8000 Import OpenSSL 3.0.15 · python/cpython-source-deps@3f89d7d · GitHub
[go: up one dir, main page]
Skip to content

Commit 3f89d7d

Browse files
zoobazooba
committed
Import OpenSSL 3.0.15
1 parent 0467ebc commit 3f89d7d

File tree

176 files changed

+2454
-832
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

176 files changed

+2454
-832
lines changed

‎CHANGES.md

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,30 @@ breaking changes, and mappings for the large list of deprecated functions.
2828

2929
[Migration guide]: https://github.com/openssl/openssl/tree/master/doc/man7/migration_guide.pod
3030

31+
### Changes between 3.0.14 and 3.0.15 [3 Sep 2024]
32+
33+
* Fixed possible denial of service in X.509 name checks.
34+
35+
Applications performing certificate name checks (e.g., TLS clients checking
36+
server certificates) may attempt to read an invalid memory address when
37+
comparing the expected name with an `otherName` subject alternative name of
38+
an X.509 certificate. This may result in an exception that terminates the
39+
application program.
40+
41+
([CVE-2024-6119])
42+
43+
*Viktor Dukhovni*
44+
45+
* Fixed possible buffer overread in SSL_select_next_proto().
46+
47+
Calling the OpenSSL API function SSL_select_next_proto with an empty
48+
supported client protocols buffer may cause a crash or memory contents
49+
to be sent to the peer.
50+
51+
([CVE-2024-5535])
52+
53+
*Matt Caswell*
54+
3155
### Changes between 3.0.13 and 3.0.14 [4 Jun 2024]
3256

3357
* Fixed potential use after free after SSL_free_buffers() is called.
@@ -70,6 +94,14 @@ breaking changes, and mappings for the large list of deprecated functions.
7094

7195
*Tomáš Mráz*
7296

97+
* Improved EC/DSA nonce generation routines to avoid bias and timing
98+
side channel leaks.
99+
100+
Thanks to Florian Sieck from Universität zu Lübeck and George Pantelakis
101+
and Hubert Kario from Red Hat for reporting the issues.
102+
103+
*Tomáš Mráz and Paul Dale*
104+
73105
* Fixed an issue where some non-default TLS server configurations can cause
74106
unbounded memory growth when processing TLSv1.3 sessions. An attacker may
75107
exploit certain server configurations to trigger unbounded memory growth that
@@ -19890,6 +19922,8 @@ ndif
1989019922

1989119923
<!-- Links -->
1989219924

19925+
[CVE-2024-6119]: https://www.openssl.org/news/vulnerabilities.html#CVE-2024-6119
19926+
[CVE-2024-5535]: https://www.openssl.org/news/vulnerabilities.html#CVE-2024-5535
1989319927
[CVE-2024-4741]: https://www.openssl.org/news/vulnerabilities.html#CVE-2024-4741
1989419928
[CVE-2024-4603]: https://www.openssl.org/news/vulnerabilities.html#CVE-2024-4603
1989519929
[CVE-2024-2511]: https://www.openssl.org/news/vulnerabilities.html#CVE-2024-2511

‎CONTRIBUTING.md

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ HOW TO CONTRIBUTE TO OpenSSL
33

44
Please visit our [Getting Started] page for other ideas about how to contribute.
55

6-
[Getting Started]: <https://www.openssl.org/community/getting-started.html>
6+
[Getting Started]: <https://openssl-library.org/community/getting-started>
77

88
Development is done on GitHub in the [openssl/openssl] repository.
99

@@ -77,8 +77,8 @@ guidelines:
7777
Clean builds via GitHub Actions are required. They are started automatically
7878
whenever a PR is created or updated by committers.
7979
80-
[coding style]: https://www.openssl.org/policies/technical/coding-style.html
81-
[documentation policy]: https://openssl.org/policies/technical/documentation-policy.html
80+
[coding style]: https://openssl-library.org/policies/technical/coding-style/
81+
[documentation policy]: https://openssl-library.org/policies/technical/documentation-policy/
8282
8383
5. When at all possible, code contributions should include tests. These can
8484
either be added to an existing test, or completely new. Please see

‎Configurations/10-main.conf

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1264,6 +1264,25 @@ my %targets = (
12641264
AR => add("-X32"),
12651265
RANLIB => add("-X32"),
12661266
},
1267+
# To enable openxl compiler for aix
1268+
# If 17.1 openxl runtime is available, -latomic can be used
1269+
# instead of -DBROKEN_CLANG_ATOMICS
1270+
"aix-clang" => {
1271+
inherit_from => [ "aix-common" ],
1272+
CC => "ibm-clang",
1273+
CFLAGS => picker(debug => "-O0 -g",
1274+
release => "-O"),
1275+
cflags => combine("-Wno-implicit-function-declaration -mcmodel=large -DBROKEN_CLANG_ATOMICS",
1276+
threads("-pthread")),
1277+
ex_libs => add(threads("-pthread")),
1278+
bn_ops => "BN_LLONG RC4_CHAR",
1279+
asm_arch => 'ppc32',
1280+
perlasm_scheme => "aix32",
1281+
shared_cflag => "-fpic",
1282+
shared_ldflag => add("-shared"),
1283+
AR => add("-X32"),
1284+
RANLIB => add("-X32"),
1285+
},
12671286
"aix64-cc" => {
12681287
inherit_from => [ "aix-common" ],
12691288
CC => "cc",
@@ -1282,6 +1301,23 @@ my %targets = (
12821301
AR => add("-X64"),
12831302
RANLIB => add("-X64"),
12841303
},
1304+
"aix64-clang" => {
1305+
inherit_from => [ "aix-common" ],
1306+
CC => "ibm-clang",
1307+
CFLAGS => picker(debug => "-O0 -g",
1308+
release => "-O"),
1309+
cflags => combine("-maix64 -Wno-implicit-function-declaration -mcmodel=large",
1310+
threads("-pthread")),
1311+
ex_libs => add(threads("-pthread")),
1312+
bn_ops => "SIXTY_FOUR_BIT_LONG RC4_CHAR",
1313+
asm_arch => 'ppc64',
1314+
perlasm_scheme => "aix64",
1315+
shared_cflag => "-fpic",
1316+
shared_ldflag => add("-shared"),
1317+
shared_extension => "64.so.\$(SHLIB_VERSION_NUMBER)",
1318+
AR => add("-X64"),
1319+
RANLIB => add("-X64"),
1320+
},
12851321

12861322
# SIEMENS BS2000/OSD: an EBCDIC-based mainframe
12871323
"BS2000-OSD" => {

‎Configurations/15-ios.conf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ my %targets = (
1010
template => 1,
1111
inherit_from => [ "darwin-common" ],
1212
sys_id => "iOS",
13-
disable => [ "shared", "async" ],
13+
disable => [ "async" ],
1414
},
1515
"ios-xcrun" => {
1616
inherit_from => [ "ios-common" ],

‎Configure

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -178,7 +178,6 @@ my @gcc_devteam_warn = qw(
178178
# -Wextended-offsetof -- no, needed in CMS ASN1 code
179179
my @clang_devteam_warn = qw(
180180
-Wno-unknown-warning-option
181-
-Wswitch-default
182181
-Wno-parentheses-equality
183182
-Wno-language-extension-token
184183
-Wno-extended-offsetof
@@ -1583,7 +1582,7 @@ if (!$disabled{makedepend}) {
15831582
disable('unavailable', 'makedepend') unless $config{makedep_scheme};
15841583
}
15851584

1586-
if (!$disabled{asm} && !$predefined_C{__MACH__} && $^O ne 'VMS') {
1585+
if (!$disabled{asm} && !$predefined_C{__MACH__} && $^O ne 'VMS' && !$predefined_C{_AIX}) {
15871586
# probe for -Wa,--noexecstack option...
15881587
if ($predefined_C{__clang__}) {
15891588
# clang has builtin assembler, which doesn't recognize --help,
@@ -3407,6 +3406,13 @@ sub absolutedir {
34073406
return rel2abs($dir);
34083407
}
34093408

3409+
# realpath() on Windows seems to check if the directory actually exists,
3410+
# which isn't what is wanted here. All we want to know is if a directory
3411+
# spec is absolute, not if it exists.
3412+
if ($^O eq "MSWin32") {
3413+
return rel2abs($dir);
3414+
}
3415+
34103416
# We use realpath() on Unix, since no other will properly clean out
34113417
# a directory spec.
34123418
use Cwd qw/realpath/;

‎INSTALL.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1164,7 +1164,7 @@ Configure OpenSSL
11641164
### Automatic Configuration
11651165

11661166
In previous version, the `config` script determined the platform type and
1167-
compiler and then called `Configure`. Starting with this release, they are
1167+
compiler and then called `Configure`. Starting with version 3.0, they are
11681168
the same.
11691169

11701170
#### Unix / Linux / macOS
@@ -1618,7 +1618,7 @@ More about our support resources can be found in the [SUPPORT] file.
16181618

16191619
### Configuration Errors
16201620

1621-
If the `./Configure` or `./Configure` command fails with an error message,
1621+
If the `./config` or `./Configure` command fails with an error message,
16221622
read the error message carefully and try to figure out whether you made
16231623
a mistake (e.g., by providing a wrong option), or whether the script is
16241624
working incorrectly. If you think you encountered a bug, please

‎NEWS.md

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,19 @@ OpenSSL Releases
1818
OpenSSL 3.0
1919
-----------
2020

21+
### Major changes between OpenSSL 3.0.14 and OpenSSL 3.0.15 [3 Sep 2024]
22+
23+
OpenSSL 3.0.15 is a security patch release. The most severe CVE fixed in this
24+
release is Moderate.
25+
26+
This release incorporates the following bug fixes and mitigations:
27+
28+
* Fixed possible denial of service in X.509 name checks
29+
([CVE-2024-6119])
30+
31+
* Fixed possible buffer overread in SSL_select_next_proto()
32+
([CVE-2024-5535])
33+
2134
### Major changes between OpenSSL 3.0.13 and OpenSSL 3.0.14 [4 Jun 2024]
2235

2336
* Fixed potential use after free after SSL_free_buffers() is called
@@ -1482,6 +1495,8 @@ OpenSSL 0.9.x
14821495

14831496
<!-- Links -->
14841497

1498+
[CVE-2024-6119]: https://www.openssl.org/news/vulnerabilities.html#CVE-2024-6119
1499+
[CVE-2024-5535]: https://www.openssl.org/news/vulnerabilities.html#CVE-2024-5535
14851500
[CVE-2024-4741]: https://www.openssl.org/news/vulnerabilities.html#CVE-2024-4741
14861501
[CVE-2024-4603]: https://www.openssl.org/news/vulnerabilities.html#CVE-2024-4603
14871502
[CVE-2024-2511]: https://www.openssl.org/news/vulnerabilities.html#CVE-2024-2511

‎VERSION.dat

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
MAJOR=3
22
MINOR=0
3-
PATCH=14
3+
PATCH=15
44
PRE_RELEASE_TAG=
55
BUILD_METADATA=
6-
RELEASE_DATE="4 Jun 2024"
6+
RELEASE_DATE="3 Sep 2024"
77
SHLIB_VERSION=3

‎apps/cms.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2008-2023 The OpenSSL Project Authors. All Rights Reserved.
2+
* Copyright 2008-2024 The OpenSSL Project Authors. All Rights Reserved.
33
*
44
* Licensed under the Apache License 2.0 (the "License"). You may not use
55
* this file except in compliance with the License. You can obtain a copy
@@ -132,7 +132,7 @@ const OPTIONS cms_options[] = {
132132
{"binary", OPT_BINARY, '-',
133133
"Treat input as binary: do not translate to canonical form"},
134134
{"crlfeol", OPT_CRLFEOL, '-',
135-
"Use CRLF as EOL termination instead of CR only" },
135+
"Use CRLF as EOL termination instead of LF only" },
136136
{"asciicrlf", OPT_ASCIICRLF, '-',
137137
"Perform CRLF canonicalisation when signing"},
138138

‎apps/dgst.c

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 1995-2023 The OpenSSL Project Authors. All Rights Reserved.
2+
* Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
33
*
44
* Licensed under the Apache License 2.0 (the "License"). You may not use
55
* this file except in compliance with the License. You can obtain a copy
@@ -478,7 +478,7 @@ int dgst_main(int argc, char **argv)
478478
static void show_digests(const OBJ_NAME *name, void *arg)
479479
{
480480
struct doall_dgst_digests *dec = (struct doall_dgst_digests *)arg;
481-
const EVP_MD *md = NULL;
481+
EVP_MD *md = NULL;
482482

483483
/* Filter out signed digests (a.k.a signature algorithms) */
484484
if (strstr(name->name, "rsa") != NULL || strstr(name->name, "RSA") != NULL)
@@ -490,8 +490,7 @@ static void show_digests(const OBJ_NAME *name, void *arg)
490490
/* Filter out message digests that we cannot use */
491491
md = EVP_MD_fetch(app_get0_libctx(), name->name, app_get0_propq());
492492
if (md == NULL) {
493-
md = EVP_get_digestbyname(name 10000 ->name);
494-
if (md == NULL)
493+
if (EVP_get_digestbyname(name->name) == NULL)
495494
return;
496495
}
497496

@@ -502,6 +501,8 @@ static void show_digests(const OBJ_NAME *name, void *arg)
502501
} else {
503502
BIO_printf(dec->bio, " ");
504503
}
504+
505+
EVP_MD_free(md);
505506
}
506507

507508
/*

‎apps/lib/opt.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2015-2021 The OpenSSL Project Authors. All Rights Reserved.
2+
* Copyright 2015-2024 The OpenSSL Project Authors. All Rights Reserved.
33
*
44
* Licensed under the Apache License 2.0 (the "License"). You may not use
55
* this file except in compliance with the License. You can obtain a copy
@@ -616,7 +616,7 @@ int opt_uintmax(const char *value, ossl_uintmax_t *result)
616616
opt_number_error(value);
617617
return 0;
618618
}
619-
*result = (ossl_intmax_t)m;
619+
*result = (ossl_uintmax_t)m;
620620
errno = oerrno;
621621
return 1;
622622
}

‎apps/lib/s_cb.c

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -649,7 +649,7 @@ void msg_cb(int write_p, int version, int content_type, const void *buf,
649649
(void)BIO_flush(bio);
650650
}
651651

652-
static STRINT_PAIR tlsext_types[] = {
652+
static const STRINT_PAIR tlsext_types[] = {
653653
{"server name", TLSEXT_TYPE_server_name},
654654
{"max fragment length", TLSEXT_TYPE_max_fragment_length},
655655
{"client certificate URL", TLSEXT_TYPE_client_certificate_url},
@@ -688,6 +688,7 @@ static STRINT_PAIR tlsext_types[] = {
688688
{"psk kex modes", TLSEXT_TYPE_psk_kex_modes},
689689
{"certificate authorities", TLSEXT_TYPE_certificate_authorities},
690690
{"post handshake auth", TLSEXT_TYPE_post_handshake_auth},
691+
{"early_data", TLSEXT_TYPE_early_data},
691692
{NULL}
692693
};
693694

‎apps/smime.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 1999-2021 The OpenSSL Project Authors. All Rights Reserved.
2+
* Copyright 1999-2024 The OpenSSL Project Authors. All Rights Reserved.
33
*
44
* Licensed under the Apache License 2.0 (the "License"). You may not use
55
* this file except in compliance with the License. You can obtain a copy
@@ -118,7 +118,7 @@ const OPTIONS smime_options[] = {
118118
"Do not load certificates from the default certificates store"},
119119
{"nochain", OPT_NOCHAIN, '-',
120120
"set PKCS7_NOCHAIN so certificates contained in the message are not used as untrusted CAs" },
121-
{"crlfeol", OPT_CRLFEOL, '-', "Use CRLF as EOL termination instead of CR only"},
121+
{"crlfeol", OPT_CRLFEOL, '-', "Use CRLF as EOL termination instead of LF only"},
122122

123123
OPT_R_OPTIONS,
124124
OPT_V_OPTIONS,

0 commit comments

Comments
 (0)
0