Skip to content

Commit 88b6d1c

Browse files
monfreshmonfresh
committed
Update OpenSSL from 3.1.0 to 3.1.3
1 parent 2684a47 commit 88b6d1c

367 files changed

Lines changed: 8009 additions & 3822 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎vendor/openssl/CHANGES.md‎

Lines changed: 188 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,184 @@ OpenSSL Releases
2222
OpenSSL 3.1
2323
-----------
2424

25+
### Changes between 3.1.2 and 3.1.3 [19 Sep 2023]
26+
27+
* Fix POLY1305 MAC implementation corrupting XMM registers on Windows.
28+
29+
The POLY1305 MAC (message authentication code) implementation in OpenSSL
30+
does not save the contents of non-volatile XMM registers on Windows 64
31+
platform when calculating the MAC of data larger than 64 bytes. Before
32+
returning to the caller all the XMM registers are set to zero rather than
33+
restoring their previous content. The vulnerable code is used only on newer
34+
x86_64 processors supporting the AVX512-IFMA instructions.
35+
36+
The consequences of this kind of internal application state corruption can
37+
be various - from no consequences, if the calling application does not
38+
depend on the contents of non-volatile XMM registers at all, to the worst
39+
consequences, where the attacker could get complete control of the
40+
application process. However given the contents of the registers are just
41+
zeroized so the attacker cannot put arbitrary values inside, the most likely
42+
consequence, if any, would be an incorrect result of some application
43+
dependent calculations or a crash leading to a denial of service.
44+
45+
([CVE-2023-4807])
46+
47+
*Bernd Edlinger*
48+
49+
### Changes between 3.1.1 and 3.1.2 [1 Aug 2023]
50+
51+
* Fix excessive time spent checking DH q parameter value.
52+
53+
The function DH_check() performs various checks on DH parameters. After
54+
fixing CVE-2023-3446 it was discovered that a large q parameter value can
55+
also trigger an overly long computation during some of these checks.
56+
A correct q value, if present, cannot be larger than the modulus p
57+
parameter, thus it is unnecessary to perform these checks if q is larger
58+
than p.
59+
60+
If DH_check() is called with such q parameter value,
61+
DH_CHECK_INVALID_Q_VALUE return flag is set and the computationally
62+
intensive checks are skipped.
63+
64+
([CVE-2023-3817])
65+
66+
*Tomáš Mráz*
67+
68+
* Fix DH_check() excessive time with over sized modulus.
69+
70+
The function DH_check() performs various checks on DH parameters. One of
71+
those checks confirms that the modulus ("p" parameter) is not too large.
72+
Trying to use a very large modulus is slow and OpenSSL will not normally use
73+
a modulus which is over 10,000 bits in length.
74+
75+
However the DH_check() function checks numerous aspects of the key or
76+
parameters that have been supplied. Some of those checks use the supplied
77+
modulus value even if it has already been found to be too large.
78+
79+
A new limit has been added to DH_check of 32,768 bits. Supplying a
80+
key/parameters with a modulus over this size will simply cause DH_check() to
81+
fail.
82+
83+
([CVE-2023-3446])
84+
85+
*Matt Caswell*
86+
87+
* Do not ignore empty associated data entries with AES-SIV.
88+
89+
The AES-SIV algorithm allows for authentication of multiple associated
90+
data entries along with the encryption. To authenticate empty data the
91+
application has to call `EVP_EncryptUpdate()` (or `EVP_CipherUpdate()`)
92+
with NULL pointer as the output buffer and 0 as the input buffer length.
93+
The AES-SIV implementation in OpenSSL just returns success for such call
94+
instead of performing the associated data authentication operation.
95+
The empty data thus will not be authenticated. ([CVE-2023-2975])
96+
97+
Thanks to Juerg Wullschleger (Google) for discovering the issue.
98+
99+
The fix changes the authentication tag value and the ciphertext for
100+
applications that use empty associated data entries with AES-SIV.
101+
To decrypt data encrypted with previous versions of OpenSSL the application
102+
has to skip calls to `EVP_DecryptUpdate()` for empty associated data
103+
entries.
104+
105+
*Tomáš Mráz*
106+
107+
* When building with the `enable-fips` option and using the resulting
108+
FIPS provider, TLS 1.2 will, by default, mandate the use of an extended
109+
master secret (FIPS 140-3 IG G.Q) and the Hash and HMAC DRBGs will
110+
not operate with truncated digests (FIPS 140-3 IG G.R).
111+
112+
*Paul Dale*
113+
114+
### Changes between 3.1.0 and 3.1.1 [30 May 2023]
115+
116+
* Mitigate for the time it takes for `OBJ_obj2txt` to translate gigantic
117+
OBJECT IDENTIFIER sub-identifiers to canonical numeric text form.
118+
119+
OBJ_obj2txt() would translate any size OBJECT IDENTIFIER to canonical
120+
numeric text form. For gigantic sub-identifiers, this would take a very
121+
long time, the time complexity being O(n^2) where n is the size of that
122+
sub-identifier. ([CVE-2023-2650])
123+
124+
To mitigitate this, `OBJ_obj2txt()` will only translate an OBJECT
125+
IDENTIFIER to canonical numeric text form if the size of that OBJECT
126+
IDENTIFIER is 586 bytes or less, and fail otherwise.
127+
128+
The basis for this restriction is [RFC 2578 (STD 58), section 3.5]. OBJECT
129+
IDENTIFIER values, which stipulates that OBJECT IDENTIFIERS may have at
130+
most 128 sub-identifiers, and that the maximum value that each sub-
131+
identifier may have is 2^32-1 (4294967295 decimal).
132+
133+
For each byte of every sub-identifier, only the 7 lower bits are part of
134+
the value, so the maximum amount of bytes that an OBJECT IDENTIFIER with
135+
these restrictions may occupy is 32 * 128 / 7, which is approximately 586
136+
bytes.
137+
138+
*Richard Levitte*
139+
140+
* Multiple algorithm implementation fixes for ARM BE platforms.
141+
142+
*Liu-ErMeng*
143+
144+
* Added a -pedantic option to fipsinstall that adjusts the various
145+
settings to ensure strict FIPS compliance rather than backwards
146+
compatibility.
147+
148+
*Paul Dale*
149+
150+
* Fixed buffer overread in AES-XTS decryption on ARM 64 bit platforms which
151+
happens if the buffer size is 4 mod 5 in 16 byte AES blocks. This can
152+
trigger a crash of an application using AES-XTS decryption if the memory
153+
just after the buffer being decrypted is not mapped.
154+
Thanks to Anton Romanov (Amazon) for discovering the issue.
155+
([CVE-2023-1255])
156+
157+
*Nevine Ebeid*
158+
159+
* Reworked the Fix for the Timing Oracle in RSA Decryption ([CVE-2022-4304]).
160+
The previous fix for this timing side channel turned out to cause
161+
a severe 2-3x performance regression in the typical use case
162+
compared to 3.0.7. The new fix uses existing constant time
163+
code paths, and restores the previous performance level while
164+
fully eliminating all existing timing side channels.
165+
The fix was developed by Bernd Edlinger with testing support
166+
by Hubert Kario.
167+
168+
*Bernd Edlinger*
169+
170+
* Add FIPS provider configuration option to disallow the use of
171+
truncated digests with Hash and HMAC DRBGs (q.v. FIPS 140-3 IG D.R.).
172+
The option '-no_drbg_truncated_digests' can optionally be
173+
supplied to 'openssl fipsinstall'.
174+
175+
*Paul Dale*
176+
177+
* Corrected documentation of X509_VERIFY_PARAM_add0_policy() to mention
178+
that it does not enable policy checking. Thanks to David Benjamin for
179+
discovering this issue.
180+
([CVE-2023-0466])
181+
182+
*Tomáš Mráz*
183+
184+
* Fixed an issue where invalid certificate policies in leaf certificates are
185+
silently ignored by OpenSSL and other certificate policy checks are skipped
186+
for that certificate. A malicious CA could use this to deliberately assert
187+
invalid certificate policies in order to circumvent policy checking on the
188+
certificate altogether.
189+
([CVE-2023-0465])
190+
191+
*Matt Caswell*
192+
193+
* Limited the number of nodes created in a policy tree to mitigate
194+
against CVE-2023-0464. The default limit is set to 1000 nodes, which
195+
should be sufficient for most installations. If required, the limit
196+
can be adjusted by setting the OPENSSL_POLICY_TREE_NODES_MAX build
197+
time define to a desired maximum number of nodes or zero to allow
198+
unlimited growth.
199+
([CVE-2023-0464])
200+
201+
*Paul Dale*
202+
25203
### Changes between 3.0 and 3.1.0 [14 Mar 2023]
26204

27205
* Add FIPS provider configuration option to enforce the
@@ -19678,6 +19856,16 @@ ndif
1967819856

1967919857
<!-- Links -->
1968019858

19859+
[CVE-2023-4807]: https://www.openssl.org/news/vulnerabilities.html#CVE-2023-4807
19860+
[CVE-2023-3817]: https://www.openssl.org/news/vulnerabilities.html#CVE-2023-3817
19861+
[CVE-2023-3446]: https://www.openssl.org/news/vulnerabilities.html#CVE-2023-3446
19862+
[CVE-2023-2975]: https://www.openssl.org/news/vulnerabilities.html#CVE-2023-2975
19863+
[RFC 2578 (STD 58), section 3.5]: https://datatracker.ietf.org/doc/html/rfc2578#section-3.5
19864+
[CVE-2023-2650]: https://www.openssl.org/news/vulnerabilities.html#CVE-2023-2650
19865+
[CVE-2023-1255]: https://www.openssl.org/news/vulnerabilities.html#CVE-2023-1255
19866+
[CVE-2023-0466]: https://www.openssl.org/news/vulnerabilities.html#CVE-2023-0466
19867+
[CVE-2023-0465]: https://www.openssl.org/news/vulnerabilities.html#CVE-2023-0465
19868+
[CVE-2023-0464]: https://www.openssl.org/news/vulnerabilities.html#CVE-2023-0464
1968119869
[CVE-2023-0401]: https://www.openssl.org/news/vulnerabilities.html#CVE-2023-0401
1968219870
[CVE-2023-0286]: https://www.openssl.org/news/vulnerabilities.html#CVE-2023-0286
1968319871
[CVE-2023-0217]: https://www.openssl.org/news/vulnerabilities.html#CVE-2023-0217

‎vendor/openssl/Configurations/10-main.conf‎

Lines changed: 12 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -9,19 +9,22 @@ sub vc_win64a_info {
99
$vc_win64a_info = { AS => "nasm",
1010
ASFLAGS => "-g",
1111
asflags => "-Ox -f win64 -DNEAR",
12-
asoutflag => "-o " };
12+
asoutflag => "-o ",
13+
perlasm_scheme => "nasm" };
1314
} elsif ($disabled{asm}) {
1415
# assembler is still used to compile uplink shim
1516
$vc_win64a_info = { AS => "ml64",
1617
ASFLAGS => "/nologo /Zi",
1718
asflags => "/c /Cp /Cx",
18-
asoutflag => "/Fo" };
19+
asoutflag => "/Fo",
20+
perlasm_scheme => "masm" };
1921
} else {
2022
$die->("NASM not found - make sure it's installed and available on %PATH%\n");
2123
$vc_win64a_info = { AS => "{unknown}",
2224
ASFLAGS => "",
2325
asflags => "",
24-
asoutflag => "" };
26+
asoutflag => "",
27+
perlasm_scheme => "auto" };
2528
}
2629
}
2730
return $vc_win64a_info;
@@ -1493,7 +1496,7 @@ my %targets = (
14931496
sys_id => "WIN64A",
14941497
uplink_arch => 'x86_64',
14951498
asm_arch => 'x86_64',
1496-
perlasm_scheme => "auto",
1499+
perlasm_scheme => sub { vc_win64a_info()->{perlasm_scheme} },
14971500
multilib => "-x64",
14981501
},
14991502
"VC-WIN32" => {
@@ -2011,5 +2014,9 @@ my %targets = (
20112014
cflags => add("/POINTER_SIZE=64=ARGV"),
20122015
pointer_size => "64",
20132016
},
2014-
2017+
"vms-x86_64" => {
2018+
inherit_from => [ "vms-generic" ],
2019+
bn_ops => "SIXTY_FOUR_BIT",
2020+
pointer_size => "",
2021+
}
20152022
);

‎vendor/openssl/Configurations/50-vms-x86_64.conf‎

Lines changed: 3 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,16 +1,10 @@
11
## -*- mode: perl; -*-
22

3-
# OpenVMS for x86_64 is currently out on a field test. A native C compiler
4-
# is currently not available, but there are cross-compilation tools for
5-
# OpenVMS for Itanium. This configuration file holds the necessary target(s)
6-
# to make that useful.
7-
#
8-
# The assumption is that *building* is done on Itanium, and then the source
9-
# tree and build tree are transferred to x86_64, where tests can be performed,
10-
# and installation can be done.
3+
# OpenVMS cross compilation of x86_64 binaries on Itanium. This doesn't
4+
# fit the usual cross compilation parameters that are used on Unixly machines
115

126
(
13-
'vms-x86_64' => {
7+
'vms-x86_64-cross-ia64' => {
148
inherit_from => [ 'vms-generic' ],
159
CC => 'XCC',
1610
bn_ops => 'SIXTY_FOUR_BIT',

‎vendor/openssl/Configurations/README.md‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -233,8 +233,14 @@ In each table entry, the following keys are significant:
233233
is ILP32;
234234
RC4_CHAR RC4 key schedule is made
235235
up of 'unsigned char's;
236+
Note: should not be used
237+
for new configuration
238+
targets
236239
RC4_INT RC4 key schedule is made
237240
up of 'unsigned int's;
241+
Note: should not be used
242+
for new configuration
243+
targets
238244

239245
[1] as part of the target configuration, one can have a key called
240246
`inherit_from` that indicates what other configurations to inherit

‎vendor/openssl/Configurations/descrip.mms.tmpl‎

Lines changed: 3 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -125,7 +125,7 @@
125125
my @lib_cflags_no_inst = ( $target{no_inst_lib_cflags} // @lib_cflags );
126126
my @lib_cflags_cont = ( $target{shared_cflag} || (),
127127
@{$config{lib_cflags}}, @{$config{shared_cflag}},
128-
$cnf_cflags, '$(CFLAGS)');
128+
@cnf_cflags, '$(CFLAGS)');
129129
our $lib_cflags = join('', @lib_cflags, @lib_cflags_cont );
130130
our $lib_cflags_no_inst = join('', @lib_cflags_no_inst, @lib_cflags_cont );
131131
our $lib_ldflags =
@@ -161,7 +161,7 @@
161161
my @dso_cflags_no_inst = ( $target{no_inst_dso_cflags} // @dso_cflags );
162162
my @dso_cflags_cont = ( $target{module_cflag} || (),
163163
@{$config{dso_cflags}}, @{$config{module_cflag}},
164-
$cnf_cflags, '$(CFLAGS)');
164+
@cnf_cflags, '$(CFLAGS)');
165165
our $dso_cflags = join('', @dso_cflags, @dso_cflags_cont );
166166
our $dso_cflags_no_inst = join('', @dso_cflags_no_inst, @dso_cflags_cont );
167167
our $dso_ldflags =
@@ -196,13 +196,9 @@
196196
my @bin_cflags = ( $target{bin_cflags} // () );
197197
my @bin_cflags_no_inst = ( $target{no_inst_bin_cflags} // @bin_cflags );
198198
my @bin_cflags_cont = ( @{$config{bin_cflags}},
199-
$cnf_cflags, '$(CFLAGS)');
199+
@cnf_cflags, '$(CFLAGS)');
200200
our $bin_cflags = join('', @bin_cflags, @bin_cflags_cont );
201201
our $bin_cflags_no_inst = join('', @bin_cflags_no_inst, @bin_cflags_cont );
202-
our $bin_cflags =
203-
join('', $target{bin_cflags} || (),
204-
@{$config{bin_cflags}},
205-
@cnf_cflags, '$(CFLAGS)');
206202
our $bin_ldflags =
207203
join('', $target{bin_lflags} || (),
208204
@{$config{bin_lflags}},

‎vendor/openssl/Configurations/unix-Makefile.tmpl‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1227,7 +1227,8 @@ providers/fips.module.sources.new: configdata.pm
12271227
crypto/ec/asm/*.pl \
12281228
crypto/modes/asm/*.pl \
12291229
crypto/sha/asm/*.pl \
1230-
crypto/x86_64cpuid.pl; do \
1230+
crypto/*cpuid.pl crypto/*cpuid.S \
1231+
crypto/*cap.c; do \
12311232
echo "$$x"; \
12321233
done \
12331234
) | sort | uniq > providers/fips.module.sources.new

‎vendor/openssl/Configurations/windows-makefile.tmpl‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -765,7 +765,7 @@ EOF
765765
my $generator;
766766
if ($gen0 =~ /\.pl$/) {
767767
$generator = '"$(PERL)"'.$gen_incs.' "'.$gen0.'"'.$gen_args
768-
.' "$(PERLASM_SCHEME)"'.$incs.' '.$cppflags.$defs.' $(PROCESSSOR)';
768+
.' "$(PERLASM_SCHEME)"'.$incs.' '.$cppflags.$defs.' $(PROCESSOR)';
769769
} elsif ($gen0 =~ /\.S$/) {
770770
$generator = undef;
771771
} else {

‎vendor/openssl/Configure‎

Lines changed: 2 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -597,8 +597,7 @@ my @disable_cascades = (
597597

598598
"crypto-mdebug" => [ "crypto-mdebug-backtrace" ],
599599

600-
# If no modules, then no dynamic engines either
601-
"module" => [ "dynamic-engine" ],
600+
"module" => [ "dynamic-engine", "fips" ],
602601

603602
# Without shared libraries, dynamic engines aren't possible.
604603
# This is due to them having to link with libcrypto and register features
@@ -616,8 +615,6 @@ my @disable_cascades = (
616615
# or modules.
617616
"pic" => [ "shared", "module" ],
618617

619-
"module" => [ "fips", "dso" ],
620-
621618
"engine" => [ "dynamic-engine", grep(/eng$/, @disablables) ],
622619
"dynamic-engine" => [ "loadereng" ],
623620
"hw" => [ "padlockeng" ],
@@ -1423,7 +1420,7 @@ if ($target =~ /^mingw/ && `$config{CC} --target-help 2>&1` =~ m/-mno-cygwin/m)
14231420
}
14241421

14251422
if ($target =~ /linux.*-mips/ && !$disabled{asm}
1426-
&& !grep { $_ !~ /-m(ips|arch=)/ } (@{$config{CFLAGS}})) {
1423+
&& !grep { $_ =~ /-m(ips|arch=)/ } (@{$config{CFLAGS}})) {
14271424
# minimally required architecture flags for assembly modules
14281425
my $value;
14291426
$value = '-mips2' if ($target =~ /mips32/);

‎vendor/openssl/INSTALL.md‎

Lines changed: 13 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -797,14 +797,22 @@ By default OpenSSL will attempt to stay in memory until the process exits.
797797
This is so that libcrypto and libssl can be properly cleaned up automatically
798798
via an `atexit()` handler. The handler is registered by libcrypto and cleans
799799
up both libraries. On some platforms the `atexit()` handler will run on unload of
800-
libcrypto (if it has been dynamically loaded) rather than at process exit. This
801-
option can be used to stop OpenSSL from attempting to stay in memory until the
800+
libcrypto (if it has been dynamically loaded) rather than at process exit.
801+
802+
This option can be used to stop OpenSSL from attempting to stay in memory until the
802803
process exits. This could lead to crashes if either libcrypto or libssl have
803804
already been unloaded at the point that the atexit handler is invoked, e.g. on a
804805
platform which calls `atexit()` on unload of the library, and libssl is unloaded
805-
before libcrypto then a crash is likely to happen. Applications can suppress
806-
running of the `atexit()` handler at run time by using the
807-
`OPENSSL_INIT_NO_ATEXIT` option to `OPENSSL_init_crypto()`.
806+
before libcrypto then a crash is likely to happen.
807+
808+
Note that shared library pinning is not automatically disabled for static builds,
809+
i.e., `no-shared` does not imply `no-pinshared`. This may come as a surprise when
810+
linking libcrypto statically into a shared third-party library, because in this
811+
case the shared library will be pinned. To prevent this behaviour, you need to
812+
configure the static build using `no-shared` and `no-pinshared` together.
813+
814+
Applications can suppress running of the `atexit()` handler at run time by
815+
using the `OPENSSL_INIT_NO_ATEXIT` option to `OPENSSL_init_crypto()`.
808816
See the man page for it for further details.
809817

810818
### no-posix-io

0 commit comments

Comments
 (0)