Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 15a7190

Browse files
zoobazooba
committed
Import OpenSSL 1.1.1u
1 parent 82bfdc9 commit 15a7190

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

44 files changed

+1010
-784
lines changed

‎CHANGES

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,64 @@
77
https://github.com/openssl/openssl/commits/ and pick the appropriate
88
release branch.
99

10+
Changes between 1.1.1t and 1.1.1u [30 May 2023]
11+
12+
*) Mitigate for the time it takes for `OBJ_obj2txt` to translate gigantic
13+
OBJECT IDENTIFIER sub-identifiers to canonical numeric text form.
14+
15+
OBJ_obj2txt() would translate any size OBJECT IDENTIFIER to canonical
16+
numeric text form. For gigantic sub-identifiers, this would take a very
17+
long time, the time complexity being O(n^2) where n is the size of that
18+
sub-identifier. (CVE-2023-2650)
19+
20+
To mitigitate this, `OBJ_obj2txt()` will only translate an OBJECT
21+
IDENTIFIER to canonical numeric text form if the size of that OBJECT
22+
IDENTIFIER is 586 bytes or less, and fail otherwise.
23+
24+
The basis for this restriction is RFC 2578 (STD 58), section 3.5. OBJECT
25+
IDENTIFIER values, which stipulates that OBJECT IDENTIFIERS may have at
26+
most 128 sub-identifiers, and that the maximum value that each sub-
27+
identifier may have is 2^32-1 (4294967295 decimal).
28+
29+
For each byte of every sub-identifier, only the 7 lower bits are part of
30+
the value, so the maximum amount of bytes that an OBJECT IDENTIFIER with
31+
these restrictions may occupy is 32 * 128 / 7, which is approximately 586
32+
bytes.
33+
34+
Ref: https://datatracker.ietf.org/doc/html/rfc2578#section-3.5
35+
36+
[Richard Levitte]
37+
38+
*) Reworked the Fix for the Timing Oracle in RSA Decryption (CVE-2022-4304).
39+
The previous fix for this timing side channel turned out to cause
40+
a severe 2-3x performance regression in the typical use case
41+
compared to 1.1.1s. The new fix uses existing constant time
42+
code paths, and restores the previous performance level while
43+
fully eliminating all existing timing side channels.
44+
The fix was developed by Bernd Edlinger with testing support
45+
by Hubert Kario.
46+
[Bernd Edlinger]
47+
48+
*) Corrected documentation of X509_VERIFY_PARAM_add0_policy() to mention
49+
that it does not enable policy checking. Thanks to
50+
David Benjamin for discovering this issue. (CVE-2023-0466)
51+
[Tomas Mraz]
52+
53+
*) Fixed an issue where invalid certificate policies in leaf certificates are
54+
silently ignored by OpenSSL and other certificate policy checks are skipped
55+
for that certificate. A malicious CA could use this to deliberately assert
56+
invalid certificate policies in order to circumvent policy checking on the
57+
certificate altogether. (CVE-2023-0465)
58+
[Matt Caswell]
59+
60+
*) Limited the number of nodes created in a policy tree to mitigate
61+
against CVE-2023-0464. The default limit is set to 1000 nodes, which
62+
should be sufficient for most installations. If required, the limit
63+
can be adjusted by setting the OPENSSL_POLICY_TREE_NODES_MAX build
64+
time define to a desired maximum number of nodes or zero to allow
65+
unlimited growth. (CVE-2023-0464)
66+
[Paul Dale]
67+
1068
Changes between 1.1.1s and 1.1.1t [7 Feb 2023]
1169

1270
*) Fixed X.400 address type confusion in X.509 GeneralName.

‎Configurations/descrip.mms.tmpl

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,8 @@
1313
our $sover_dirname = sprintf "%02d%02d", split(/\./, $config{shlib_version_number});
1414
our $osslver = sprintf "%02d%02d", split(/\./, $config{version});
1515

16+
our $shlibvariant = $target{shlib_variant} || "";
17+
1618
our $sourcedir = $config{sourcedir};
1719
our $builddir = $config{builddir};
1820
sub sourcefile {
@@ -47,13 +49,13 @@
4749
map { (my $x = $_) =~ s/\.a$//; $x }
4850
@{$unified_info{libraries}};
4951
our @shlibs =
50-
map { $unified_info{sharednames}->{$_} || () }
52+
map { $unified_info{sharednames}->{$_}.$shlibvariant || () }
5153
grep(!/\.a$/, @{$unified_info{libraries}});
5254
our @install_libs =
5355
map { (my $x = $_) =~ s/\.a$//; $x }
5456
@{$unified_info{install}->{libraries}};
5557
our @install_shlibs =
56-
map { $unified_info{sharednames}->{$_} || () }
58+
map { $unified_info{sharednames}->{$_}.$shlibvariant || () }
5759
grep(!/\.a$/, @{$unified_info{install}->{libraries}});
5860

5961
# This is a horrible hack, but is needed because recursive inclusion of files
@@ -695,7 +697,7 @@ reconfigure reconf :
695697
}
696698
return map { $_ =~ /\.a$/
697699
? $`.".OLB"
698-
: $unified_info{sharednames}->{$_}.".EXE" } @_;
700+
: $unified_info{sharednames}->{$_}.$shlibvariant.".EXE" } @_;
699701
}
700702

701703
# Helper function to deal with inclusion directory specs.
@@ -912,7 +914,7 @@ EOF
912914
sub libobj2shlib {
913915
my %args = @_;
914916
my $lib = $args{lib};
915-
my $shlib = $args{shlib};
917+
my $shlib = $args{shlib}.$shlibvariant;
916918
my $libd = dirname($lib);
917919
my $libn = basename($lib);
918920
my @objs = map { (my $x = $_) =~ s|\.o$|.OBJ|; $x }

‎Configurations/windows-makefile.tmpl

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@
99
our $exeext = $target{exe_extension} || ".exe";
1010
our $libext = $target{lib_extension} || ".lib";
1111
our $shlibext = $target{shared_extension} || ".dll";
12+
our $shlibvariant = $target{shlib_variant} || "";
1213
our $shlibextimport = $target{shared_import_extension} || ".lib";
1314
our $dsoext = $target{dso_extension} || ".dll";
1415

@@ -35,7 +36,7 @@
3536
my $lib = shift;
3637
return () if $disabled{shared} || $lib =~ /\.a$/;
3738
return () unless defined $unified_info{sharednames}->{$lib};
38-
return $unified_info{sharednames}->{$lib} . $shlibext;
39+
return $unified_info{sharednames}->{$lib} . $shlibvariant . $shlibext;
3940
}
4041

4142
sub lib {

‎Configure

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1244,7 +1244,7 @@ if ($target =~ /^mingw/ && `$config{CC} --target-help 2>&1` =~ m/-mno-cygwin/m)
12441244
}
12451245

12461246
if ($target =~ /linux.*-mips/ && !$disabled{asm}
1247-
&& !grep { $_ !~ /-m(ips|arch=)/ } (@{$config{CFLAGS}})) {
1247+
&& !grep { $_ =~ /-m(ips|arch=)/ } (@{$config{CFLAGS}})) {
12481248
# minimally required architecture flags for assembly modules
12491249
my $value;
12501250
$value = '-mips2' if ($target =~ /mips32/);

‎NEWS

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,15 @@
55
This file gives a brief overview of the major changes between each OpenSSL
66
release. For more details please read the CHANGES file.
77

8+
Major changes between OpenSSL 1.1.1t and OpenSSL 1.1.1u [30 May 2023]
9+
10+
o Mitigate for very slow `OBJ_obj2txt()` performance with gigantic
11+
OBJECT IDENTIFIER sub-identities. (CVE-2023-2650)
12+
o Fixed documentation of X509_VERIFY_PARAM_add0_policy() (CVE-2023-0466)
13+
o Fixed handling of invalid certificate policies in leaf certificates
14+
(CVE-2023-0465)
15+
o Limited the number of nodes created in a policy tree ([CVE-2023-0464])
16+
817
Major changes between OpenSSL 1.1.1s and OpenSSL 1.1.1t [7 Feb 2023]
918

1019
o Fixed X.400 address type confusion in X.509 GeneralName (CVE-2023-0286)

‎README

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11

2-
OpenSSL 1.1.1t 7 Feb 2023
2+
OpenSSL 1.1.1u 30 May 2023
33

4-
Copyright (c) 1998-2022 The OpenSSL Project
4+
Copyright (c) 1998-2023 The OpenSSL Project
55
Copyright (c) 1995-1998 Eric A. Young, Tim J. Hudson
66
All rights reserved.
77

‎crypto/aes/asm/bsaes-armv7.pl

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
#! /usr/bin/env perl
2-
# Copyright 2012-2020 The OpenSSL Project Authors. All Rights Reserved.
2+
# Copyright 2012-2023 The OpenSSL Project Authors. All Rights Reserved.
33
#
44
# Licensed under the OpenSSL license (the "License"). You may not use
55
# this file except in compliance with the License. You can obtain a copy
@@ -14,7 +14,7 @@
1414
# details see http://www.openssl.org/~appro/cryptogams/.
1515
#
1616
# Specific modes and adaptation for Linux kernel by Ard Biesheuvel
17-
# of Linaro. Permission to use under GPL terms is granted.
17+
# of Linaro.
1818
# ====================================================================
1919

2020
# Bit-sliced AES for ARM NEON

‎crypto/asn1/a_bitstr.c

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 1995-2016 The OpenSSL Project Authors. All Rights Reserved.
2+
* Copyright 1995-2023 The OpenSSL Project Authors. All Rights Reserved.
33
*
44
* Licensed under the OpenSSL license (the "License"). You may not use
55
* this file except in compliance with the License. You can obtain a copy
@@ -148,6 +148,9 @@ int ASN1_BIT_STRING_set_bit(ASN1_BIT_STRING *a, int n, int value)
148148
int w, v, iv;
149149
unsigned char *c;
150150

151+
if (n < 0)
152+
return 0;
153+
151154
w = n / 8;
152155
v = 1 << (7 - (n & 0x07));
153156
iv = ~v;
@@ -182,6 +185,9 @@ int ASN1_BIT_STRING_get_bit(const ASN1_BIT_STRING *a, int n)
182185
{
183186
int w, v;
184187

188+
if (n < 0)
189+
return 0;
190+
185191
w = n / 8;
186192
v = 1 << (7 - (n & 0x07));
187193
if ((a == NULL) || (a->length < (w + 1)) || (a->data == NULL))

‎crypto/bio/b_print.c

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -305,7 +305,6 @@ _dopr(char **sbuffer,
305305
case 'G':
306306
case 'g':
307307
/* not implemented for UEFI */
308-
ERR_raise(ERR_LIB_BIO, ERR_R_UNSUPPORTED);
309308
return 0;
310309
#endif
311310
case 'c':

0 commit comments

Comments
 (0)