8000 Import OpenSSL 3.0.16 · python/cpython-source-deps@bb01d0a · GitHub
[go: up one dir, main page]
Skip to content

Commit bb01d0a

Browse files
zoobazooba
committed
Import OpenSSL 3.0.16
1 parent 3f89d7d commit bb01d0a
  • openssl-verification-options.pod
  • openssl.pod
  • man3
  • man7
  • engines
  • include
  • providers
  • ssl/statem
  • test
  • util

    • Some content is hidden

    Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

    171 files changed

    +2546
    -1082
    lines changed

    ‎CHANGES.md‎

    Lines changed: 33 additions & 0 deletions
    Original file line numberDiff line numberDiff line change
    @@ -28,6 +28,37 @@ breaking changes, and mappings for the large list of deprecated functions.
    2828

    2929
    [Migration guide]: https://github.com/openssl/openssl/tree/master/doc/man7/migration_guide.pod
    3030

    31+
    ### Changes between 3.0.15 and 3.0.16 [11 Feb 2025]
    32+
    33+
    * Fixed timing side-channel in ECDSA signature computation.
    34+
    35+
    There is a timing signal of around 300 nanoseconds when the top word of
    36+
    the inverted ECDSA nonce value is zero. This can happen with significant
    37+
    probability only for some of the supported elliptic curves. In particular
    38+
    the NIST P-521 curve is affected. To be able to measure this leak, the
    39+
    attacker process must either be located in the same physical computer or
    40+
    must have a very fast network connection with low latency.< D306 /div>
    41+
    42+
    ([CVE-2024-13176])
    43+
    44+
    *Tomáš Mráz*
    45+
    46+
    * Fixed possible OOB memory access with invalid low-level GF(2^m) elliptic
    47+
    curve parameters.
    48+
    49+
    Use of the low-level GF(2^m) elliptic curve APIs with untrusted
    50+
    explicit values for the field polynomial can lead to out-of-bounds memory
    51+
    reads or writes.
    52+
    Applications working with "exotic" explicit binary (GF(2^m)) curve
    53+
    parameters, that make it possible to represent invalid field polynomials
    54+
    with a zero constant term, via the above or similar APIs, may terminate
    55+
    abruptly as a result of reading or writing outside of array bounds. Remote
    56+
    code execution cannot easily be ruled out.
    57+
    58+
    ([CVE-2024-9143])
    59+
    60+
    *Viktor Dukhovni*
    61+
    3162
    ### Changes between 3.0.14 and 3.0.15 [3 Sep 2024]
    3263

    3364
    * Fixed possible denial of service in X.509 name checks.
    @@ -19922,6 +19953,8 @@ ndif
    1992219953

    1992319954
    <!-- Links -->
    1992419955

    19956+
    [CVE-2024-13176]: https://www.openssl.org/news/vulnerabilities.html#CVE-2024-13176
    19957+
    [CVE-2024-9143]: https://www.openssl.org/news/vulnerabilities.html#CVE-2024-9143
    1992519958
    [CVE-2024-6119]: https://www.openssl.org/news/vulnerabilities.html#CVE-2024-6119
    1992619959
    [CVE-2024-5535]: https://www.openssl.org/news/vulnerabilities.html#CVE-2024-5535
    1992719960
    [CVE-2024-4741]: https://www.openssl.org/news/vulnerabilities.html#CVE-2024-4741

    ‎Configurations/unix-Makefile.tmpl‎

    Lines changed: 1 addition & 1 deletion
    < 38BA button class="Button Button--iconOnly Button--invisible" aria-label="More options" id=":R28pdlab:" aria-haspopup="true" aria-expanded="false" tabindex="0">
    Original file line numberDiff line numberDiff line change
    @@ -1688,7 +1688,7 @@ EOF
    16881688
    } elsif ($makedep_scheme eq 'gcc' && !grep /\.rc$/, @srcs) {
    16891689
    $recipe .= <<"EOF";
    16901690
    $obj: $deps
    1691-
    $cmd $incs $defs $cmdflags -MMD -MF $dep.tmp -MT \$\@ -c -o \$\@ $srcs
    1691+
    $cmd $incs $defs $cmdflags -MMD -MF $dep.tmp -c -o \$\@ $srcs
    16921692
    \@touch $dep.tmp
    16931693
    \@if cmp $dep.tmp $dep > /dev/null 2> /dev/null; then \\
    16941694
    rm -f $dep.tmp; \\

    ‎NEWS.md‎

    Lines changed: 16 additions & 0 deletions
    Original file line numberDiff line numberDiff line change
    @@ -18,6 +18,20 @@ OpenSSL Releases
    1818
    OpenSSL 3.0
    1919
    -----------
    2020

    21+
    ### Major changes between OpenSSL 3.0.15 and OpenSSL 3.0.16 [11 Feb 2025]
    22+
    23+
    OpenSSL 3.0.16 is a security patch release. The most severe CVE fixed in this
    24+
    release is Low.
    25+
    26+
    This release incorporates the following bug fixes and mitigations:
    27+
    28+
    * Fixed timing side-channel in ECDSA signature computation.
    29+
    ([CVE-2024-13176])
    30+
    31+
    * Fixed possible OOB memory access with invalid low-level GF(2^m) elliptic
    32+
    curve parameters.
    33+
    ([CVE-2024-9143])
    34+
    2135
    ### Major changes between OpenSSL 3.0.14 and OpenSSL 3.0.15 [3 Sep 2024]
    2236

    2337
    OpenSSL 3.0.15 is a security patch release. The most severe CVE fixed in this
    @@ -1495,6 +1509,8 @@ OpenSSL 0.9.x
    14951509

    14961510
    <!-- Links -->
    14971511

    1512+
    [CVE-2024-13176]: https://www.openssl.org/news/vulnerabilities.html#CVE-2024-13176
    1513+
    [CVE-2024-9143]: https://www.openssl.org/news/vulnerabilities.html#CVE-2024-9143
    14981514
    [CVE-2024-6119]: https://www.openssl.org/news/vulnerabilities.html#CVE-2024-6119
    14991515
    [CVE-2024-5535]: https://www.openssl.org/news/vulnerabilities.html#CVE-2024-5535
    15001516
    [CVE-2024-4741]: https://www.openssl.org/news/vulnerabilities.html#CVE-2024-4741

    ‎NOTES-NONSTOP.md‎

    Lines changed: 2 additions & 5 deletions
    Original file line numberDiff line numberDiff line change
    @@ -119,12 +119,9 @@ correctly, you also need the `COMP_ROOT` set, as in:
    119119

    120120
    `COMP_ROOT` needs to be in Windows form.
    121121

    122-
    `Configure` must specify the `no-makedepend` option otherwise errors will
    123-
    result when running the build because the c99 cross-compiler does not support
    124-
    the `gcc -MT` option. An example of a `Configure` command to be run from the
    125-
    OpenSSL directory is:
    122+
    An example of a `Configure` command to be run from the OpenSSL directory is:
    126123

    127-
    ./Configure nonstop-nsx_64 no-makedepend --with-rand-seed=rdcpu
    124+
    ./Configure nonstop-nsx_64 --with-rand-seed=rdcpu
    128125

    129126
    Do not forget to include any OpenSSL cross-compiling prefix and certificate
    130127
    options when creating your libraries.

    ‎README.md‎

    Lines changed: 8 additions & 20 deletions
    Original file line numberDiff line numberDiff line change
    @@ -59,7 +59,7 @@ For Production Use
    5959
    ------------------
    6060

    6161
    Source code tarballs of the official releases can be downloaded from
    62-
    [www.openssl.org/source](https://www.openssl.org/source).
    62+
    [openssl-library.org/source/](https://openssl-library.org/source/).
    6363
    The OpenSSL project does not distribute the toolkit in binary form.
    6464

    6565
    However, for a large variety of operating systems precompiled versions
    @@ -75,22 +75,18 @@ the source tarballs, having a local copy of the git repository with
    7575
    the entire project history gives you much more insight into the
    7676
    code base.
    7777

    78-
    The official OpenSSL Git Repository is located at [git.openssl.org].
    79-
    There is a GitHub mirror of the repository at [github.com/openssl/openssl],
    78+
    The main OpenSSL Git repository is private.
    79+
    There is a public GitHub mirror of it at [github.com/openssl/openssl],
    8080
    which is updated automatically from the former on every commit.
    8181

    82-
    A local copy of the Git Repository can be obtained by cloning it from
    83-
    the original OpenSSL repository using
    84-
    85-
    git clone git://git.openssl.org/openssl.git
    86-
    87-
    or from the GitHub mirror using
    82+
    A local copy of the Git repository can be obtained by cloning it from
    83+
    the GitHub mirror using
    8884

    8985
    git clone https://github.com/openssl/openssl.git
    9086

    9187
    If you intend to contribute to OpenSSL, either to fix bugs or contribute
    92-
    new features, you need to fork the OpenSSL repository openssl/openssl on
    93-
    GitHub and clone your public fork instead.
    88+
    new features, you need to fork the GitHub mirror and clone your public fork
    89+
    instead.
    9490

    9591
    git clone https://github.com/yourname/openssl.git
    9692

    @@ -166,7 +162,7 @@ attempting to develop or distribute cryptographic code.
    166162
    Copyright
    167163
    =========
    168164

    169-
    Copyright (c) 1998-2024 The OpenSSL Project
    165+
    Copyright (c) 1998-2025 The OpenSSL Project
    170166

    171167
    Copyright (c) 1995-1998 Eric A. Young, Tim J. Hudson
    172168

    @@ -178,14 +174,6 @@ All rights reserved.
    178174
    <https://www.openssl.org>
    179175
    "OpenSSL Homepage"
    180176

    181-
    [git.openssl.org]:
    182-
    <https://git.openssl.org>
    183-
    "OpenSSL Git Repository"
    184-
    185-
    [git.openssl.org]:
    186-
    <https://git.openssl.org>
    187-
    "OpenSSL Git Repository"
    188-
    189177
    [github.com/openssl/openssl]:
    190178
    <https://github.com/openssl/openssl>
    191179
    "OpenSSL GitHub Mirror"

    ‎VERSION.dat‎

    Lines changed: 2 additions & 2 deletions
    Original file line numberDiff line numberDiff line change
    @@ -1,7 +1,7 @@
    11
    MAJOR=3
    22
    MINOR=0
    3-
    PATCH=15
    3+
    PATCH=16
    44
    PRE_RELEASE_TAG=
    55
    BUILD_METADATA=
    6-
    RELEASE_DATE="3 Sep 2024"
    6+
    RELEASE_DATE="11 Feb 2025"
    77
    SHLIB_VERSION=3

    ‎apps/asn1parse.c‎

    Lines changed: 3 additions & 2 deletions
    Original file line numberDiff line numberDiff line change
    @@ -1,5 +1,5 @@
    11
    /*
    2-
    * Copyright 1995-2021 The OpenSSL Project Authors. All Rights Reserved.
    2+
    * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
    33
    *
    44
    * Licensed under the Apache License 2.0 (the "License"). You may not use
    55
    * this file except in compliance with the License. You can obtain a copy
    @@ -127,7 +127,8 @@ int asn1parse_main(int argc, char **argv)
    127127
    dump = strtol(opt_arg(), NULL, 0);
    128128
    break;
    129129
    case OPT_STRPARSE:
    130-
    sk_OPENSSL_STRING_push(osk, opt_arg());
    130+
    if (sk_OPENSSL_STRING_push(osk, opt_arg()) <= 0)
    131+
    goto end;
    131132
    break;
    132133
    case OPT_GENSTR:
    133134
    genstr = opt_arg();

    ‎apps/cms.c‎

    Lines changed: 28 additions & 11 deletions
    Original file line numberDiff line numberDiff line change
    @@ -1,5 +1,5 @@
    11
    /*
    2-
    * Copyright 2008-2024 The OpenSSL Project Authors. All Rights Reserved.
    2+
    * Copyright 2008-2025 The OpenSSL Project Authors. All Rights Reserved.
    33
    *
    44
    * Licensed under the Apache License 2.0 (the "License"). You may not use
    55
    * this file except in compliance with the License. You can obtain a copy
    @@ -494,13 +494,15 @@ int cms_main(int argc, char **argv)
    494494
    if (rr_from == NULL
    495495
    && (rr_from = sk_OPENSSL_STRING_new_null()) == NULL)
    496496
    goto end;
    497-
    sk_OPENSSL_STRING_push(rr_from, opt_arg());
    497+
    if (sk_OPENSSL_STRING_push(rr_from, opt_arg()) <= 0)
    498+
    goto end;
    498499
    break;
    499500
    case OPT_RR_TO:
    500501
    if (rr_to == NULL
    501502
    && (rr_to = sk_OPENSSL_STRING_new_null()) == NULL)
    502503
    goto end;
    503-
    sk_OPENSSL_STRING_push(rr_to, opt_arg());
    504+
    if (sk_OPENSSL_STRING_push(rr_to, opt_arg()) <= 0)
    505+
    goto end;
    504506
    break;
    505507
    case OPT_PRINT:
    506508
    noout = print = 1;
    @@ -577,13 +579,15 @@ int cms_main(int argc, char **argv)
    577579
    if (sksigners == NULL
    578580
    && (sksigners = sk_OPENSSL_STRING_new_null()) == NULL)
    579581
    goto end;
    580-
    sk_OPENSSL_STRING_push(sksigners, signerfile);
    582+
    if (sk_OPENSSL_STRING_push(sksigners, signerfile) <= 0)
    583+
    goto end;
    581584
    if (keyfile == NULL)
    582585
    keyfile = signerfile;
    583586
    if (skkeys == NULL
    584587
    && (skkeys = sk_OPENSSL_STRING_new_null()) == NULL)
    585588
    goto end;
    586-
    sk_OPENSSL_STRING_push(skkeys, keyfile);
    589+
    if (sk_OPENSSL_STRING_push(skkeys, keyfile) <= 0)
    590+
    goto end;
    587591
    keyfile = NULL;
    588592
    }
    589593
    signerfile = opt_arg();
    @@ -601,12 +605,14 @@ int cms_main(int argc, char **argv)
    601605
    if (sksigners == NULL
    602606
    && (sksigners = sk_OPENSSL_STRING_new_null()) == NULL)
    603607
    goto end;
    604-
    sk_OPENSSL_STRING_push(sksigners, signerfile);
    608+
    if (sk_OPENSSL_STRING_push(sksigners, signerfile) <= 0)
    609+
    goto end;
    605610
    signerfile = NULL;
    606611
    if (skkeys == NULL
    607612
    && (skkeys = sk_OPENSSL_STRING_new_null()) == NULL)
    608613
    goto end;
    609-
    sk_OPENSSL_STRING_push(skkeys, keyfile);
    614+
    if (sk_OPENSSL_STRING_push(skkeys, keyfile) <= 0)
    615+
    goto end;
    610616
    }
    611617
    keyfile = opt_arg();
    612618
    break;
    @@ -660,7 +666,8 @@ int cms_main(int argc, char **argv)
    660666
    key_param->next = nparam;
    661667
    key_param = nparam;
    662668
    }
    663-
    sk_OPENSSL_STRING_push(key_param->param, opt_arg());
    669+
    if (sk_OPENSSL_STRING_push(key_param->param, opt_arg()) <= 0)
    670+
    goto end;
    664671
    break;
    665672
    case OPT_V_CASES:
    666673
    if (!opt_verify(o, vpm))
    @@ -749,12 +756,14 @@ int cms_main(int argc, char **argv)
    749756
    if (sksigners == NULL
    750757
    && (sksigners = sk_OPENSSL_STRING_new_null()) == NULL)
    751758
    goto end;
    752-
    sk_OPENSSL_STRING_push(sksigners, signerfile);
    759+
    if (sk_OPENSSL_STRING_push(sksigners, signerfile) <= 0)
    760+
    goto end;
    753761
    if (skkeys == NULL && (skkeys = sk_OPENSSL_STRING_new_null()) == NULL)
    754762
    goto end;
    755763
    if (keyfile == NULL)
    756764
    keyfile = signerfile;
    757-
    sk_OPENSSL_STRING_push(skkeys, keyfile);
    765+
    if (sk_OPENSSL_STRING_push(skkeys, keyfile) <= 0)
    766+
    goto end;
    758767
    }
    759768
    if (sksigners == NULL) {
    760769
    BIO_printf(bio_err, "No signer certificate specified\n");
    @@ -1014,8 +1023,15 @@ int cms_main(int argc, char **argv)
    10141023
    pwri_tmp = NULL;
    10151024
    }
    10161025
    if (!(flags & CMS_STREAM)) {
    1017-
    if (!CMS_final(cms, in, NULL, flags))
    1026+
    if (!CMS_final(cms, in, NULL, flags)) {
    1027+
    if (originator != NULL
    1028+
    && ERR_GET_REASON(ERR_peek_error())
    1029+
    == CMS_R_ERROR_UNSUPPORTED_STATIC_KEY_AGREEMENT) {
    1030+
    BIO_printf(bio_err, "Cannot use originator for encryption\n");
    1031+
    goto end;
    1032+
    }
    10181033
    goto end;
    1034+
    }
    10191035
    }
    10201036
    } else if (operation == SMIME_ENCRYPTED_ENCRYPT) {
    10211037
    cms = CMS_EncryptedData_encrypt_ex(in, cipher, secret_key,
    @@ -1261,6 +1277,7 @@ int cms_main(int argc, char **argv)
    12611277
    X509_free(cert);
    12621278
    X509_free(recip);
    12631279
    X509_free(signer);
    1280+
    X509_free(originator);
    12641281
    EVP_PKEY_free(key);
    12651282
    EVP_CIPHER_free(cipher);
    12661283
    EVP_CIPHER_free(wrap_cipher);

    ‎apps/engine.c‎

    Lines changed: 5 additions & 3 deletions
    Original file line numberDiff line numberDiff line change
    @@ -1,5 +1,5 @@
    11
    /*
    2-
    * Copyright 2000-2021 The OpenSSL Project Authors. All Rights Reserved.
    2+
    * Copyright 2000-2025 The OpenSSL Project Authors. All Rights Reserved.
    33
    *
    44
    * Licensed under the Apache License 2.0 (the "License"). You may not use
    55
    * this file except in compliance with the License. You can obtain a copy
    @@ -352,10 +352,12 @@ int engine_main(int argc, char **argv)
    352352
    test_avail++;
    353353
    break;
    354354
    case OPT_PRE:
    355-
    sk_OPENSSL_STRING_push(pre_cmds, opt_arg());
    355+
    if (sk_OPENSSL_STRING_push(pre_cmds, opt_arg()) <= 0)
    356+
    goto end;
    356357
    break;
    357358
    case OPT_POST:
    358-
    sk_OPENSSL_STRING_push(post_cmds, opt_arg());
    359+
    if (sk_OPENSSL_STRING_push(post_cmds, opt_arg()) <= 0)
    360+
    goto end;
    359361
    break;
    360362
    }
    361363
    }

    ‎apps/lib/http_server.c‎

    Lines changed: 5 additions & 2 deletions
    Original file line numberDiff line numberDiff line change
    @@ -220,14 +220,17 @@ BIO *http_server_init_bio(const char *prog, const char *port)
    220220
    {
    221221
    BIO *acbio = NULL, *bufbio;
    222222
    int asock;
    223+
    char name[40];
    223224

    225+
    snprintf(name, sizeof(name), "[::]:%s", port); /* port may be "0" */
    224226
    bufbio = BIO_new(BIO_f_buffer());
    225227
    if (bufbio == NULL)
    226228
    goto err;
    227229
    acbio = BIO_new(BIO_s_accept());
    228230
    if (acbio == NULL
    229-
    || BIO_set_bind_mode(acbio, BIO_BIND_REUSEADDR) < 0
    230-
    || BIO_set_accept_port(acbio, port) < 0) {
    231+
    || BIO_set_accept_ip_family(acbio, BIO_FAMILY_IPANY) <= 0 /* IPv4/6 */
    232+
    || BIO_set_bind_mode(acbio, BIO_BIND_REUSEADDR) <= 0
    233+
    || BIO_set_accept_name(acbio, name) <= 0) {
    231234
    log_message(prog, LOG_ERR, "Error setting up accept BIO");
    232235
    goto err;
    233236
    }

    0 commit comments

    Comments
     (0)
    0