Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 089abd1

Browse files
zoobazooba
committed
Import OpenSSL 1.1.1q
1 parent a92010e commit 089abd1

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

86 files changed

+2188
-944
lines changed

‎CHANGES

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,58 @@
77
https://github.com/openssl/openssl/commits/ and pick the appropriate
88
release branch.
99

10+
Changes between 1.1.1p and 1.1.1q [5 Jul 2022]
11+
12+
*) AES OCB mode for 32-bit x86 platforms using the AES-NI assembly optimised
13+
implementation would not encrypt the entirety of the data under some
14+
circumstances. This could reveal sixteen bytes of data that was
15+
preexisting in the memory that wasn't written. In the special case of
16+
"in place" encryption, sixteen bytes of the plaintext would be revealed.
17+
18+
Since OpenSSL does not support OCB based cipher suites for TLS and DTLS,
19+
they are both unaffected.
20+
(CVE-2022-2097)
21+
[Alex Chernyakhovsky, David Benjamin, Alejandro Sedeño]
22+
23+
Changes between 1.1.1o and 1.1.1p [21 Jun 2022]
24+
25+
*) In addition to the c_rehash shell command injection identified in
26+
CVE-2022-1292, further bugs where the c_rehash script does not
27+
properly sanitise shell metacharacters to prevent command injection have been
28+
fixed.
29+
30+
When the CVE-2022-1292 was fixed it was not discovered that there
31+
are other places in the script where the file names of certificates
32+
being hashed were possibly passed to a command executed through the shell.
33+
34+
This script is distributed by some operating systems in a manner where
35+
it is automatically executed. On such operating systems, an attacker
36+
could execute arbitrary commands with the privileges of the script.
37+
38+
Use of the c_rehash script is considered obsolete and should be replaced
39+
by the OpenSSL rehash command line tool.
40+
(CVE-2022-2068)
41+
[Daniel Fiala, Tomáš Mráz]
42+
43+
*) When OpenSSL TLS client is connecting without any supported elliptic
44+
curves and TLS-1.3 protocol is disabled the connection will no longer fail
45+
if a ciphersuite that does not use a key exchange based on elliptic
46+
curves can be negotiated.
47+
[Tomáš Mráz]
48+
49+
Changes between 1.1.1n and 1.1.1o [3 May 2022]
50+
51+
*) Fixed a bug in the c_rehash script which was not properly sanitising shell
52+
metacharacters to prevent command injection. This script is distributed
53+
by some operating systems in a manner where it is automatically executed.
54+
On such operating systems, an attacker could execute arbitrary commands
55+
with the privileges of the script.
56+
57+
Use of the c_rehash script is considered obsolete and should be replaced
58+
by the OpenSSL rehash command line tool.
59+
(CVE-2022-1292)
60+
[Tomáš Mráz]
61+
1062
Changes between 1.1.1m and 1.1.1n [15 Mar 2022]
1163

1264
*) Fixed a bug in the BN_mod_sqrt() function that can cause it to loop forever

‎Configurations/10-main.conf

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -995,6 +995,13 @@ my %targets = (
995995
perlasm_scheme => "linux64",
996996
},
997997

998+
"BSD-aarch64" => {
999+
inherit_from => [ "BSD-generic64", asm("aarch64_asm") ],
1000+
lib_cppflags => add("-DL_ENDIAN"),
1001+
bn_ops => "SIXTY_FOUR_BIT_LONG",
1002+
perlasm_scheme => "linux64",
1003+
},
1004+
9981005
"bsdi-elf-gcc" => {
9991006
inherit_from => [ "BASE_unix", asm("x86_elf_asm") ],
10001007
CC => "gcc",

‎NEWS

Lines changed: 17 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,10 +5,26 @@
55
This file gives a brief overview of the major changes between each OpenSSL
66
release. For more details please read the CHANGES file.
77

8+
Major changes between OpenSSL 1.1.1p and OpenSSL 1.1.1q [5 Jul 2022]
9+
10+
o Fixed AES OCB failure to encrypt some bytes on 32-bit x86 platforms
11+
(CVE-2022-2097)
12+
13+
Major changes between OpenSSL 1.1.1o and OpenSSL 1.1.1p [21 Jun 2022]
14+
15+
o Fixed additional bugs in the c_rehash script which was not properly
16+
sanitising shell metacharacters to prevent command injection
17+
(CVE-2022-2068)
18+
19+
Major changes between OpenSSL 1.1.1n and OpenSSL 1.1.1o [3 May 2022]
20+
21+
o Fixed a bug in the c_rehash script which was not properly sanitising
22+
shell metacharacters to prevent command injection (CVE-2022-1292)
23+
824
Major changes between OpenSSL 1.1.1m and OpenSSL 1.1.1n [15 Mar 2022]
925

1026
o Fixed a bug in the BN_mod_sqrt() function that can cause it to loop
11-
forever for non-prime moduli ([CVE-2022-0778])
27+
forever for non-prime moduli (CVE-2022-0778)
1228

1329
Major changes between OpenSSL 1.1.1l and OpenSSL 1.1.1m [14 Dec 2021]
1430

‎README

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11

2-
OpenSSL 1.1.1n 15 Mar 2022
2+
OpenSSL 1.1.1q 5 Jul 2022
33

4-
Copyright (c) 1998-2021 The OpenSSL Project
4+
Copyright (c) 1998-2022 The OpenSSL Project
55
Copyright (c) 1995-1998 Eric A. Young, Tim J. Hudson
66
All rights reserved.
77

‎README.md

Lines changed: 0 additions & 2 deletions
This file was deleted.

‎apps/apps.c

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -307,6 +307,8 @@ int password_callback(char *buf, int bufsiz, int verify, PW_CB_DATA *cb_tmp)
307307
if (cb_data != NULL && cb_data->password != NULL
308308
&& *(const char*)cb_data->password != '\0')
309309
pw_min_len = 1;
310+
else if (!verify)
311+
pw_min_len = 0;
310312
prompt = UI_construct_prompt(ui, "pass phrase", prompt_info);
311313
if (!prompt) {
312314
BIO_printf(bio_err, "Out of memory\n");

‎apps/s_server.c

Lines changed: 44 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 1995-2021 The OpenSSL Project Authors. All Rights Reserved.
2+
* Copyright 1995-2022 The OpenSSL Project Authors. All Rights Reserved.
33
* Copyright (c) 2002, Oracle and/or its affiliates. All rights reserved
44
* Copyright 2005 Nokia. All rights reserved.
55
*
@@ -2236,6 +2236,30 @@ static void print_stats(BIO *bio, SSL_CTX *ssl_ctx)
22362236
SSL_CTX_sess_get_cache_size(ssl_ctx));
22372237
}
22382238

2239+
static long int count_reads_callback(BIO *bio, int cmd, const char *argp,
2240+
int argi, long int argl, long int ret)
2241+
{
2242+
unsigned int *p_counter = (unsigned int *)BIO_get_callback_arg(bio);
2243+
2244+
switch (cmd) {
2245+
case BIO_CB_READ: /* No break here */
2246+
case BIO_CB_GETS:
2247+
if (p_counter != NULL)
2248+
++*p_counter;
2249+
break;
2250+
default:
2251+
break;
2252+
}
2253+
2254+
if (s_debug) {
2255+
BIO_set_callback_arg(bio, (char *)bio_s_out);
2256+
ret = bio_dump_callback(bio, cmd, argp, argi, argl, ret);
2257+
BIO_set_callback_arg(bio, (char *)p_counter);
2258+
}
2259+
2260+
return ret;
2261+
}
2262+
22392263
static int sv_body(int s, int stype, int prot, unsigned char *context)
22402264
{
22412265
char *buf = NULL;
@@ -2353,10 +2377,7 @@ static int sv_body(int s, int stype, int prot, unsigned char *context)
23532377
SSL_set_accept_state(con);
23542378
/* SSL_set_fd(con,s); */
23552379

2356-
if (s_debug) {
2357-
BIO_set_callback(SSL_get_rbio(con), bio_dump_callback);
2358-
BIO_set_callback_arg(SSL_get_rbio(con), (char *)bio_s_out);
2359-
}
2380+
BIO_set_callback(SSL_get_rbio(con), count_reads_callback);
23602381
if (s_msg) {
23612382
#ifndef OPENSSL_NO_SSL_TRACE
23622383
if (s_msg == 2)
@@ -2648,7 +2669,25 @@ static int sv_body(int s, int stype, int prot, unsigned char *context)
26482669
*/
26492670
if ((!async || !SSL_waiting_for_async(con))
26502671
&& !SSL_is_init_finished(con)) {
2672+
/*
2673+
* Count number of reads during init_ssl_connection.
2674+
* It helps us to distinguish configuration errors from errors
2675+
* caused by a client.
2676+
*/
2677+
unsigned int read_counter = 0;
2678+
2679+
BIO_set_callback_arg(SSL_get_rbio(con), (char *)&read_counter);
26512680
i = init_ssl_connection(con);
2681+
BIO_set_callback_arg(SSL_get_rbio(con), NULL);
2682+
2683+
/*
2684+
* If initialization fails without reads, then
2685+
* there was a fatal error in configuration.
2686+
*/
2687+
if (i <= 0 && read_counter == 0) {
2688+
ret = -1;
2689+
goto err;
2690+
}
26522691

26532692
if (i < 0) {
26542693
ret = 0;

‎apps/x509.c

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 1995-2020 The OpenSSL Project Authors. All Rights Reserved.
2+
* Copyright 1995-2022 The OpenSSL Project Authors. All Rights Reserved.
33
*
44
* Licensed under the OpenSSL license (the "License"). You may not use
55
* this file except in compliance with the License. You can obtain a copy
@@ -590,6 +590,8 @@ int x509_main(int argc, char **argv)
590590
xca = load_cert(CAfile, CAformat, "CA Certificate");
591591
if (xca == NULL)
592592
goto end;
593+
if (!X509_set_issuer_name(x, X509_get_subject_name(xca)))
594+
goto end;
593595
}
594596

595597
out = bio_open_default(outfile, 'w', outformat);
@@ -987,8 +989,6 @@ static int x509_certify(X509_STORE *ctx, const char *CAfile, const EVP_MD *diges
987989
goto end;
988990
}
989991

990-
if (!X509_set_issuer_name(x, X509_get_subject_name(xca)))
991-
goto end;
992992
if (!X509_set_serialNumber(x, bs))
993993
goto end;
994994

‎config

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
#!/bin/sh
2-
# Copyright 1998-2020 The OpenSSL Project Authors. All Rights Reserved.
2+
# Copyright 1998-2022 The OpenSSL Project Authors. All Rights Reserved.
33
#
44
# Licensed under the OpenSSL license (the "License"). You may not use
55
# this file except in compliance with the License. You can obtain a copy
@@ -709,6 +709,7 @@ case "$GUESSOS" in
709709
ia64-*-*bsd*) OUT="BSD-ia64" ;;
710710
x86_64-*-dragonfly*) OUT="BSD-x86_64" ;;
711711
amd64-*-*bsd*) OUT="BSD-x86_64" ;;
712+
arm64-*-*bsd*) OUT="BSD-aarch64" ;;
712713
*86*-*-*bsd*) # mimic ld behaviour when it's looking for libc...
713714
if [ -L /usr/lib/libc.so ]; then # [Free|Net]BSD
714715
libc=/usr/lib/libc.so

‎crypto/aes/asm/aesni-x86.pl

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
#! /usr/bin/env perl
2-
# Copyright 2009-2020 The OpenSSL Project Authors. All Rights Reserved.
2+
# Copyright 2009-2022 The OpenSSL Project Authors. All Rights Reserved.
33
#
44
# Licensed under the OpenSSL license (the "License"). You may not use
55
# this file except in compliance with the License. You can obtain a copy
@@ -2027,7 +2027,7 @@ sub aesni_generate6
20272027
&movdqu (&QWP(-16*2,$out,$inp),$inout4);
20282028
&movdqu (&QWP(-16*1,$out,$inp),$inout5);
20292029
&cmp ($inp,$len); # done yet?
2030-
&jb (&label("grandloop"));
2030+
&jbe (&label("grandloop"));
20312031

20322032
&set_label("short");
20332033
&add ($len,16*6);
@@ -2453,7 +2453,7 @@ sub aesni_generate6
24532453
&pxor ($rndkey1,$inout5);
24542454
&movdqu (&QWP(-16*1,$out,$inp),$inout5);
24552455
&cmp ($inp,$len); # done yet?
2456-
&jb (&label("grandloop"));
2456+
&jbe (&label("grandloop"));
24572457

24582458
&set_label("short");
24592459
&add ($len,16*6);

0 commit comments

Comments
 (0)