| 5dd94f1 | Matt Caswell | 03 May 2016, 13:46:41 UTC | Prepare for 1.0.2h release Reviewed-by: Rich Salz <rsalz@openssl.org> | 03 May 2016, 13:46:41 UTC |
| 76564c8 | Matt Caswell | 03 May 2016, 13:46:41 UTC | make update Reviewed-by: Rich Salz <rsalz@openssl.org> | 03 May 2016, 13:46:41 UTC |
| b4d56b8 | Matt Caswell | 03 May 2016, 08:37:23 UTC | Update CHANGES and NEWS for the new release Reviewed-by: Richard Levitte <levitte@openssl.org> | 03 May 2016, 12:19:10 UTC |
| d4b2598 | Dr. Stephen Henson | 15 April 2016, 01:37:09 UTC | Fix ASN1_INTEGER handling. Only treat an ASN1_ANY type as an integer if it has the V_ASN1_INTEGER tag: V_ASN1_NEG_INTEGER is an internal only value which is never used for on the wire encoding. Thanks to David Benjamin <davidben@google.com> for reporting this bug. This was found using libFuzzer. RT#4364 (part)CVE-2016-2108. Reviewed-by: Emilia Käsper <emilia@openssl.org> | 03 May 2016, 12:05:34 UTC |
| 68595c0 | Kurt Roeckx | 16 April 2016, 21:08:56 UTC | Check that we have enough padding characters. Reviewed-by: Emilia Käsper <emilia@openssl.org> CVE-2016-2107 MR: #2572 | 03 May 2016, 12:05:34 UTC |
| 643e8e9 | Matt Caswell | 03 May 2016, 11:45:45 UTC | Remove some documentation for functions not in 1.0.x A few functions in the recently added EVP_EncodeInit docs don't apply to the 1.0.x branches. Reviewed-by: Richard Levitte <levitte@openssl.org> | 03 May 2016, 11:53:47 UTC |
| 0b3762a | Matt Caswell | 25 April 2016, 10:54:30 UTC | Add documentation for EVP_EncodeInit() and similar functions Reviewed-by: Richard Levitte <levitte@openssl.org> | 03 May 2016, 10:50:13 UTC |
| 3850c2b | Matt Caswell | 25 April 2016, 08:06:29 UTC | Ensure EVP_EncodeUpdate handles an output length that is too long With the EVP_EncodeUpdate function it is the caller's responsibility to determine how big the output buffer should be. The function writes the amount actually used to |*outl|. However this could go negative with a sufficiently large value for |inl|. We add a check for this error condition. Reviewed-by: Richard Levitte <levitte@openssl.org> | 03 May 2016, 10:49:12 UTC |
| 172c6e1 | Matt Caswell | 04 March 2016, 10:17:17 UTC | Avoid overflow in EVP_EncodeUpdate An overflow can occur in the EVP_EncodeUpdate function which is used for Base64 encoding of binary data. If an attacker is able to supply very large amounts of input data then a length check can overflow resulting in a heap corruption. Due to the very large amounts of data involved this will most likely result in a crash. Internally to OpenSSL the EVP_EncodeUpdate function is primarly used by the PEM_write_bio* family of functions. These are mainly used within the OpenSSL command line applications, so any application which processes data from an untrusted source and outputs it as a PEM file should be considered vulnerable to this issue. User applications that call these APIs directly with large amounts of untrusted data may also be vulnerable. Issue reported by Guido Vranken. CVE-2016-2105 Reviewed-by: Richard Levitte <levitte@openssl.org> | 03 May 2016, 10:48:28 UTC |
| 9f2ccf1 | Matt Caswell | 28 April 2016, 09:46:55 UTC | Prevent EBCDIC overread for very long strings ASN1 Strings that are over 1024 bytes can cause an overread in applications using the X509_NAME_oneline() function on EBCDIC systems. This could result in arbitrary stack data being returned in the buffer. Issue reported by Guido Vranken. CVE-2016-2176 Reviewed-by: Andy Polyakov <appro@openssl.org> | 03 May 2016, 09:25:05 UTC |
| 3ab937b | Matt Caswell | 03 March 2016, 23:36:23 UTC | Fix encrypt overflow An overflow can occur in the EVP_EncryptUpdate function. If an attacker is able to supply very large amounts of input data after a previous call to EVP_EncryptUpdate with a partial block then a length check can overflow resulting in a heap corruption. Following an analysis of all OpenSSL internal usage of the EVP_EncryptUpdate function all usage is one of two forms. The first form is like this: EVP_EncryptInit() EVP_EncryptUpdate() i.e. where the EVP_EncryptUpdate() call is known to be the first called function after an EVP_EncryptInit(), and therefore that specific call must be safe. The second form is where the length passed to EVP_EncryptUpdate() can be seen from the code to be some small value and therefore there is no possibility of an overflow. Since all instances are one of these two forms, I believe that there can be no overflows in internal code due to this problem. It should be noted that EVP_DecryptUpdate() can call EVP_EncryptUpdate() in certain code paths. Also EVP_CipherUpdate() is a synonym for EVP_EncryptUpdate(). Therefore I have checked all instances of these calls too, and came to the same conclusion, i.e. there are no instances in internal usage where an overflow could occur. This could still represent a security issue for end user code that calls this function directly. CVE-2016-2106 Issue reported by Guido Vranken. Reviewed-by: Tim Hudson <tjh@openssl.org> (cherry picked from commit 3f3582139fbb259a1c3cbb0a25236500a409bf26) | 03 May 2016, 08:00:04 UTC |
| c5e603e | Dr. Stephen Henson | 02 May 2016, 16:33:50 UTC | Fix i2d_X509_AUX: pp can be NULL. Reported by David Benjamin Reviewed-by: Emilia Käsper <emilia@openssl.org> (cherry picked from commit 05aef4bbdbc18e7b9490512cdee41e8a608bcc0e) | 02 May 2016, 21:49:32 UTC |
| a8d40f6 | TJ Saunders | 29 April 2016, 14:40:28 UTC | Remove confusing comment. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> | 02 May 2016, 16:54:38 UTC |
| 8769314 | TJ Saunders | 23 March 2016, 18:55:53 UTC | Issue #719: If no serverinfo extension is found in some cases, do not abort the handshake, but simply omit/skip that extension. Check for already-registered serverinfo callbacks during serverinfo registration. Update SSL_CTX_use_serverinfo() documentation to mention the need to reload the same serverinfo per certificate, for servers with multiple server certificates. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> | 02 May 2016, 16:54:38 UTC |
| 64eaf6c | Dr. Stephen Henson | 27 April 2016, 19:27:41 UTC | Don't free ret->data if malloc fails. Issue reported by Guido Vranken. Reviewed-by: Matt Caswell <matt@openssl.org> | 29 April 2016, 20:36:14 UTC |
| 9b08619 | Dr. Stephen Henson | 28 April 2016, 18:45:44 UTC | Add checks to X509_NAME_oneline() Sanity check field lengths and sums to avoid potential overflows and reject excessively large X509_NAME structures. Issue reported by Guido Vranken. Reviewed-by: Matt Caswell <matt@openssl.org> (cherry picked from commit 77076dc944f76e821e4eae3a6563b853ce00c0ed) Conflicts: crypto/x509/x509_err.c crypto/x509/x509_obj.c | 29 April 2016, 18:50:49 UTC |
| 66e731a | Dr. Stephen Henson | 28 April 2016, 12:09:27 UTC | Sanity check buffer length. Reject zero length buffers passed to X509_NAME_onelne(). Issue reported by Guido Vranken. Reviewed-by: Matt Caswell <matt@openssl.org> (cherry picked from commit b33d1141b6dcce947708b984c5e9e91dad3d675d) | 29 April 2016, 18:46:09 UTC |
| 65cb92f | Dr. Stephen Henson | 28 April 2016, 11:55:29 UTC | Add size limit to X509_NAME structure. This adds an explicit limit to the size of an X509_NAME structure. Some part of OpenSSL (e.g. TLS) already effectively limit the size due to restrictions on certificate size. Reviewed-by: Matt Caswell <matt@openssl.org> (cherry picked from commit 295f3a24919157e2f9021d0b1709353710ad63db) | 29 April 2016, 18:45:52 UTC |
| 4436299 | Dr. Stephen Henson | 23 April 2016, 12:33:05 UTC | Reject inappropriate private key encryption ciphers. The traditional private key encryption algorithm doesn't function properly if the IV length of the cipher is zero. These ciphers (e.g. ECB mode) are not suitable for private key encryption anyway. Reviewed-by: Emilia Käsper <emilia@openssl.org> (cherry picked from commit d78df5dfd650e6de159a19a033513481064644f5) | 27 April 2016, 23:06:07 UTC |
| 8f43c80 | Matt Caswell | 25 April 2016, 15:05:55 UTC | Ensure we check i2d_X509 return val The i2d_X509() function can return a negative value on error. Therefore we should make sure we check it. Issue reported by Yuan Jochen Kang. Reviewed-by: Emilia Käsper <emilia@openssl.org> (cherry picked from commit 446ba8de9af9aa4fa3debc7c76a38f4efed47a62) | 26 April 2016, 13:32:45 UTC |
| 0ca6764 | Matt Caswell | 25 April 2016, 16:45:11 UTC | Fix a signed/unsigned warning This causes a compilation failure when using --strict-warnings in 1.0.2 and 1.0.1 Reviewed-by: Viktor Dukhovni <viktor@openssl.org> | 25 April 2016, 16:45:11 UTC |
| d31bc17 | Rich Salz | 25 April 2016, 12:56:54 UTC | Fix NULL deref in apps/pkcs7 Thanks to Brian Carpenter for finding and reporting this. Reviewed-by: Emilia Käsper <emilia@openssl.org> (cherry picked from commit 79356a83b78a2d936dcd022847465d9ebf6c67b1) | 25 April 2016, 15:44:52 UTC |
| 0b48a24 | Andy Polyakov | 15 April 2016, 14:39:22 UTC | s390x assembly pack: cache capability query results. IBM argues that in certain scenarios capability query is really expensive. At the same time it's asserted that query results can be safely cached, because disabling CPACF is incompatible with reboot-free operation. Reviewed-by: Tim Hudson <tjh@openssl.org> (cherry picked from commit 670ad0fbf6ebcf113e278d8174081a7e2d2fa44c) | 25 April 2016, 09:54:38 UTC |
| 2442382 | Viktor Dukhovni | 20 April 2016, 02:23:24 UTC | Fix buffer overrun in ASN1_parse(). Backport of commits: 79c7f74d6cefd5d32fa20e69195ad3de834ce065 bdcd660e33710079b495cf5cc6a1aaa5d2dcd317 from master. Reviewed-by: Matt Caswell <matt@openssl.org> | 23 April 2016, 04:44:50 UTC |
| f327740 | Dr. Stephen Henson | 11 April 2016, 12:57:20 UTC | Harden ASN.1 BIO handling of large amounts of data. If the ASN.1 BIO is presented with a large length field read it in chunks of increasing size checking for EOF on each read. This prevents small files allocating excessive amounts of data. CVE-2016-2109 Thanks to Brian Carpenter for reporting this issue. Reviewed-by: Viktor Dukhovni <viktor@openssl.org> (cherry picked from commit c62981390d6cf9e3d612c489b8b77c2913b25807) | 22 April 2016, 23:27:42 UTC |
| 9676402 | Andy Polyakov | 31 March 2016, 16:47:17 UTC | PPC assembly pack: remove branch hints. As it turns out branch hints grew as kind of a misconception. In addition their interpretation by GNU assembler is affected by assembler flags and can end up with opposite meaning on different processors. As we have to loose quite a lot on misinterprerations, especially on newer processors, we just omit them altogether. Reviewed-by: Tim Hudson <tjh@openssl.org> (cherry picked from commit 20b88bb160865b0c2998056fe841b1cbacd6d4c7) | 07 April 2016, 19:29:57 UTC |
| ec66c8c | David Benjamin | 14 March 2016, 19:03:07 UTC | Fix memory leak on invalid CertificateRequest. Free up parsed X509_NAME structure if the CertificateRequest message contains excess data. The security impact is considered insignificant. This is a client side only leak and a large number of connections to malicious servers would be needed to have a significant impact. This was found by libFuzzer. Reviewed-by: Emilia Käsper <emilia@openssl.org> Reviewed-by: Stephen Henson <steve@openssl.org> | 07 April 2016, 18:25:48 UTC |
| af2db04 | Todd Short | 05 March 2016, 13:47:55 UTC | Fix ALPN * Perform ALPN after the SNI callback; the SSL_CTX may change due to that processing * Add flags to indicate that we actually sent ALPN, to properly error out if unexpectedly received. * document ALPN functions * unit tests Backport of commit 817cd0d52f0462039d1fe60462150be7f59d2002 Reviewed-by: Emilia Käsper <emilia@openssl.org> Reviewed-by: Dr. Stephen Henson <steve@openssl.org> | 04 April 2016, 17:45:09 UTC |
| 21211ad | Dr. Stephen Henson | 26 March 2016, 15:00:53 UTC | Fix FIPS SSLv2 test Reviewed-by: Viktor Dukhovni <viktor@openssl.org> | 26 March 2016, 15:00:53 UTC |
| a6406c9 | Matt Caswell | 17 March 2016, 12:55:02 UTC | Fix the no-comp option for Windows no-comp on Windows was not actually suppressing compilation of the code, although it was suppressing its use. Reviewed-by: Richard Levitte <levitte@openssl.org> | 18 March 2016, 12:13:11 UTC |
| 04d5242 | Matt Caswell | 15 March 2016, 11:51:48 UTC | Add a check for a failed malloc Ensure we check for a NULL return from OPENSSL_malloc Issue reported by Guido Vranken. Reviewed-by: Richard Levitte <levitte@openssl.org> | 18 March 2016, 11:56:34 UTC |
| 3b93479 | Matt Caswell | 15 March 2016, 11:38:56 UTC | Ensure that memory allocated for the ticket is freed If a call to EVP_DecryptUpdate fails then a memory leak could occur. Ensure that the memory is freed appropriately. Issue reported by Guido Vranken. Reviewed-by: Richard Levitte <levitte@openssl.org> | 18 March 2016, 11:56:34 UTC |
| e78dc7e | Matt Caswell | 14 March 2016, 17:06:19 UTC | Fix a potential double free in EVP_DigestInit_ex There is a potential double free in EVP_DigestInit_ex. This is believed to be reached only as a result of programmer error - but we should fix it anyway. Issue reported by Guido Vranken. Reviewed-by: Richard Levitte <levitte@openssl.org> (cherry picked from commit ffe9150b1508a0ffc9e724f975691f24eb045c05) | 18 March 2016, 11:42:19 UTC |
| 4256957 | Kurt Roeckx | 09 March 2016, 17:10:52 UTC | Add no-ssl2-method Reviewed-by: Viktor Dukhovni <viktor@openssl.org> MR: #2341 | 14 March 2016, 20:13:59 UTC |
| e76f485 | Richard Levitte | 09 March 2016, 10:36:32 UTC | Touch the correct variables for the system; shlib_wrap.sh on Solaris If there is cause to think LD_LIBRARY_PATH_32 and LD_PRELOAD_32 are appropriate variables to touch, do so. Otherwise, touch the usual LD_LIBRARY_PATH and LD_PRELOAD. This covers for older installations that don't have a mix of 32-bit and 64-bit libs. Reviewed-by: Andy Polyakov <appro@openssl.org> (cherry picked from commit a772e9d01a81dae132cb03107292b3ecc725e5af) | 09 March 2016, 11:21:01 UTC |
| d3b3715 | Richard Levitte | 06 March 2016, 21:36:57 UTC | Recognise 32-bit Solaris in util/shlib_wrap.sh Submitted by Erik Forsberg <erik@efca.com> Reviewed-by: Andy Polyakov <appro@openssl.org> (cherry picked from commit 86e75432835ec3ef7700a7103f9847e3c3d4350d) | 09 March 2016, 11:20:53 UTC |
| fcedd2d | Viktor Dukhovni | 08 March 2016, 20:33:02 UTC | expose SSLv2 method prototypes Reviewed-by: Kurt Roeckx <kurt@openssl.org> | 09 March 2016, 08:14:24 UTC |
| 1331385 | Viktor Dukhovni | 07 March 2016, 21:10:38 UTC | Retain SSLv2 methods as functions that return NULL This improves ABI compatibility when symbol resolution is not lazy. Reviewed-by: Richard Levitte <levitte@openssl.org> | 08 March 2016, 14:07:23 UTC |
| 29cce50 | Kurt Roeckx | 10 January 2016, 12:23:43 UTC | Remove LOW from the default Reviewed-by: Viktor Dukhovni <viktor@openssl.org> | 07 March 2016, 17:54:57 UTC |
| 01c32b5 | Dr. Stephen Henson | 04 March 2016, 18:04:46 UTC | Don't shift serial number into sign bit Reviewed-by: Rich Salz <rsalz@openssl.org> | 07 March 2016, 15:14:18 UTC |
| bd34ecb | Andy Polyakov | 04 March 2016, 10:39:11 UTC | bn/asm/x86[_64]-mont*.pl: complement alloca with page-walking. Some OSes, *cough*-dows, insist on stack being "wired" to physical memory in strictly sequential manner, i.e. if stack allocation spans two pages, then reference to farmost one can be punishable by SEGV. But page walking can do good even on other OSes, because it guarantees that villain thread hits the guard page before it can make damage to innocent one... Reviewed-by: Rich Salz <rsalz@openssl.org> (cherry picked from commit adc4f1fc25b2cac90076f1e1695b05b7aeeae501) | 07 March 2016, 14:03:26 UTC |
| ba26fa1 | Andy Polyakov | 04 March 2016, 10:32:26 UTC | perlasm/x86_64-xlate.pl: handle binary constants early. Not all assemblers of "gas" flavour handle binary constants, e.g. seasoned MacOS Xcode doesn't, so give them a hand. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Viktor Dukhovni <viktor@openssl.org> (cherry picked from commit 6e42e3ff9cde43830555549fdafa2a8b37b9485b) | 07 March 2016, 14:03:04 UTC |
| df14e50 | Dr. Stephen Henson | 03 March 2016, 23:37:36 UTC | Sanity check PVK file fields. PVK files with abnormally large length or salt fields can cause an integer overflow which can result in an OOB read and heap corruption. However this is an rarely used format and private key files do not normally come from untrusted sources the security implications not significant. Fix by limiting PVK length field to 100K and salt to 10K: these should be more than enough to cover any files encountered in practice. Issue reported by Guido Vranken. Reviewed-by: Rich Salz <rsalz@openssl.org> (cherry picked from commit 5f57abe2b150139b8b057313d52b1fe8f126c952) | 04 March 2016, 01:25:58 UTC |
| dd85182 | Eric S. Raymond | 29 February 2016, 19:54:47 UTC | RT4358: Extra ] in doc/ocsp.pod Reviewed-by: Richard Levitte <levitte@openssl.org> | 01 March 2016, 16:51:05 UTC |
| a500691 | Matt Caswell | 01 March 2016, 13:37:56 UTC | Prepare for 1.0.2h-dev Reviewed-by: Richard Levitte <levitte@openssl.org> | 01 March 2016, 13:37:56 UTC |
| 902f3f5 | Matt Caswell | 01 March 2016, 13:36:54 UTC | Prepare for 1.0.2g release Reviewed-by: Richard Levitte <levitte@openssl.org> | 01 March 2016, 13:36:54 UTC |
| 45e53cf | Matt Caswell | 01 March 2016, 13:36:54 UTC | make update Reviewed-by: Richard Levitte <levitte@openssl.org> | 01 March 2016, 13:36:54 UTC |
| 08d0ff5 | Matt Caswell | 01 March 2016, 12:08:33 UTC | Ensure mk1mf.pl is aware of no-weak-ssl-ciphers option Update mk1mf.pl to properly handle no-weak-ssl-ciphers Reviewed-by: Richard Levitte <levitte@openssl.org> | 01 March 2016, 12:41:49 UTC |
| 248808c | Matt Caswell | 01 March 2016, 11:00:48 UTC | Update CHANGES and NEWS for new release Reviewed-by: Richard Levitte <levitte@openssl.org> | 01 March 2016, 11:48:43 UTC |
| 515f3be | Andy Polyakov | 26 January 2016, 15:50:10 UTC | bn/asm/x86_64-mont5.pl: unify gather procedure in hardly used path and reorganize/harmonize post-conditions. Additional hardening following on from CVE-2016-0702 Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (cherry picked from master) | 01 March 2016, 11:21:43 UTC |
| 25d14c6 | Andy Polyakov | 25 January 2016, 22:41:01 UTC | crypto/bn/x86_64-mont5.pl: constant-time gather procedure. At the same time remove miniscule bias in final subtraction. Performance penalty varies from platform to platform, and even with key length. For rsa2048 sign it was observed to be 4% for Sandy Bridge and 7% on Broadwell. CVE-2016-0702 Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (cherry picked from master) | 01 March 2016, 11:21:29 UTC |
| 08ea966 | Andy Polyakov | 25 January 2016, 22:25:40 UTC | bn/asm/rsaz-avx2.pl: constant-time gather procedure. Performance penalty is 2%. CVE-2016-0702 Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (cherry picked from master) | 01 March 2016, 11:21:22 UTC |
| ef98503 | Andy Polyakov | 25 January 2016, 22:06:45 UTC | bn/asm/rsax-x86_64.pl: constant-time gather procedure. Performance penalty is 2% on Linux and 5% on Windows. CVE-2016-0702 Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (cherry picked from master) | 01 March 2016, 11:21:15 UTC |
| 708dc2f | Andy Polyakov | 25 January 2016, 19:38:38 UTC | bn/bn_exp.c: constant-time MOD_EXP_CTIME_COPY_FROM_PREBUF. Performance penalty varies from platform to platform, and even key length. For rsa2048 sign it was observed to reach almost 10%. CVE-2016-0702 Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (cherry picked from master) Resolved conflicts: crypto/bn/bn_exp.c | 01 March 2016, 11:20:41 UTC |
| bc38a7d | Viktor Dukhovni | 19 February 2016, 18:05:11 UTC | Disable EXPORT and LOW SSLv3+ ciphers by default Reviewed-by: Emilia Käsper <emilia@openssl.org> | 01 March 2016, 11:20:35 UTC |
| 1b1d8ae | Matt Caswell | 19 February 2016, 11:38:25 UTC | Add a test for SSLv2 configuration SSLv2 should be off by default. You can only turn it on if you have called SSL_CTX_clear_options(SSL_OP_NO_SSLv2) or SSL_clear_options(SSL_OP_NO_SSLv2). You should not be able to inadvertantly turn it on again via SSL_CONF without having done that first. Reviewed-by: Emilia Käsper <emilia@openssl.org> | 01 March 2016, 11:20:35 UTC |
| 021fb42 | Viktor Dukhovni | 18 February 2016, 04:38:55 UTC | Bring SSL method documentation up to date Reviewed-by: Emilia Käsper <emilia@openssl.org> | 01 March 2016, 11:20:35 UTC |
| 9dfd2be | Viktor Dukhovni | 18 February 2016, 02:07:48 UTC | Disable SSLv2 default build, default negotiation and weak ciphers. SSLv2 is by default disabled at build-time. Builds that are not configured with "enable-ssl2" will not support SSLv2. Even if "enable-ssl2" is used, users who want to negotiate SSLv2 via the version-flexible SSLv23_method() will need to explicitly call either of: SSL_CTX_clear_options(ctx, SSL_OP_NO_SSLv2); or SSL_clear_options(ssl, SSL_OP_NO_SSLv2); as appropriate. Even if either of those is used, or the application explicitly uses the version-specific SSLv2_method() or its client or server variants, SSLv2 ciphers vulnerable to exhaustive search key recovery have been removed. Specifically, the SSLv2 40-bit EXPORT ciphers, and SSLv2 56-bit DES are no longer available. Mitigation for CVE-2016-0800 Reviewed-by: Emilia Käsper <emilia@openssl.org> | 01 March 2016, 11:20:10 UTC |
| c175308 | Matt Caswell | 22 February 2016, 10:27:18 UTC | Fix BN_hex2bn/BN_dec2bn NULL ptr/heap corruption In the BN_hex2bn function the number of hex digits is calculated using an int value |i|. Later |bn_expand| is called with a value of |i * 4|. For large values of |i| this can result in |bn_expand| not allocating any memory because |i * 4| is negative. This leaves ret->d as NULL leading to a subsequent NULL ptr deref. For very large values of |i|, the calculation |i * 4| could be a positive value smaller than |i|. In this case memory is allocated to ret->d, but it is insufficiently sized leading to heap corruption. A similar issue exists in BN_dec2bn. This could have security consequences if BN_hex2bn/BN_dec2bn is ever called by user applications with very large untrusted hex/dec data. This is anticipated to be a rare occurrence. All OpenSSL internal usage of this function uses data that is not expected to be untrusted, e.g. config file data or application command line arguments. If user developed applications generate config file data based on untrusted data then it is possible that this could also lead to security consequences. This is also anticipated to be a rare. Issue reported by Guido Vranken. CVE-2016-0797 Reviewed-by: Andy Polyakov <appro@openssl.org> | 29 February 2016, 16:34:18 UTC |
| 29305f4 | Kurt Roeckx | 28 February 2016, 10:40:12 UTC | Fix invalid free Also removes an extra initializer, the master branch has a extra field. Reviewed-by: Rich Salz <rsalz@openssl.org> | 28 February 2016, 12:59:57 UTC |
| 7bcdf4e | FdaSilvaYY | 29 January 2016, 18:53:28 UTC | Fix two possible leaks Backport of 98637bd Reviewed-by: Kurt Roeckx <kurt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> | 27 February 2016, 22:05:32 UTC |
| e9cf5f0 | FdaSilvaYY | 29 January 2016, 18:49:38 UTC | Fix possible memory leak on BUF_MEM_grow_clean failure backport of 3eb70c5ebae6f2b5fd6034ed5af14910c8479688 shorter changes Reviewed-by: Kurt Roeckx <kurt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> | 27 February 2016, 22:05:32 UTC |
| a3762a9 | Andy Polyakov | 24 February 2016, 19:07:06 UTC | modes/asm/ghash-x86_64.pl: refine GNU assembler version detection. Even though AVX support was added in GAS 2.19 vpclmulqdq was apparently added in 2.20. Reviewed-by: Rich Salz <rsalz@openssl.org> (cherry picked from commit d3cdab17362b9ab0f1a0525b736c862937a9cd2f) | 27 February 2016, 20:35:34 UTC |
| 5361af8 | Kurt Roeckx | 20 February 2016, 14:29:45 UTC | Revert "Don't check RSA_FLAG_SIGN_VER." This reverts commit 6656ba7152dfe4bba865e327dd362ea08544aa80. This broke existing engines that didn't properly implement the sign and verify functions. Reviewed-by: Richard Levitte <levitte@openssl.org> MR: #2077 | 27 February 2016, 12:12:02 UTC |
| 578b956 | Matt Caswell | 25 February 2016, 13:09:46 UTC | Fix memory issues in BIO_*printf functions The internal |fmtstr| function used in processing a "%s" format string in the BIO_*printf functions could overflow while calculating the length of a string and cause an OOB read when printing very long strings. Additionally the internal |doapr_outch| function can attempt to write to an OOB memory location (at an offset from the NULL pointer) in the event of a memory allocation failure. In 1.0.2 and below this could be caused where the size of a buffer to be allocated is greater than INT_MAX. E.g. this could be in processing a very long "%s" format string. Memory leaks can also occur. These issues will only occur on certain platforms where sizeof(size_t) > sizeof(int). E.g. many 64 bit systems. The first issue may mask the second issue dependent on compiler behaviour. These problems could enable attacks where large amounts of untrusted data is passed to the BIO_*printf functions. If applications use these functions in this way then they could be vulnerable. OpenSSL itself uses these functions when printing out human-readable dumps of ASN.1 data. Therefore applications that print this data could be vulnerable if the data is from untrusted sources. OpenSSL command line applications could also be vulnerable where they print out ASN.1 data, or if untrusted data is passed as command line arguments. Libssl is not considered directly vulnerable. Additionally certificates etc received via remote connections via libssl are also unlikely to be able to trigger these issues because of message size limits enforced within libssl. CVE-2016-0799 Issue reported by Guido Vranken. Reviewed-by: Andy Polyakov <appro@openssl.org> | 25 February 2016, 22:47:13 UTC |
| 259b664 | Emilia Kasper | 24 February 2016, 11:59:59 UTC | CVE-2016-0798: avoid memory leak in SRP The SRP user database lookup method SRP_VBASE_get_by_user had confusing memory management semantics; the returned pointer was sometimes newly allocated, and sometimes owned by the callee. The calling code has no way of distinguishing these two cases. Specifically, SRP servers that configure a secret seed to hide valid login information are vulnerable to a memory leak: an attacker connecting with an invalid username can cause a memory leak of around 300 bytes per connection. Servers that do not configure SRP, or configure SRP but do not configure a seed are not vulnerable. In Apache, the seed directive is known as SSLSRPUnknownUserSeed. To mitigate the memory leak, the seed handling in SRP_VBASE_get_by_user is now disabled even if the user has configured a seed. Applications are advised to migrate to SRP_VBASE_get1_by_user. However, note that OpenSSL makes no strong guarantees about the indistinguishability of valid and invalid logins. In particular, computations are currently not carried out in constant time. Reviewed-by: Rich Salz <rsalz@openssl.org> | 24 February 2016, 17:39:13 UTC |
| 6433300 | Andy Polyakov | 03 February 2016, 10:26:11 UTC | ec/asm/ecp_nistz256-x86_64.pl: get corner case logic right. RT#4284 Reviewed-by: Rich Salz <rsalz@openssl.org> (cherry picked from commit d93753412b455907b4dc09427ccd2382209d9af2) | 23 February 2016, 20:26:53 UTC |
| 04f2a0b | FdaSilvaYY | 19 February 2016, 22:28:52 UTC | GH714: missing field initialisation Signed-off-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Kurt Roeckx <kurt@openssl.org> | 23 February 2016, 18:21:07 UTC |
| c436c99 | David Woodhouse | 23 February 2016, 14:00:03 UTC | RT4175: Fix PKCS7_verify() regression with Authenticode signatures This is a partial revert of commit c8491de39 ("GH354: Memory leak fixes"), which was cherry-picked from commit 55500ea7c in OpenSSL 1.1. That commit introduced a change in behaviour which is a regression for software implementing Microsoft Authenticode — which requires a PKCS#7 signature to be validated against explicit external data, even though it's a non-detached signature with its own embedded data. The is fixed differently in OpenSSL 1.1 by commit 6b2ebe433 ("Add PKCS7_NO_DUAL_CONTENT flag"), but that approach isn't viable in the 1.0.2 stable branch, so just comment the offending check back out again. Signed-off-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> | 23 February 2016, 15:16:15 UTC |
| f78baa9 | Corinna Vinschen | 16 January 2016, 18:36:15 UTC | Don't strip object files on Cygwin Building for the Cygwin distro requires to be able to build debuginfo files. This in turn requires to build object files without stripping. The stripping is performed by the next step after building which creates the debuginfo files. Signed-off-by: Corinna Vinschen <vinschen@redhat.com> (cherry picked from commit 42b8f1427a8cdf320e51374a5fbfefc74bec0519) Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> | 22 February 2016, 21:14:00 UTC |
| 5c57fbb | Richard Levitte | 22 February 2016, 10:02:03 UTC | Recognise Cygwin-x86_64 in config In response to RT#4326 Reviewed-by: Rich Salz <rsalz@openssl.org> | 22 February 2016, 14:44:10 UTC |
| 6c88c71 | Dr. Stephen Henson | 18 February 2016, 12:47:23 UTC | Fix double free in DSA private key parsing. Fix double free bug when parsing malformed DSA private keys. Thanks to Adam Langley (Google/BoringSSL) for discovering this bug using libFuzzer. CVE-2016-0705 Reviewed-by: Emilia Käsper <emilia@openssl.org> | 19 February 2016, 14:03:07 UTC |
| c575cef | Andy Polyakov | 19 February 2016, 12:40:58 UTC | Makefile.shared: limit .dll image base pinning to FIPS builds. Reviewed-by: Richard Levitte <levitte@openssl.org> | 19 February 2016, 12:40:58 UTC |
| b393a4a | Andy Polyakov | 18 February 2016, 13:08:55 UTC | evp/e_des3.c: address compiler warning. In backporting from master one modification was mistreated. RT#4210 Reviewed-by: Matt Caswell <matt@openssl.org> | 19 February 2016, 12:34:42 UTC |
| 43be582 | Dr. Stephen Henson | 18 February 2016, 02:49:14 UTC | typo Reviewed-by: Rich Salz <rsalz@openssl.org> (cherry picked from commit f6fb7f1856d443185c23f1a5968c08b4269dd37d) | 18 February 2016, 14:00:23 UTC |
| 866b282 | Dr. Stephen Henson | 16 February 2016, 22:17:43 UTC | Switch to FIPS implementation for CMAC. Reviewed-by: Tim Hudson <tjh@openssl.org> | 16 February 2016, 22:52:59 UTC |
| 24e6a0d | Andy Polyakov | 12 February 2016, 13:46:02 UTC | evp/e_des[3].c: address compiler warnings, fix formatting. RT#4210 (1.0.2-specific adaptation of 7687f5255011a5a3ca75e8c5427683d58ae411c0) Reviewed-by: Richard Levitte <levitte@openssl.org> | 13 February 2016, 09:46:26 UTC |
| 6533a0b | Andy Polyakov | 12 February 2016, 13:07:27 UTC | modes/ctr128.c: pay attention to ecount_buf alignment in CRYPTO_ctr128_encrypt. It's never problem if CRYPTO_ctr128_encrypt is called from EVP, because buffer in question is always aligned within EVP_CIPHER_CTX structure. RT#4218 Reviewed-by: Richard Levitte <levitte@openssl.org> (cherry picked from commit 5e4bbeb49fb6522d858703201b5adee9611e7b7b) | 12 February 2016, 21:00:13 UTC |
| b4b23d0 | Emilia Kasper | 02 February 2016, 16:12:45 UTC | RT 3854: Update apps/req Change the default keysize to 2048 bits, and the minimum to 512 bits. Reviewed-by: Rich Salz <rsalz@openssl.org> (cherry picked from commit a76265574398944d686d2d0de9bacca162f555ca) | 12 February 2016, 13:17:57 UTC |
| 10c639a | Andy Polyakov | 10 February 2016, 14:11:40 UTC | perlasm/x86_64-xlate.pl: pass pure constants verbatim. RT#3885 Reviewed-by: Rich Salz <rsalz@openssl.org> (cherry picked from commit fd7dc201d3b9d43972de6a0e659f7ef6421c99cc) | 11 February 2016, 20:26:44 UTC |
| 0fffd52 | Andy Polyakov | 03 February 2016, 17:21:00 UTC | util/mk1mf.pl: use LINK_CMD instead of LINK variable. Trouble is that LINK variable assignment in make-file interferes with LINK environment variable, which can be used to modify Microsoft's LINK.EXE behaviour. RT#4289 Reviewed-by: Richard Levitte <levitte@openssl.org> (cherry picked from commit d44bb1c31ca00f4359090daa15659c0dd1a08f0d) Resolved conflicts: util/pl/VC-32.pl | 11 February 2016, 20:25:24 UTC |
| 5246447 | Andy Polyakov | 09 February 2016, 10:53:11 UTC | ms/uplink-x86.pl: make it work. Reviewed-by: Richard Levitte <levitte@openssl.org> (cherry picked from commit 740b2b9a6cf31b02916a4d18f868e8a95934c083) | 10 February 2016, 11:55:11 UTC |
| 64193c8 | Matt Caswell | 02 February 2016, 10:05:43 UTC | Handle SSL_shutdown while in init more appropriately #2 Previous commit f73c737c7 attempted to "fix" a problem with the way SSL_shutdown() behaved whilst in mid-handshake. The original behaviour had SSL_shutdown() return immediately having taken no action if called mid- handshake with a return value of 1 (meaning everything was shutdown successfully). In fact the shutdown has not been successful. Commit f73c737c7 changed that to send a close_notify anyway and then return. This seems to be causing some problems for some applications so perhaps a better (much simpler) approach is revert to the previous behaviour (no attempt at a shutdown), but return -1 (meaning the shutdown was not successful). This also fixes a bug where SSL_shutdown always returns 0 when shutdown *very* early in the handshake (i.e. we are still using SSLv23_method). Reviewed-by: Viktor Dukhovni <viktor@openssl.org> | 08 February 2016, 09:30:57 UTC |
| 402fb18 | Dr. Stephen Henson | 06 February 2016, 17:07:58 UTC | if no comparison function set make sk_sort no op Reviewed-by: Rich Salz <rsalz@openssl.org> (cherry picked from commit 0ca2e82ab1575f9c4eed259c4d66ca9372a45bf5) | 06 February 2016, 18:49:56 UTC |
| a3baa17 | Viktor Dukhovni | 02 February 2016, 09:35:27 UTC | Fix missing ok=0 with locally blacklisted CAs Also in X509_verify_cert() avoid using "i" not only as a loop counter, but also as a trust outcome and as an error ordinal. Finally, make sure that all "goto end" jumps return an error, with "end" renamed to "err" accordingly. [ The 1.1.0 version of X509_verify_cert() is major rewrite, which addresses these issues in a more systemic way. ] Reviewed-by: Rich Salz <rsalz@openssl.org> | 05 February 2016, 15:54:11 UTC |
| 093d20a | Kurt Roeckx | 03 February 2016, 17:54:02 UTC | Restore xmm7 from the correct address on win64 Reviewed-by: Richard Levitte <levitte@openssl.org> RT: #4288, MR: #1831 (cherry picked from commit df057ea6c8a20e4babc047689507dfafde59ffd6) | 04 February 2016, 14:42:50 UTC |
| 5df0bde | Viktor Dukhovni | 02 February 2016, 04:37:42 UTC | Fix pkeyutl/rsautl empty encrypt-input/decrypt-output handling Also fix option processing in pkeyutl to allow use of (formerly) "out-of-order" switches that were needless implementation limitations. RT2018 Reviewed-by: Rich Salz <rsalz@openssl.org> | 02 February 2016, 17:41:33 UTC |
| a2bab12 | Rich Salz | 02 February 2016, 17:16:10 UTC | GH611: s_client help message bug Reviewed-by: Emilia Käsper <emilia@openssl.org> | 02 February 2016, 17:16:10 UTC |
| 106dbca | Hubert Kario | 01 February 2016, 16:14:34 UTC | GH554: Improve pkeyutl doc Signed-off-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Dr. Stephen Henson <steve@openssl.org> (cherry picked from commit 53619f9f40740ae8b256998574758aa191635db8) | 01 February 2016, 16:45:00 UTC |
| a38a159 | Daniel Kahn Gillmor | 31 January 2016, 01:38:08 UTC | RT4129: BUF_new_mem_buf should take const void * Signed-off-by: Rich Salz <rsalz@akamai.com> Reviewed-by: Dr. Stephen Henson <steve@openssl.org> (cherry picked from commit 8ab31975bacb9c907261088937d3aa4102e3af84) | 01 February 2016, 13:43:27 UTC |
| e0fde61 | Rich Salz | 29 January 2016, 17:09:05 UTC | GH102: Add volatile to CRYPTO_memcmp Can't hurt and seems to prevent problems from some over-aggressive (LTO?) compilers. Reviewed-by: Richard Levitte <levitte@openssl.org> (cherry picked from commit 98ab57644f44d2d83595c2d0f69138a284d6096b) | 30 January 2016, 19:41:23 UTC |
| 2454acc | Dr. Stephen Henson | 21 January 2016, 14:29:16 UTC | Backport SHA2 support for capi engine Reviewed-by: Andy Polyakov <appro@openssl.org> | 29 January 2016, 13:35:49 UTC |
| 1e9446b | Matt Caswell | 04 November 2015, 22:54:29 UTC | Add have_precompute_mult tests Add tests for have_precompute_mult for the optimised curves (nistp224, nistp256 and nistp521) if present Reviewed-by: Richard Levitte <levitte@openssl.org> (cherry picked from commit 8ce4e7e605577cb5818de068e2c6da60901cddba) | 29 January 2016, 13:07:12 UTC |
| e94f52e | Matt Caswell | 04 November 2015, 17:30:22 UTC | Fix bug in nistp224/256/521 where have_precompute_mult always returns 0 During precomputation if the group given is well known then we memcpy a well known precomputation. However we go the wrong label in the code and don't store the data properly. Consequently if we call have_precompute_mult the data isn't there and we return 0. RT#3600 Reviewed-by: Richard Levitte <levitte@openssl.org> (cherry picked from commit 615614c8862fb89dcf1551a4e113be0789dddf5f) | 29 January 2016, 13:07:10 UTC |
| 83ab6e5 | Matt Caswell | 29 January 2016, 09:40:03 UTC | Add missing return value checks The function DH_check_pub_key() was missing some return value checks in some calls to BN functions. RT#4278 Reviewed-by: Andy Polyakov <appro@openssl.org> (cherry picked from commit f5a12207eccfd814bde68b880a96910dfa25f164) | 29 January 2016, 11:58:45 UTC |
| 7107798 | Matt Caswell | 29 January 2016, 09:38:06 UTC | Correct value of DH_CHECK_PUBKEY_INVALID A new return value for DH_check_pub_key was recently added: DH_CHECK_PUBKEY_INVALID. As this is a flag which can be ORed with other return values it should have been set to the value 4 not 3. RT#4278 Reviewed-by: Andy Polyakov <appro@openssl.org> (cherry picked from commit cb389fe80462e20daba30835a9e86354451bd14f) | 29 January 2016, 11:58:45 UTC |
| 2b0c11a | Kurt Roeckx | 27 January 2016, 19:31:57 UTC | Fix CHANGES entry about DSA_generate_parameters_ex Reviewed-by: Viktor Dukhovni <openssl-users@dukhovni.org> | 28 January 2016, 18:55:46 UTC |
| da7947e | Richard Levitte | 28 January 2016, 16:55:11 UTC | Correct number of arguments in BIO_get_conn_int_port macro Reviewed-by: Rich Salz <rsalz@openssl.org> (cherry picked from commit 41a28cb2944a4e1c9d13889757a3bd9f72abeca1) | 28 January 2016, 17:20:55 UTC |
| 22d192f | Matt Caswell | 28 January 2016, 13:58:24 UTC | Prepare for 1.0.2g-dev Reviewed-by: Richard Levitte <levitte@openssl.org> | 28 January 2016, 13:58:24 UTC |
| 95605f3 | Matt Caswell | 28 January 2016, 13:57:22 UTC | Prepare for 1.0.2f release Reviewed-by: Richard Levitte <levitte@openssl.org> | 28 January 2016, 13:57:22 UTC |
