba9172959a)
2023-07-14Add CHANGES.md and NEWS.md entries for CVE-2023-2975Tomas Mraz
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/21384) (cherry picked from commit 1e398bec538978b9957e69bf9e12b3c626290bea)
2023-07-14Add a NEWS entry covering the FIPS related changes.Pauli
Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Todd Short <todd.short@me.com> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/21386)
2023-06-06Make link to RFC 1578 in CHANGES.md be a proper linkTomas Mraz
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/21130) (cherry picked from commit 18f82df5b14b3fba078c6c5f0f4a0bb8eee6c954)
2023-05-30Prepare for 3.1.2Tomas Mraz
Reviewed-by: Richard Levitte <levitte@openssl.org> Release: yes
2023-05-30Prepare for release of 3.1.1openssl-3.1.1Tomas Mraz
Reviewed-by: Richard Levitte <levitte@openssl.org> Release: yes
2023-05-29Restrict the size of OBJECT IDENTIFIERs that OBJ_obj2txt will translateRichard Levitte
OBJ_obj2txt() would translate any size OBJECT IDENTIFIER to canonical numeric text form. For gigantic sub-identifiers, this would take a very long time, the time complexity being O(n^2) where n is the size of that sub-identifier. To mitigate this, a restriction on the size that OBJ_obj2txt() will translate to canonical numeric text form is added, based on RFC 2578 (STD 58), which says this: > 3.5. OBJECT IDENTIFIER values > > An OBJECT IDENTIFIER value is an ordered list of non-negative numbers. > For the SMIv2, each number in the list is referred to as a sub-identifier, > there are at most 128 sub-identifiers in a value, and each sub-identifier > has a maximum value of 2^32-1 (4294967295 decimal). Fixes otc/security#96 Fixes CVE-2023-2650 Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org>
2023-05-29Add missing CHANGES.md entriesTomas Mraz
Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/21057)
2023-04-26Correct the CHANGES entry for CVE-2023-1255Tomas Mraz
Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> (Merged from https://github.com/openssl/openssl/pull/20798) (cherry picked from commit e6990079c2413625d2039ebed49ea17a5b8cf935)
2023-04-20aesv8-armx.pl: Avoid buffer overrread in AES-XTS decryptionTomas Mraz
Original author: Nevine Ebeid (Amazon) Fixes: CVE-2023-1255 The buffer overread happens on decrypts of 4 mod 5 sizes. Unless the memory just after the buffer is unmapped this is harmless. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com> (Merged from https://github.com/openssl/openssl/pull/20759) (cherry picked from commit 72dfe46550ee1f1bbfacd49f071419365bc23304)
2023-04-04Alternative fix for CVE-2022-4304Bernd Edlinger
This is about a timing leak in the topmost limb of the internal result of RSA_private_decrypt, before the padding check. There are in fact at least three bugs together that caused the timing leak: First and probably most important is the fact that the blinding did not use the constant time code path at all when the RSA object was used for a private decrypt, due to the fact that the Montgomery context rsa->_method_mod_n was not set up early enough in rsa_ossl_private_decrypt, when BN_BLINDING_create_param needed it, and that was persisted as blinding->m_ctx, although the RSA object creates the Montgomery context just a bit later. Then the infamous bn_correct_top was used on the secret value right after the blinding was removed. And finally the function BN_bn2binpad did not use the constant-time code path since the BN_FLG_CONSTTIME was not set on the secret value. In order to address the first problem, this patch makes sure that the rsa->_method_mod_n is initialized right before the blinding context. And to fix the second problem, we add a new utility function bn_correct_top_consttime, a const-time variant of bn_correct_top. Together with the fact, that BN_bn2binpad is already constant time if the flag BN_FLG_CONSTTIME is set, this should eliminate the timing oracle completely. In addition the no-asm variant may also have branches that depend on secret values, because the last invocation of bn_sub_words in bn_from_montgomery_word had branches when the function is compiled by certain gcc compiler versions, due to the clumsy coding style. So additionally this patch stream-lined the no-asm C-code in order to avoid branches where possible and improve the resulting code quality. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20282)
2023-03-29changes: note the banning of truncated hashes with DRBGsPauli
Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/20521) (cherry picked from commit 808b30f6b60da3e92283e315f2e6f0e574a62080)
2023-03-28Fix documentation of X509_VERIFY_PARAM_add0_policy()Tomas Mraz
The function was incorrectly documented as enabling policy checking. Fixes: CVE-2023-0466 Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20562)
2023-03-28Updated CHANGES.md and NEWS.md for CVE-2023-0465Matt Caswell
Also updated the entries for CVE-2023-0464 Related-to: CVE-2023-0465 Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20586)
2023-03-22changes: note about policy tree size limits and circumventionPauli
Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/20570)
2023-03-14Prepare for 3.1.1Matt Caswell
Reviewed-by: Tomas Mraz <tomas@openssl.org> Release: yes
2023-03-14Prepare for release of 3.1.0openssl-3.1.0Matt Caswell
Reviewed-by: Tomas Mraz <tomas@openssl.org> Release: yes
2023-03-07Add option to FIPS module to enforce EMS check during KDF TLS1_PRF.slontis
Fixes #19989 Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20241) (cherry picked from commit 50ea5cdcb735916591e35a04c1f5a659bf253ddc)
2023-02-22update changes entry to note EdDSA is not FIPS approvedPauli
Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Hugo Landau <hlandau@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20343) (cherry picked from commit 8c02b98fab688b0ccacbb2de5816a5d5fc7fb23b)
2023-02-11Correct a copy&paste error in a link URLTomas Mraz
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20228) (cherry picked from commit 1472127d9d6bc4866ab26b503e0d5937b40dca37)
2023-02-11Sync CHANGES.md and NEWS.md with 3.0.8 releaseTomas Mraz
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20228) (cherry picked from commit 5f14b5bc25d78384d239428f0d255d1ea7c4a6d1)
2023-02-08remove EdDSA from changes entry about non-fips algorithmsPauli
Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/20219) (cherry picked from commit 4072a762664020524f536361a6de43e8de19a4f8)
2023-02-07CVE-2023-0286: Fix GENERAL_NAME_cmp for x400Address (3.0)Hugo Landau
Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org>
2023-01-31[doc] Sync documentation now that 3.0 honors ↵Nicola Tuveri
OSSL_PKEY_PARAM_EC_POINT_CONVERSION_FORMAT https://github.com/openssl/openssl/pull/19901 backported the "Honor OSSL_PKEY_PARAM_EC_POINT_CONVERSION_FORMAT as set and default to UNCOMPRESSED" changeset to 3.0. This commit updates: - the HISTORY notes of the relevant documentation to mark the change happened since 3.0.8. - the `CHANGES.md file` to sync up with the tip of the `openssl-3.0` branch Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20003) (cherry picked from commit f66c1272f92bed6bc8aa17f6a8956d9e2e5b7798)
2023-01-24changes entry about non-approved FIPS algorithmsPauli
Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Hugo Landau <hlandau@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20079) (cherry picked from commit d4e105f6d53002ebaac2caf0c723bbf734f4a21a)
2022-12-21Prepare for 3.1 beta 2Tomas Mraz
Reviewed-by: Hugo Landau <hlandau@openssl.org> Release: yes
2022-12-21Prepare for release of 3.1 beta 1openssl-3.1.0-beta1Tomas Mraz
Reviewed-by: Hugo Landau <hlandau@openssl.org> Release: yes
2022-12-21Add CHANGES.md entry for support for KMAC in KBKDFTomas Mraz
Reviewed-by: Hugo Landau <hlandau@openssl.org> Release: yes (Merged from https://github.com/openssl/openssl/pull/19943)
2022-12-14CHANGES.md: Fix the 3.0.7 release dateTomas Mraz
Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19865)
2022-12-09signature: Clamp PSS salt len to MD lenClemens Lang
FIPS 186-4 section 5 "The RSA Digital Signature Algorithm", subsection 5.5 "PKCS #1" says: "For RSASSA-PSS […] the length (in bytes) of the salt (sLen) shall satisfy 0 <= sLen <= hLen, where hLen is the length of the hash function output block (in bytes)." Introduce a new option RSA_PSS_SALTLEN_AUTO_DIGEST_MAX and make it the default. The new value will behave like RSA_PSS_SALTLEN_AUTO, but will not use more than the digest length when signing, so that FIPS 186-4 is not violated. This value has two advantages when compared with RSA_PSS_SALTLEN_DIGEST: (1) It will continue to do auto-detection when verifying signatures for maximum compatibility, where RSA_PSS_SALTLEN_DIGEST would fail for other digest sizes. (2) It will work for combinations where the maximum salt length is smaller than the digest size, which typically happens with large digest sizes (e.g., SHA-512) and small RSA keys. J.-S. Coron shows in "Optimal Security Proofs for PSS and Other Signature Schemes. Advances in Cryptology – Eurocrypt 2002, volume 2332 of Lecture Notes in Computer Science, pp. 272 – 287. Springer Verlag, 2002." that longer salts than the output size of modern hash functions do not increase security: "For example,for an application in which at most one billion signatures will be generated, k0 = 30 bits of random salt are actually sufficient to guarantee the same level of security as RSA, and taking a larger salt does not increase the security level." Signed-off-by: Clemens Lang <cllang@redhat.com> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> Reviewed-by: Tomas Mraz <tomas@openssl.org> (cherry picked from commit 6c73ca4a2f4ea71f4a880670624e7b2fdb6f32da) (Merged from https://github.com/openssl/openssl/pull/19862)
2022-12-07Replace "a RSA" with "an RSA"Daniel Fiala
Fixes openssl#19771 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19787) (cherry picked from commit a63fa5f711f1f97e623348656b42717d6904ee3e)
2022-12-01Prepare for 3.1 beta 1Tomas Mraz
Reviewed-by: Matt Caswell <matt@openssl.org> Release: yes
2022-12-01Prepare for release of 3.1 alpha 1openssl-3.1.0-alpha1Tomas Mraz
Reviewed-by: Matt Caswell <matt@openssl.org> Release: yes
2022-11-29Honor OSSL_PKEY_PARAM_EC_POINT_CONVERSION_FORMAT as set and default to ↵Nicola Tuveri
UNCOMPRESSED Originally the code to im/export the EC pubkey was meant to be consumed only by the im/export functions when crossing the provider boundary. Having our providers exporting to a COMPRESSED format octet string made sense to avoid memory waste, as it wasn't exposed outside the provider API, and providers had all tools available to convert across the three formats. Later on, with #13139 deprecating the `EC_KEY_*` functions, more state was added among the params imported/exported on an EC provider-native key (including `OSSL_PKEY_PARAM_EC_POINT_CONVERSION_FORMAT`, although it did not affect the format used to export `OSSL_PKEY_PARAM_PUB_KEY`). Finally, in #14800, `EVP_PKEY_todata()` was introduced and prominently exposed directly to users outside the provider API, and the choice of COMPRESSED over UNCOMPRESSED as the default became less sensible in light of usability, given the latter is more often needed by applications and protocols. This commit fixes it, by using `EC_KEY_get_conv_form()` to get the point format from the internal state (an `EC_KEY` under the hood) of the provider-side object, and using it on `EVP_PKEY_export()`/`EVP_PKEY_todata()` to format `OSSL_PKEY_PARAM_PUB_KEY`. The default for an `EC_KEY` was already UNCOMPRESSED, and it is altered if the user sets `OSSL_PKEY_PARAM_EC_POINT_CONVERSION_FORMAT` via `EVP_PKEY_fromdata()`, `EVP_PKEY_set_params()`, or one of the more specialized methods. For symmetry, this commit also alters `ec_pkey_export_to()` in `crypto/ec/ec_ameth.c`, part of the `EVP_PKEY_ASN1_METHOD` for legacy EC keys: it exclusively used COMPRESSED format, and now it honors the conversion format specified in the EC_KEY object being exported to a provider when this function is called. Expand documentation about `OSSL_PKEY_PARAM_PUB_KEY` and mention the 3.1 change in behavior for our providers. Fixes #16595 Reviewed-by: Hugo Landau <hlandau@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19681)
2022-11-23Fix various typos, repeated words, align some spelling to LDP.FdaSilvaYY
Partially revamped from #16712 - fall thru -> fall through - time stamp -> timestamp - host name -> hostname - ipv6 -> IPv6 Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/19059) (cherry picked from commit d7f3a2cc8691c062ef5bdeef28b66f80c8f7d5c3)
generated by cgit v1.2.3 (git 2.25.1) at 2024-06-16 11:25:50 +0000