Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit a5c15eb

Browse files
zoobazooba
committed
Import OpenSSL 3.0.13
1 parent 4c87ca3 commit a5c15eb

File tree

275 files changed

+4851
-1209
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

275 files changed

+4851
-1209
lines changed

‎CHANGES.md‎

Lines changed: 97 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,98 @@ breaking changes, and mappings for the large list of deprecated functions.
2828

2929
[Migration guide]: https://github.com/openssl/openssl/tree/master/doc/man7/migration_guide.pod
3030

31+
### Changes between 3.0.12 and 3.0.13 [30 Jan 2024]
32+
33+
* A file in PKCS12 format can contain certificates and keys and may come from
34+
an untrusted source. The PKCS12 specification allows certain fields to be
35+
NULL, but OpenSSL did not correctly check for this case. A fix has been
36+
applied to prevent a NULL pointer dereference that results in OpenSSL
37+
crashing. If an application processes PKCS12 files from an untrusted source
38+
using the OpenSSL APIs then that application will be vulnerable to this
39+
issue prior to this fix.
40+
41+
OpenSSL APIs that were vulnerable to this are: PKCS12_parse(),
42+
PKCS12_unpack_p7data(), PKCS12_unpack_p7encdata(), PKCS12_unpack_authsafes()
43+
and PKCS12_newpass().
44+
45+
We have also fixed a similar issue in SMIME_write_PKCS7(). However since this
46+
function is related to writing data we do not consider it security
47+
significant.
48+
49+
([CVE-2024-0727])
50+
51+
*Matt Caswell*
52+
53+
* When function EVP_PKEY_public_check() is called on RSA public keys,
54+
a computation is done to confirm that the RSA modulus, n, is composite.
55+
For valid RSA keys, n is a product of two or more large primes and this
56+
computation completes quickly. However, if n is an overly large prime,
57+
then this computation would take a long time.
58+
59+
An application that calls EVP_PKEY_public_check() and supplies an RSA key
60+
obtained from an untrusted source could be vulnerable to a Denial of Service
61+
attack.
62+
63+
The function EVP_PKEY_public_check() is not called from other OpenSSL
64+
functions however it is called from the OpenSSL pkey command line
65+
application. For that reason that application is also vulnerable if used
66+
with the "-pubin" and "-check" options on untrusted data.
67+
68+
To resolve this issue RSA keys larger than OPENSSL_RSA_MAX_MODULUS_BITS will
69+
now fail the check immediately with an RSA_R_MODULUS_TOO_LARGE error reason.
70+
71+
([CVE-2023-6237])
72+
73+
*Tomáš Mráz*
74+
75+
* Restore the encoding of SM2 PrivateKeyInfo and SubjectPublicKeyInfo to
76+
have the contained AlgorithmIdentifier.algorithm set to id-ecPublicKey
77+
rather than SM2.
78+
79+
*Richard Levitte*
80+
81+
* The POLY1305 MAC (message authentication code) implementation in OpenSSL
82+
for PowerPC CPUs saves the contents of vector registers in different
83+
order than they are restored. Thus the contents of some of these vector
84+
registers is corrupted when returning to the caller. The vulnerable code is
85+
used only on newer PowerPC processors supporting the PowerISA 2.07
86+
instructions.
87+
88+
The consequences of this kind of internal application state corruption can
89+
be various - from no consequences, if the calling application does not
90+
depend on the contents of non-volatile XMM registers at all, to the worst
91+
consequences, where the attacker could get complete control of the
92+
application process. However unless the compiler uses the vector registers
93+
for storing pointers, the most likely consequence, if any, would be an
94+
incorrect result of some application dependent calculations or a crash
95+
leading to a denial of service.
96+
97+
([CVE-2023-6129])
98+
99+
*Rohan McLure*
100+
101+
* Fix excessive time spent in DH check / generation with large Q parameter
102+
value.
103+
104+
Applications that use the functions DH_generate_key() to generate an
105+
X9.42 DH key may experience long delays. Likewise, applications that use
106+
DH_check_pub_key(), DH_check_pub_key_ex() or EVP_PKEY_public_check()
107+
to check an X9.42 DH key or X9.42 DH parameters may experience long delays.
108+
Where the key or parameters that are being checked have been obtained from
109+
an untrusted source this may lead to a Denial of Service.
110+
111+
([CVE-2023-5678])
112+
113+
*Richard Levitte*
114+
115+
### Changes between 3.0.11 and 3.0.12 [24 Oct 2023]
116+
117+
* Fix incorrect key and IV resizing issues when calling EVP_EncryptInit_ex2(),
118+
EVP_DecryptInit_ex2() or EVP_CipherInit_ex2() with OSSL_PARAM parameters
119+
that alter the key or IV length ([CVE-2023-5363]).
120+
121+
*Paul Dale*
122+
31123
### Changes between 3.0.10 and 3.0.11 [19 Sep 2023]
32124

33125
* Fix POLY1305 MAC implementation corrupting XMM registers on Windows.
@@ -19732,6 +19824,11 @@ ndif
1973219824

1973319825
<!-- Links -->
1973419826

19827+
[CVE-2024-0727]: https://www.openssl.org/news/vulnerabilities.html#CVE-2024-0727
19828+
[CVE-2023-6237]: https://www.openssl.org/news/vulnerabilities.html#CVE-2023-6237
19829+
[CVE-2023-6129]: https://www.openssl.org/news/vulnerabilities.html#CVE-2023-6129
19830+
[CVE-2023-5678]: https://www.openssl.org/news/vulnerabilities.html#CVE-2023-5678
19831+
[CVE-2023-5363]: https://www.openssl.org/news/vulnerabilities.html#CVE-2023-5363
1973519832
[CVE-2023-4807]: https://www.openssl.org/news/vulnerabilities.html#CVE-2023-4807
1973619833
[CVE-2023-3817]: https://www.openssl.org/news/vulnerabilities.html#CVE-2023-3817
1973719834
[CVE-2023-3446]: https://www.openssl.org/news/vulnerabilities.html#CVE-2023-3446

‎CONTRIBUTING.md‎

Lines changed: 36 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -9,31 +9,45 @@ Development is done on GitHub in the [openssl/openssl] repository.
99

1010
[openssl/openssl]: <https://github.com/openssl/openssl>
1111

12-
To request new features or report bugs, please open an issue on GitHub
12+
To request new a feature, ask a question, or report a bug,
13+
please open an [issue on GitHub](https://github.com/openssl/openssl/issues).
1314

14-
To submit a patch, please open a pull request on GitHub. If you are thinking
15-
of making a large contribution, open an issue for it before starting work,
16-
to get comments from the community. Someone may be already working on
17-
the same thing or there may be reasons why that feature isn't implemented.
15+
To submit a patch or implement a new feature, please open a
16+
[pull request on GitHub](https://github.com/openssl/openssl/pulls).
17+
If you are thinking of making a large contribution,
18+
open an issue for it before starting work, to get comments from the community.
19+
Someone may be already working on the same thing,
20+
or there may be special reasons why a feature is not implemented.
1821

1922
To make it easier to review and accept your pull request, please follow these
2023
guidelines:
2124

2225
1. Anything other than a trivial contribution requires a [Contributor
2326
License Agreement] (CLA), giving us permission to use your code.
24-
If your contribution is too small to require a CLA (e.g. fixing a spelling
25-
mistake), place the text "`CLA: trivial`" on a line by itself separated by
26-
an empty line from the rest of the commit message. It is not sufficient to
27-
only place the text in the GitHub pull request description.
27+
If your contribution is too small to require a CLA (e.g., fixing a spelling
28+
mistake), then place the text "`CLA: trivial`" on a line by itself below
29+
the rest of your commit message separated by an empty line, like this:
30+
31+
```
32+
One-line summary of trivial change
33+
34+
Optional main body of commit message. It might contain a sentence
35+
or two explaining the trivial change.
36+
37+
CLA: trivial
38+
```
39+
40+
It is not sufficient to only place the text "`CLA: trivial`" in the GitHub
41+
pull request description.
2842
2943
[Contributor License Agreement]: <https://www.openssl.org/policies/cla.html>
3044
3145
To amend a missing "`CLA: trivial`" line after submission, do the following:
3246
3347
```
3448
git commit --amend
35-
[add the line, save and quit the editor]
36-
git push -f
49+
# add the line, save and quit the editor
50+
git push -f [<repository> [<branch>]]
3751
```
3852
3953
2. All source files should start with the following text (with
@@ -53,22 +67,24 @@ guidelines:
5367
often. We do not accept merge commits, you will have to remove them
5468
(usually by rebasing) before it will be acceptable.
5569
56-
4. Patches should follow our [coding style] and compile without warnings.
57-
Where `gcc` or `clang` is available you should use the
70+
4. Code provided should follow our [coding style] and compile without warnings.
71+
There is a [Perl tool](util/check-format.pl) that helps
72+
finding code formatting mistakes and other coding style nits.
73+
Where `gcc` or `clang` is available, you should use the
5874
`--strict-warnings` `Configure` option. OpenSSL compiles on many varied
59-
platforms: try to ensure you only use portable features. Clean builds via
60-
GitHub Actions and AppVeyor are required, and they are started automatically
61-
whenever a PR is created or updated.
75+
platforms: try to ensure you only use portable features.
76+
Clean builds via GitHub Actions are required. They are started automatically
77+
whenever a PR is created or updated by committers.
6278
6379
[coding style]: https://www.openssl.org/policies/technical/coding-style.html
6480
65-
5. When at all possible, patches should include tests. These can
81+
5. When at all possible, code contributions should include tests. These can
6682
either be added to an existing test, or completely new. Please see
6783
[test/README.md](test/README.md) for information on the test framework.
6884
6985
6. New features or changed functionality must include
70-
documentation. Please look at the "pod" files in doc/man[1357] for
71-
examples of our style. Run "make doc-nits" to make sure that your
86+
documentation. Please look at the `.pod` files in `doc/man[1357]` for
87+
examples of our style. Run `make doc-nits` to make sure that your
7288
documentation changes are clean.
7389
7490
7. For user visible changes (API changes, behaviour changes, ...),
@@ -78,7 +94,7 @@ guidelines:
7894
Have a look through existing entries for inspiration.
7995
Please note that this is NOT simply a copy of git-log one-liners.
8096
Also note that security fixes get an entry in [CHANGES.md](CHANGES.md).
81-
This file helps users get more in depth information of what comes
97+
This file helps users get more in-depth information of what comes
8298
with a specific release without having to sift through the higher
8399
noise ratio in git-log.
84100

‎Configurations/10-main.conf‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1941,5 +1941,15 @@ my %targets = (
19411941
inherit_from => [ "vms-generic" ],
19421942
bn_ops => "SIXTY_FOUR_BIT",
19431943
pointer_size => "",
1944+
},
1945+
"vms-x86_64-p32" => {
1946+
inherit_from => [ "vms-x86_64" ],
1947+
cflags => add("/POINTER_SIZE=32"),
1948+
pointer_size => "32",
1949+
},
1950+
"vms-x86_64-p64" => {
1951+
inherit_from => [ "vms-x86_64" ],
1952+
cflags => add("/POINTER_SIZE=64=ARGV"),
1953+
pointer_size => "64",
19441954
}
19451955
);

‎Configurations/descrip.mms.tmpl‎

Lines changed: 7 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -478,7 +478,8 @@ build_all_generated : $(GENERATED_MANDATORY) $(GENERATED) build_docs
478478
all : build_sw build_docs
479479

480480
test : tests
481-
{- dependmagic('tests'); -} : build_programs_nodep, build_modules_nodep run_tests
481+
{- dependmagic('tests'); -} : build_programs_nodep, build_modules_nodep
482+
$(MMS) $(MMSQUALIFIERS) run_tests
482483
run_tests :
483484
@ ! {- output_off() if $disabled{tests}; "" -}
484485
DEFINE SRCTOP "$(SRCDIR)"
@@ -710,13 +711,15 @@ vmsconfig.pm : configdata.pm
710711
WRITE CONFIG " shlib_version => '","{- $config{shlib_version} -}","',"
711712
WRITE CONFIG " shlib_major => '","{- $config{shlib_major} -}","',"
712713
WRITE CONFIG " shlib_minor => '","{- $config{shlib_minor} -}","',"
713-
WRITE CONFIG " no_shared => '","{- $disabled{shared} -}","',"
714714
WRITE CONFIG " INSTALLTOP => '$(INSTALLTOP)',"
715715
WRITE CONFIG " OPENSSLDIR => '$(OPENSSLDIR)',"
716+
WRITE CONFIG ");"
717+
WRITE CONFIG "our %target = ("
716718
WRITE CONFIG " pointer_size => '","{- $target{pointer_size} -}","',"
717719
WRITE CONFIG ");"
718-
WRITE CONFIG "our %target = ();"
719-
WRITE CONFIG "our %disabled = ();"
720+
WRITE CONFIG "our %disabled = ("
721+
WRITE CONFIG " shared => '","{- $disabled{shared} -}","',"
722+
WRITE CONFIG ");"
720723
WRITE CONFIG "our %withargs = ();"
721724
WRITE CONFIG "our %unified_info = ();"
722725
WRITE CONFIG "1;"

0 commit comments

Comments
 (0)