8000 Import OpenSSL 3.0.14 · python/cpython-source-deps@0467ebc · GitHub
[go: up one dir, main page]
Skip to content

Commit 0467ebc

Browse files
zoobazooba
committed
Import OpenSSL 3.0.14
1 parent a5c15eb commit 0467ebc
  • ossl_provider_new.pod
  • ossl_random_add_conf_module.pod
  • man7
  • man1
  • man3
  • man7
  • e_os.h
  • engines
  • fuzz
  • include
  • os-dep/Apple
  • providers
  • ssl
  • test

    • Some content is hidden

    Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

    130 files changed

    +2301
    -770
    lines changed

    ‎CHANGES.md

    Lines changed: 69 additions & 0 deletions
    Original file line numberDiff line numberDiff line change
    @@ -28,6 +28,72 @@ breaking changes, and mappings for the large list of deprecated functions.
    2828

    2929
    [Migration guide]: https://github.com/openssl/openssl/tree/master/doc/man7/migration_guide.pod
    3030

    31+
    ### Changes between 3.0.13 and 3.0.14 [4 Jun 2024]
    32+
    33+
    * Fixed potential use after free after SSL_free_buffers() is called.
    34+
    35+
    The SSL_free_buffers function is used to free the internal OpenSSL
    36+
    buffer used when processing an incoming record from the network.
    37+
    The call is only expected to succeed if the buffer is not currently
    38+
    in use. However, two scenarios have been identified where the buffer
    39+
    is freed even when still in use.
    40+
    41+
    The first scenario occurs where a record header has been received
    42+
    from the network and processed by OpenSSL, but the full record body
    43+
    has not yet arrived. In this case calling SSL_free_buffers will succeed
    44+
    even though a record has only been partially processed and the buffer
    45+
    is still in use.
    46+
    47+
    The second scenario occurs where a full record containing application
    48+
    data has been received and processed by OpenSSL but the application has
    49+
    only read part of this data. Again a call to SSL_free_buffers will
    50+
    succeed even though the buffer is still in use.
    51+
    52+
    ([CVE-2024-4741])
    53+
    54+
    *Matt Caswell*
    55+
    56+
    * Fixed an issue where checking excessively long DSA keys or parameters may
    57+
    be very slow.
    58+
    59+
    Applications that use the functions EVP_PKEY_param_check() or
    60+
    EVP_PKEY_public_check() to check a DSA public key or DSA parameters may
    61+
    experience long delays. Where the key or parameters that are being checked
    62+
    have been obtained from an untrusted source this may lead to a Denial of
    63+
    Service.
    64+
    65+
    To resolve this issue DSA keys larger than OPENSSL_DSA_MAX_MODULUS_BITS
    66+
    will now fail the check immediately with a DSA_R_MODULUS_TOO_LARGE error
    67+
    reason.
    68+
    69+
    ([CVE-2024-4603])
    70+
    71+
    *Tomáš Mráz*
    72+
    73+
    * Fixed an issue where some non-default TLS server configurations can cause
    74+
    unbounded memory growth when processing TLSv1.3 sessions. An attacker may
    75+
    exploit certain server configurations to trigger unbounded memory growth that
    76+
    would lead to a Denial of Service
    77+
    78+
    This problem can occur in TLSv1.3 if the non-default SSL_OP_NO_TICKET option
    79+
    is being used (but not if early_data is also configured and the default
    80+
    anti-replay protection is in use). In this case, under certain conditions,
    81+
    the session cache can get into an incorrect state and it will fail to flush
    82+
    properly as it fills. The session cache will continue to grow in an unbounded
    83+
    manner. A malicious client could deliberately create the scenario for this
    84+
    failure to force a Denial of Service. It may also happen by accident in
    85+
    normal operation.
    86+
    87+
    ([CVE-2024-2511])
    88+
    89+
    *Matt Caswell*
    90+
    91+
    * New atexit configuration switch, which controls whether the OPENSSL_cleanup
    92+
    is registered when libcrypto is unloaded. This can be used on platforms
    93+
    where using atexit() from shared libraries causes crashes on exit.
    94+
    95+
    *Randall S. Becker*
    96+
    3197
    ### Changes between 3.0.12 and 3.0.13 [30 Jan 2024]
    3298

    3399
    * A file in PKCS12 format can contain certificates and keys and may come from
    @@ -19824,6 +19890,9 @@ ndif
    1982419890

    1982519891
    <!-- Links -->
    1982619892

    19893+
    [CVE-2024-4741]: https://www.openssl.org/news/vulnerabilities.html#CVE-2024-4741
    19894+
    [CVE-2024-4603]: https://www.openssl.org/news/vulnerabilities.html#CVE-2024-4603
    19895+
    [CVE-2024-2511]: https://www.openssl.org/news/vulnerabilities.html#CVE-2024-2511
    1982719896
    [CVE-2024-0727]: https://www.openssl.org/news/vulnerabilities.html#CVE-2024-0727
    1982819897
    [CVE-2023-6237]: https://www.openssl.org/news/vulnerabilities.html#CVE-2023-6237
    1982919898
    [CVE-2023-6129]: https://www.openssl.org/news/vulnerabilities.html#CVE-2023-6129

    ‎CONTRIBUTING.md

    Lines changed: 4 additions & 2 deletions
    Original file line numberDiff line numberDiff line change
    @@ -9,7 +9,7 @@ Development is done on GitHub in the [openssl/openssl] repository.
    99

    1010
    [openssl/openssl]: <https://github.com/openssl/openssl>
    1111

    12-
    To request new a feature, ask a question, or report a bug,
    12+
    To request a new feature, ask a question, or report a bug,
    1313
    please open an [issue on GitHub](https://github.com/openssl/openssl/issues).
    1414

    1515
    To submit a patch or implement a new feature, please open a
    @@ -67,7 +67,8 @@ guidelines:
    6767
    often. We do not accept merge commits, you will have to remove them
    6868
    (usually by rebasing) before it will be acceptable.
    6969
    70-
    4. Code provided should follow our [coding style] and compile without warnings.
    70+
    4. Code provided should follow our [coding style] and [documentation policy]
    71+
    and compile without warnings.
    7172
    There is a [Perl tool](util/check-format.pl) that helps
    7273
    finding code formatting mistakes and other coding style nits.
    7374
    Where `gcc` or `clang` is available, you should use the
    @@ -77,6 +78,7 @@ guidelines:
    7778
    whenever a PR is created or updated by committers.
    7879
    7980
    [coding style]: https://www.openssl.org/policies/technical/coding-style.html
    81+
    [documentation policy]: https://openssl.org/policies/technical/documentation-policy.html
    8082
    8183
    5. When at all possible, code contributions should include tests. These can
    8284
    either be added to an existing test, or completely new. Please see

    ‎Configurations/10-main.conf

    Lines changed: 8 additions & 1 deletion
    Original file line numberDiff line numberDiff line change
    @@ -784,7 +784,14 @@ my %targets = (
    784784
    asm_arch => 'aarch64',
    785785
    perlasm_scheme => "linux64",
    786786
    },
    787-
    787+
    "linux-arm64ilp32-clang" => { # clang config abi by --target
    788+
    inherit_from => [ "linux-generic32" ],
    789+
    CC => "clang",
    790+
    CXX => "clang++",
    791+
    bn_ops => "SIXTY_FOUR_BIT RC4_CHAR",
    792+
    asm_arch => 'aarch64',
    793+
    perlasm_scheme => "linux64",
    794+
    },
    788795
    "linux-mips32" => {
    789796
    # Configure script adds minimally required -march for assembly
    790797
    # support, if no -march was specified at command line.

    ‎Configurations/15-ios.conf

    Lines changed: 3 additions & 3 deletions
    Original file line numberDiff line numberDiff line change
    @@ -49,16 +49,16 @@ my %targets = (
    4949
    #
    5050
    "iphoneos-cross" => {
    5151
    inherit_from => [ "ios-common" ],
    52-
    cflags => add("-isysroot \$(CROSS_TOP)/SDKs/\$(CROSS_SDK) -fno-common"),
    52+
    cflags => add("-isysroot \"\$(CROSS_TOP)/SDKs/\$(CROSS_SDK)\" -fno-common"),
    5353
    },
    5454
    "ios-cross" => {
    5555
    inherit_from => [ "ios-xcrun" ],
    5656
    CC => "cc",
    57-
    cflags => add("-isysroot \$(CROSS_TOP)/SDKs/\$(CROSS_SDK)"),
    57+
    cflags => add("-isysroot \"\$(CROSS_TOP)/SDKs/\$(CROSS_SDK)\""),
    5858
    },
    5959
    "ios64-cross" => {
    6060
    inherit_from => [ "ios64-xcrun" ],
    6161
    CC => "cc",
    62-
    cflags => add("-isysroot \$(CROSS_TOP)/SDKs/\$(CROSS_SDK)"),
    62+
    cflags => add("-isysroot \"\$(CROSS_TOP)/SDKs/\$(CROSS_SDK)\""),
    6363
    },
    6464
    );

    ‎Configurations/unix-Makefile.tmpl

    Lines changed: 7 additions & 7 deletions
    Original file line numberDiff line numberDiff line change
    @@ -21,7 +21,7 @@
    2121
    sub dependmagic {
    2222
    my $target = shift;
    2323

    24-
    return "$target: build_generated\n\t\$(MAKE) depend && \$(MAKE) _$target\n_$target";
    24+
    return "$target: build_generated\n\t\"\$(MAKE)\" depend && \"\$(MAKE)\" _$target\n_$target";
    2525
    }
    2626

    2727
    our $COLUMNS = $ENV{COLUMNS};
    @@ -527,7 +527,7 @@ all: build_sw build_docs
    527527

    528528
    test: tests
    529529
    {- dependmagic('tests'); -}: build_programs_nodep build_modules_nodep link-utils
    530-
    $(MAKE) run_tests
    530+
    "$(MAKE)" run_tests
    531531
    run_tests: FORCE
    532532
    @ : {- output_off() if $disabled{tests}; "" -}
    533533
    ( SRCTOP=$(SRCDIR) \
    @@ -542,7 +542,7 @@ run_tests: FORCE
    542542

    543543
    list-tests:
    544544
    @ : {- output_off() if $disabled{tests}; "" -}
    545-
    $(MAKE) run_tests TESTS=list
    545+
    "$(MAKE)" run_tests TESTS=list
    546546
    @ : {- if ($disabled{tests}) { output_on(); } else { output_off(); } "" -}
    547547
    @echo "Tests are not supported with your chosen Configure options"
    548548
    @ : {- output_on() if !$disabled{tests}; "" -}
    @@ -1193,12 +1193,12 @@ providers/fips.module.sources.new: configdata.pm
    11931193
    cd sources-tmp \
    11941194
    && $$srcdir/Configure --banner=Configured enable-fips -O0 \
    11951195
    && ./configdata.pm --query 'get_sources("providers/fips")' > sources1 \
    1196-
    && $(MAKE) -sj 4 build_generated providers/fips.so \
    1196+
    && "$(MAKE)" -sj 4 build_generated providers/fips.so \
    11971197
    && find . -name '*.d' | xargs cat > dep1 \
    1198-
    && $(MAKE) distclean \
    1198+
    && "$(MAKE)" distclean \
    11991199
    && $$srcdir/Configure --banner=Configured enable-fips no-asm -O0 \
    12001200
    && ./configdata.pm --query 'get_sources("providers/fips")' > sources2 \
    1201-
    && $(MAKE) -sj 4 build_generated providers/fips.so \
    1201+
    && "$(MAKE)" -sj 4 build_generated providers/fips.so \
    12021202
    && find . -name '*.d' | xargs cat > dep2 \
    12031203
    && cat sources1 sources2 \
    12041204
    | grep -v ' : \\$$' | grep -v util/providers.num \
    @@ -1332,7 +1332,7 @@ ordinals: build_generated
    13321332
    $(SSLHEADERS)
    13331333

    13341334
    test_ordinals:
    1335-
    $(MAKE) run_tests TESTS=test_ordinals
    1335+
    "$(MAKE)" run_tests TESTS=test_ordinals
    13361336

    13371337
    tags TAGS: FORCE
    13381338
    rm -f TAGS tags

    ‎Configure

    Lines changed: 2 additions & 1 deletion
    Original file line numberDiff line numberDiff line change
    @@ -1,6 +1,6 @@
    11
    #! /usr/bin/env perl
    22
    # -*- mode: perl; -*-
    3-
    # Copyright 2016-2023 The OpenSSL Project Authors. All Rights Reserved.
    3+
    # Copyright 2016-2024 The OpenSSL Project Authors. All Rights Reserved.
    44
    #
    55
    # Licensed under the Apache License 2.0 (the "License"). You may not use
    66
    # this file except in compliance with the License. You can obtain a copy
    @@ -405,6 +405,7 @@ my @disablables = (
    405405
    "asan",
    406406
    "asm",
    407407
    "async",
    408+
    "atexit",
    408409
    "autoalginit",
    409410
    "autoerrinit",
    410411
    "autoload-config",

    ‎FAQ.md

    Lines changed: 0 additions & 6 deletions
    This file was deleted.

    ‎INSTALL.md

    Lines changed: 8 additions & 1 deletion
    Original file line numberDiff line numberDiff line change
    @@ -480,7 +480,7 @@ Setting the FIPS HMAC key
    480480

    481481
    As part of its self-test validation, the FIPS module must verify itself
    482482
    by performing a SHA-256 HMAC computation on itself. The default key is
    483-
    the SHA256 value of "the holy handgrenade of antioch" and is sufficient
    483+
    the SHA256 value of "holy hand grenade of antioch" and is sufficient
    484484
    for meeting the FIPS requirements.
    485485

    486486
    To change the key to a different value, use this flag. The value should
    @@ -546,6 +546,13 @@ be used even with this option.
    546546

    547547
    Do not build support for async operations.
    548548

    549+
    ### no-atexit
    550+
    551+
    Do not use `atexit()` in libcrypto builds.
    552+
    553+
    `atexit()` has varied semantics between platforms and can cause SIGSEGV in some
    554+
    circumstances. This option disables the atexit registration of OPENSSL_cleanup.
    555+
    549556
    ### no-autoalginit
    550557

    551558
    Don't automatically load all supported ciphers and digests.

    ‎NEWS.md

    Lines changed: 15 additions & 0 deletions
    Original file line numberDiff line numberDiff line change
    @@ -18,6 +18,18 @@ OpenSSL Releases
    1818
    OpenSSL 3.0
    1919
    -----------
    2020

    21+
    ### Major changes between OpenSSL 3.0.13 and OpenSSL 3.0.14 [4 Jun 2024]
    22+
    23+
    * Fixed potential use after free after SSL_free_buffers() is called
    24+
    ([CVE-2024-4741])
    25+
    26+
    * Fixed an issue where checking excessively long DSA keys or parameters may
    27+
    be very slow
    28+
    ([CVE-2024-4603])
    29+
    30+
    * Fixed unbounded memory growth with session handling in TLSv1.3
    31+
    ([CVE-2024-2511])
    32+
    2133
    ### Major changes between OpenSSL 3.0.12 and OpenSSL 3.0.13 [30 Jan 2024]
    2234

    2335
    * Fixed PKCS12 Decoding crashes
    @@ -1470,6 +1482,9 @@ OpenSSL 0.9.x
    14701482

    14711483
    <!-- Links -->
    14721484

    1485+
    [CVE-2024-4741]: https://www.openssl.org/news/vulnerabilities.html#CVE-2024-4741
    1486+
    [CVE-2024-4603]: https://www.openssl.org/news/vulnerabilities.html#CVE-2024-4603
    1487+
    [CVE-2024-2511]: https://www.openssl.org/news/vulnerabilities.html#CVE-2024-2511
    14731488
    [CVE-2024-0727]: https://www.openssl.org/news/vulnerabilities.html#CVE-2024-0727
    14741489
    [CVE-2023-6237]: https://www.openssl.org/news/vulnerabilities.html#CVE-2023-6237
    14751490
    [CVE-2023-6129]: https://www.openssl.org/news/vulnerabilities.html#CVE-2023-6129

    ‎NOTES-NONSTOP.md

    Lines changed: 4 additions & 1 deletion
    Original file line numberDiff line numberDiff line change
    @@ -56,7 +56,10 @@ relating to `atexit()` processing when a shared library is unloaded and when
    5656
    the program terminates. This limitation applies to all OpenSSL shared library
    5757
    components.
    5858

    59-
    A resolution to this situation is under investigation.
    59+
    It is possible to configure the build with `no-atexit` to avoid the SIGSEGV.
    60+
    Preferably, you can explicitly call `OPENSSL_cleanup()` from your application.
    61+
    It is not mandatory as it just deallocates various global data structures
    62+
    OpenSSL allocated.
    6063

    6164
    About Prefix and OpenSSLDir
    6265
    ---------------------------

    ‎VERSION.dat

    Lines changed: 2 additions & 2 deletions
    Original file line numberDiff line numberDiff line change
    @@ -1,7 +1,7 @@
    11
    MAJOR=3
    22
    MINOR=0
    3-
    PATCH=13
    3+
    PATCH=14
    44
    PRE_RELEASE_TAG=
    55
    BUILD_METADATA=
    6-
    RELEASE_DATE="30 Jan 2024"
    6+
    RELEASE_DATE="4 Jun 2024"
    77
    SHLIB_VERSION=3

    ‎apps/lib/s_cb.c

    Lines changed: 5 additions & 3 deletions
    Original file line numberDiff line numberDiff line change
    @@ -1,5 +1,5 @@
    11
    /*
    2-
    * Copyright 1995-2022 The OpenSSL Project Authors. All Rights Reserved.
    2+
    * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
    33
    *
    44
    * Licensed under the Apache License 2.0 (the "License"). You may not use
    55
    * this file except in compliance with the License. You can obtain a copy
    @@ -1318,7 +1318,8 @@ int ssl_load_stores(SSL_CTX *ctx,
    13181318
    if (vfyCAstore != NULL && !X509_STORE_load_store(vfy, vfyCAstore))
    13191319
    goto err;
    13201320
    add_crls_store(vfy, crls);
    1321-
    SSL_CTX_set1_verify_cert_store(ctx, vfy);
    1321+
    if (SSL_CTX_set1_verify_cert_store(ctx, vfy) == 0)
    1322+
    goto err;
    13221323
    if (crl_download)
    13231324
    store_setup_crl_download(vfy);
    13241325
    }
    @@ -1332,7 +1333,8 @@ int ssl_load_stores(SSL_CTX *ctx,
    13321333
    goto err;
    13331334
    if (chCAstore != NULL && !X509_STORE_load_store(ch, chCAstore))
    13341335
    goto err;
    1335-
    SSL_CTX_set1_chain_cert_store(ctx, ch);
    1336+
    if (SSL_CTX_set1_chain_cert_store(ctx, ch) == 0)
    1337+
    goto err;
    13361338
    }
    13371339
    rv = 1;
    13381340
    err:

    ‎apps/list.c

    Lines changed: 2 additions & 1 deletion
    Original file line numberDiff line numberDiff line change
    @@ -1,5 +1,5 @@
    11
    /*
    2-
    * Copyright 1995-2022 The OpenSSL Project Authors. All Rights Reserved.
    2+
    * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
    33
    *
    44
    * Licensed under the Apache License 2.0 (the "License"). You may not use
    55
    * this file except in compliance with the License. You can obtain a copy
    @@ -1230,6 +1230,7 @@ static void list_provider_info(void)
    12301230
    }
    12311231

    12321232
    if (OSSL_PROVIDER_do_all(NULL, &collect_providers, providers) != 1) {
    1233+
    sk_OSSL_PROVIDER_free(providers);
    12331234
    BIO_printf(bio_err, "ERROR: Memory allocation\n");
    12341235
    return;
    12351236
    }

    ‎apps/ocsp.c

    Lines changed: 2 additions & 2 deletions
    Original file line numberDiff line numberDiff line change
    @@ -1,5 +1,5 @@
    11
    /*
    2-
    * Copyright 2001-2022 The OpenSSL Project Authors. All Rights Reserved.
    2+
    * Copyright 2001-2024 The OpenSSL Project Authors. All Rights Reserved.
    33
    *
    44
    * Licensed under the Apache License 2.0 (the "License"). You may not use
    55
    * this file except in compliance with the License. You can obtain a copy
    @@ -11,7 +11,7 @@
    1111

    1212
    #ifdef OPENSSL_SYS_VMS
    1313
    /* So fd_set and friends get properly defined on OpenVMS */
    14-
    # define _XOPEN_SOURCE_EXTENDED
    14+
    # define _XOPEN_SOURCE_EXTENDED 1
    1515
    #endif
    1616

    1717
    #include <stdio.h>

    ‎apps/pkcs12.c

    Lines changed: 11 additions & 5 deletions
    Original file line numberDiff line numberDiff line change
    @@ -1,5 +1,5 @@
    11
    /*
    2-
    * Copyright 1999-2022 The OpenSSL Project Authors. All Rights Reserved.
    2+
    * Copyright 1999-2024 The OpenSSL Project Authors. All Rights Reserved.
    33
    *
    44
    * Licensed under the Apache License 2.0 (the "License"). You may not use
    55
    * this file except in compliance with the License. You can obtain a copy
    @@ -712,9 +712,6 @@ int pkcs12_main(int argc, char **argv)
    712712
    in = bio_open_default(infile, 'r', FORMAT_PKCS12);
    713713
    if (in == NULL)
    714714
    goto end;
    715-
    out = bio_open_owner(outfile, FORMAT_PEM, private);
    716-
    if (out == NULL)
    717-
    goto end;
    718715

    719716
    p12 = PKCS12_init_ex(NID_pkcs7_data, app_get0_libctx(), app_get0_propq());
    720717
    if (p12 == NULL) {
    @@ -814,6 +811,11 @@ int pkcs12_main(int argc, char **argv)
    814811

    815812
    dump:
    816813
    assert(private);
    814+
    815+
    out = bio_open_owner(outfile, FORMAT_PEM, private);
    816+
    if (out == NULL)
    817+
    goto end;
    818+
    817819
    if (!dump_certs_keys_p12(out, p12, cpass, -1, options, passout, enc)) {
    818820
    BIO_printf(bio_err, "Error outputting keys and certificates\n");
    819821
    ERR_print_errors(bio_err);
    @@ -855,7 +857,11 @@ int dump_certs_keys_p12(BIO *out, const PKCS12 *p12, const char *pass,
    855857
    } else if (bagnid == NID_pkcs7_encrypted) {
    856858
    if (options & INFO) {
    857859
    BIO_printf(bio_err, "PKCS7 Encrypted data: ");
    858-
    alg_print(p7->d.encrypted->enc_data->algorithm);
    860+
    if (p7->d.encrypted == NULL) {
    861+
    BIO_printf(bio_err, "<no data>\n");
    862+
    } else {
    863+
    alg_print(p7->d.encrypted->enc_data->algorithm);
    864+
    }
    859865
    }
    860866
    bags = PKCS12_unpack_p7encdata(p7, pass, passlen);
    861867
    } else {

    0 commit comments

    Comments
     (0)
    0