From 1222c4e62d063573a7953bd7d70dc2cc3854d952 Mon Sep 17 00:00:00 2001 From: Matt Caswell Date: Fri, 15 Mar 2024 17:58:42 +0000 Subject: Hardening around not_resumable sessions Make sure we can't inadvertently use a not_resumable session Related to CVE-2024-2511 Reviewed-by: Neil Horman Reviewed-by: Tomas Mraz (Merged from https://github.com/openssl/openssl/pull/24042) (cherry picked from commit 21df7f04f6c4a560b4de56d10e1e58958c7e566d) --- ssl/ssl_sess.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/ssl/ssl_sess.c b/ssl/ssl_sess.c index 60ceacde4e..eaa9595f8c 100644 --- a/ssl/ssl_sess.c +++ b/ssl/ssl_sess.c @@ -519,6 +519,12 @@ SSL_SESSION *lookup_sess_in_cache(SSL_CONNECTION *s, sess_id, sess_id_len, ©); if (ret != NULL) { + if (ret->not_resumable) { + /* If its not resumable then ignore this session */ + if (!copy) + SSL_SESSION_free(ret); + return NULL; + } ssl_tsan_counter(s->session_ctx, &s->session_ctx->stats.sess_cb_hit); -- cgit v1.2.3