Skip to content

Commit 2c6817e

Browse files
RafaelGSSjuanarbol
RafaelGSS
authored and
juanarbol
committed
deps: upgrade openssl sources to quictls/openssl-3.0.8+quic
This updates all sources in deps/openssl/openssl by: $ git clone git@github.com:quictls/openssl.git $ cd openssl $ git checkout openssl-3.0.8+quic $ cd ../node/deps/openssl $ rm -rf openssl $ cp -R ../../../openssl openssl $ rm -rf openssl/.git* openssl/.travis* $ git add --all openssl $ git commit openssl PR-URL: #46572 Refs: https://mta.openssl.org/pipermail/openssl-announce/2023-February/000251.html Reviewed-By: Richard Lau <rlau@redhat.com>
1 parent f0afa0b commit 2c6817e

File tree

368 files changed

+6451
-1512
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

368 files changed

+6451
-1512
lines changed

‎deps/openssl/openssl/CHANGES.md

+174-2
Original file line numberDiff line numberDiff line change
@@ -28,12 +28,175 @@ breaking changes, and mappings for the large list of deprecated functions.
2828

2929
[Migration guide]: https://github.com/openssl/openssl/tree/master/doc/man7/migration_guide.pod
3030

31-
### Changes between 3.0.7 and 3.0.7+quic [1 Nov 2022]
31+
### Changes between 3.0.8 and 3.0.8+quic [7 Feb 2023]
3232

3333
* Add QUIC API support from BoringSSL.
3434

3535
*Todd Short*
3636

37+
### Changes between 3.0.7 and 3.0.8 [7 Feb 2023]
38+
39+
* Fixed NULL dereference during PKCS7 data verification.
40+
41+
A NULL pointer can be dereferenced when signatures are being
42+
verified on PKCS7 signed or signedAndEnveloped data. In case the hash
43+
algorithm used for the signature is known to the OpenSSL library but
44+
the implementation of the hash algorithm is not available the digest
45+
initialization will fail. There is a missing check for the return
46+
value from the initialization function which later leads to invalid
47+
usage of the digest API most likely leading to a crash.
48+
([CVE-2023-0401])
49+
50+
PKCS7 data is processed by the SMIME library calls and also by the
51+
time stamp (TS) library calls. The TLS implementation in OpenSSL does
52+
not call these functions however third party applications would be
53+
affected if they call these functions to verify signatures on untrusted
54+
data.
55+
56+
*Tomáš Mráz*
57+
58+
* Fixed X.400 address type confusion in X.509 GeneralName.
59+
60+
There is a type confusion vulnerability relating to X.400 address processing
61+
inside an X.509 GeneralName. X.400 addresses were parsed as an ASN1_STRING
62+
but the public structure definition for GENERAL_NAME incorrectly specified
63+
the type of the x400Address field as ASN1_TYPE. This field is subsequently
64+
interpreted by the OpenSSL function GENERAL_NAME_cmp as an ASN1_TYPE rather
65+
than an ASN1_STRING.
66+
67+
When CRL checking is enabled (i.e. the application sets the
68+
X509_V_FLAG_CRL_CHECK flag), this vulnerability may allow an attacker to
69+
pass arbitrary pointers to a memcmp call, enabling them to read memory
70+
contents or enact a denial of service.
71+
([CVE-2023-0286])
72+
73+
*Hugo Landau*
74+
75+
* Fixed NULL dereference validating DSA public key.
76+
77+
An invalid pointer dereference on read can be triggered when an
78+
application tries to check a malformed DSA public key by the
79+
EVP_PKEY_public_check() function. This will most likely lead
80+
to an application crash. This function can be called on public
81+
keys supplied from untrusted sources which could allow an attacker
82+
to cause a denial of service attack.
83+
84+
The TLS implementation in OpenSSL does not call this function
85+
but applications might call the function if there are additional
86+
security requirements imposed by standards such as FIPS 140-3.
87+
([CVE-2023-0217])
88+
89+
*Shane Lontis, Tomáš Mráz*
90+
91+
* Fixed Invalid pointer dereference in d2i_PKCS7 functions.
92+
93+
An invalid pointer dereference on read can be triggered when an
94+
application tries to load malformed PKCS7 data with the
95+
d2i_PKCS7(), d2i_PKCS7_bio() or d2i_PKCS7_fp() functions.
96+
97+
The result of the dereference is an application crash which could
98+
lead to a denial of service attack. The TLS implementation in OpenSSL
99+
does not call this function however third party applications might
100+
call these functions on untrusted data.
101+
([CVE-2023-0216])
102+
103+
*Tomáš Mráz*
104+
105+
* Fixed Use-after-free following BIO_new_NDEF.
106+
107+
The public API function BIO_new_NDEF is a helper function used for
108+
streaming ASN.1 data via a BIO. It is primarily used internally to OpenSSL
109+
to support the SMIME, CMS and PKCS7 streaming capabilities, but may also
110+
be called directly by end user applications.
111+
112+
The function receives a BIO from the caller, prepends a new BIO_f_asn1
113+
filter BIO onto the front of it to form a BIO chain, and then returns
114+
the new head of the BIO chain to the caller. Under certain conditions,
115+
for example if a CMS recipient public key is invalid, the new filter BIO
116+
is freed and the function returns a NULL result indicating a failure.
117+
However, in this case, the BIO chain is not properly cleaned up and the
118+
BIO passed by the caller still retains internal pointers to the previously
119+
freed filter BIO. If the caller then goes on to call BIO_pop() on the BIO
120+
then a use-after-free will occur. This will most likely result in a crash.
121+
([CVE-2023-0215])
122+
123+
*Viktor Dukhovni, Matt Caswell*
124+
125+
* Fixed Double free after calling PEM_read_bio_ex.
126+
127+
The function PEM_read_bio_ex() reads a PEM file from a BIO and parses and
128+
decodes the "name" (e.g. "CERTIFICATE"), any header data and the payload
129+
data. If the function succeeds then the "name_out", "header" and "data"
130+
arguments are populated with pointers to buffers containing the relevant
131+
decoded data. The caller is responsible for freeing those buffers. It is
132+
possible to construct a PEM file that results in 0 bytes of payload data.
133+
In this case PEM_read_bio_ex() will return a failure code but will populate
134+
the header argument with a pointer to a buffer that has already been freed.
135+
If the caller also frees this buffer then a double free will occur. This
136+
will most likely lead to a crash.
137+
138+
The functions PEM_read_bio() and PEM_read() are simple wrappers around
139+
PEM_read_bio_ex() and therefore these functions are also directly affected.
140+
141+
These functions are also called indirectly by a number of other OpenSSL
142+
functions including PEM_X509_INFO_read_bio_ex() and
143+
SSL_CTX_use_serverinfo_file() which are also vulnerable. Some OpenSSL
144+
internal uses of these functions are not vulnerable because the caller does
145+
not free the header argument if PEM_read_bio_ex() returns a failure code.
146+
([CVE-2022-4450])
147+
148+
*Kurt Roeckx, Matt Caswell*
149+
150+
* Fixed Timing Oracle in RSA Decryption.
151+
152+
A timing based side channel exists in the OpenSSL RSA Decryption
153+
implementation which could be sufficient to recover a plaintext across
154+
a network in a Bleichenbacher style attack. To achieve a successful
155+
decryption an attacker would have to be able to send a very large number
156+
of trial messages for decryption. The vulnerability affects all RSA padding
157+
modes: PKCS#1 v1.5, RSA-OEAP and RSASVE.
158+
([CVE-2022-4304])
159+
160+
*Dmitry Belyavsky, Hubert Kario*
161+
162+
* Fixed X.509 Name Constraints Read Buffer Overflow.
163+
164+
A read buffer overrun can be triggered in X.509 certificate verification,
165+
specifically in name constraint checking. The read buffer overrun might
166+
result in a crash which could lead to a denial of service attack.
167+
In a TLS client, this can be triggered by connecting to a malicious
168+
server. In a TLS server, this can be triggered if the server requests
169+
client authentication and a malicious client connects.
170+
([CVE-2022-4203])
171+
172+
*Viktor Dukhovni*
173+
174+
* Fixed X.509 Policy Constraints Double Locking security issue.
175+
176+
If an X.509 certificate contains a malformed policy constraint and
177+
policy processing is enabled, then a write lock will be taken twice
178+
recursively. On some operating systems (most widely: Windows) this
179+
results in a denial of service when the affected process hangs. Policy
180+
processing being enabled on a publicly facing server is not considered
181+
to be a common setup.
182+
([CVE-2022-3996])
183+
184+
*Paul Dale*
185+
186+
* Our provider implementations of `OSSL_FUNC_KEYMGMT_EXPORT` and
187+
`OSSL_FUNC_KEYMGMT_GET_PARAMS` for EC and SM2 keys now honor
188+
`OSSL_PKEY_PARAM_EC_POINT_CONVERSION_FORMAT` as set (and
189+
default to `POINT_CONVERSION_UNCOMPRESSED`) when exporting
190+
`OSSL_PKEY_PARAM_PUB_KEY`, instead of unconditionally using
191+
`POINT_CONVERSION_COMPRESSED` as in previous 3.x releases.
192+
For symmetry, our implementation of `EVP_PKEY_ASN1_METHOD->export_to`
193+
for legacy EC and SM2 keys is also changed similarly to honor the
194+
equivalent conversion format flag as specified in the underlying
195+
`EC_KEY` object being exported to a provider, when this function is
196+
called through `EVP_PKEY_export()`.
197+
198+
*Nicola Tuveri*
199+
37200
### Changes between 3.0.6 and 3.0.7 [1 Nov 2022]
38201

39202
* Fixed two buffer overflows in punycode decoding functions.
@@ -19232,7 +19395,7 @@ ndif
1923219395
*Ralf S. Engelschall*
1923319396

1923419397
* Incorporated the popular no-RSA/DSA-only patches
19235-
which allow to compile a RSA-free SSLeay.
19398+
which allow to compile an RSA-free SSLeay.
1923619399

1923719400
*Andrew Cooke / Interrader Ldt., Ralf S. Engelschall*
1923819401

@@ -19421,6 +19584,15 @@ ndif
1942119584

1942219585
<!-- Links -->
1942319586

19587+
[CVE-2023-0401]: https://www.openssl.org/news/vulnerabilities.html#CVE-2023-0401
19588+
[CVE-2023-0286]: https://www.openssl.org/news/vulnerabilities.html#CVE-2023-0286
19589+
[CVE-2023-0217]: https://www.openssl.org/news/vulnerabilities.html#CVE-2023-0217
19590+
[CVE-2023-0216]: https://www.openssl.org/news/vulnerabilities.html#CVE-2023-0216
19591+
[CVE-2023-0215]: https://www.openssl.org/news/vulnerabilities.html#CVE-2023-0215
19592+
[CVE-2022-4450]: https://www.openssl.org/news/vulnerabilities.html#CVE-2022-4450
19593+
[CVE-2022-4304]: https://www.openssl.org/news/vulnerabilities.html#CVE-2022-4304
19594+
[CVE-2022-4203]: https://www.openssl.org/news/vulnerabilities.html#CVE-2022-4203
19595+
[CVE-2022-3996]: https://www.openssl.org/news/vulnerabilities.html#CVE-2022-3996
1942419596
[CVE-2022-2274]: https://www.openssl.org/news/vulnerabilities.html#CVE-2022-2274
1942519597
[CVE-2022-2097]: https://www.openssl.org/news/vulnerabilities.html#CVE-2022-2274
1942619598
[CVE-2020-1971]: https://www.openssl.org/news/vulnerabilities.html#CVE-2020-1971

‎deps/openssl/openssl/Configurations/descrip.mms.tmpl

+5-17
Original file line numberDiff line numberDiff line change
@@ -984,7 +984,8 @@ EOF
984984
$target : $gen0 $deps $mkdef
985985
\$(PERL) $mkdef$ord_ver --type $args{intent} --ordinals $gen0 --name $ord_name "--OS" "VMS"$case_insensitive > $target
986986
EOF
987-
} elsif (platform->isasm($args{src})) {
987+
} elsif (platform->isasm($args{src})
988+
|| platform->iscppasm($args{src})) {
988989
#
989990
# Assembler generator
990991
#
@@ -994,7 +995,9 @@ EOF
994995
dso => "$dso_cflags $dso_cppflags",
995996
bin => "$bin_cflags $bin_cppflags" } -> {$args{intent}};
996997
my $defs = join("", map { ",".$_ } @{$args{defs}});
997-
my $target = platform->asm($args{src});
998+
my $target = platform->isasm($args{src})
999+
? platform->asm($args{src})
1000+
: $args{src};
9981001

9991002
my $generator;
10001003
if ($gen0 =~ /\.pl$/) {
@@ -1007,21 +1010,6 @@ EOF
10071010
}
10081011

10091012
if (defined($generator)) {
1010-
# If the target is named foo.S in build.info, we want to
1011-
# end up generating foo.s in two steps.
1012-
if ($args{src} =~ /\.S$/) {
1013-
return <<"EOF";
1014-
$target : $gen0 $deps
1015-
$generator \$\@-S
1016-
\@ extradefines = "$defs"
1017-
PIPE \$(CPP) $cppflags \$\@-S | -
1018-
\$(PERL) -ne "/^#(\\s*line)?\\s*[0-9]+\\s+""/ or print" > \$\@-i
1019-
\@ DELETE/SYMBOL/LOCAL extradefines
1020-
RENAME \$\@-i \$\@
1021-
DELETE \$\@-S;
1022-
EOF
1023-
}
1024-
# Otherwise....
10251013
return <<"EOF";
10261014
$target : $gen0 $deps
10271015
\@ extradefines = "$defs"

‎deps/openssl/openssl/Configurations/platform/BASE.pm

+3-2
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,7 @@ sub def { return __base($_[1], '.ld') . $_[0]->defext() }
4242
sub obj { return __base($_[1], '.o') . $_[0]->objext() }
4343
sub res { return __base($_[1], '.res') . $_[0]->resext() }
4444
sub dep { return __base($_[1], '.o') . $_[0]->depext() } # <- objname
45-
sub asm { return __base($_[1], '.S', '.s') . $_[0]->asmext() }
45+
sub asm { return __base($_[1], '.s') . $_[0]->asmext() }
4646

4747
# Another set of convenience functions for standard checks of certain
4848
# internal extensions and conversion from internal to platform specific
@@ -51,7 +51,8 @@ sub asm { return __base($_[1], '.S', '.s') . $_[0]->asmext() }
5151
sub isdef { return $_[1] =~ m|\.ld$|; }
5252
sub isobj { return $_[1] =~ m|\.o$|; }
5353
sub isres { return $_[1] =~ m|\.res$|; }
54-
sub isasm { return $_[1] =~ m|\.[Ss]$|; }
54+
sub isasm { return $_[1] =~ m|\.s$|; }
55+
sub iscppasm { return $_[1] =~ m|\.S$|; }
5556
sub isstaticlib { return $_[1] =~ m|\.a$|; }
5657
sub convertext {
5758
if ($_[0]->isdef($_[1])) { return $_[0]->def($_[1]); }

‎deps/openssl/openssl/Configurations/unix-Makefile.tmpl

+2-1
Original file line numberDiff line numberDiff line change
@@ -1552,7 +1552,8 @@ EOF
15521552
$target: $gen0 $deps \$(SRCDIR)/util/mkdef.pl
15531553
\$(PERL) \$(SRCDIR)/util/mkdef.pl$ord_ver --type $args{intent} --ordinals $gen0 --name $ord_name --OS $mkdef_os > $target
15541554
EOF
1555-
} elsif (platform->isasm($args{src})) {
1555+
} elsif (platform->isasm($args{src})
1556+
|| platform->iscppasm($args{src})) {
15561557
#
15571558
# Assembler generator
15581559
#

‎deps/openssl/openssl/Configurations/windows-makefile.tmpl

+5-14
Original file line numberDiff line numberDiff line change
@@ -747,7 +747,8 @@ EOF
747747
$target: $gen0 $deps $mkdef
748748
"\$(PERL)" "$mkdef"$ord_ver --type $args{intent} --ordinals $gen0 --name $ord_name --OS windows > $target
749749
EOF
750-
} elsif (platform->isasm($args{src})) {
750+
} elsif (platform->isasm($args{src})
751+
|| platform->iscppasm($args{src})) {
751752
#
752753
# Assembler generator
753754
#
@@ -757,7 +758,9 @@ EOF
757758
dso => '$(DSO_CFLAGS) $(DSO_CPPFLAGS)',
758759
bin => '$(BIN_CFLAGS) $(BIN_CPPFLAGS)'
759760
} -> {$args{intent}};
760-
my $target = platform->asm($args{src});
761+
my $target = platform->isasm($args{src})
762+
? platform->asm($args{src})
763+
: $args{src};
761764

762765
my $generator;
763766
if ($gen0 =~ /\.pl$/) {
@@ -770,18 +773,6 @@ EOF
770773
}
771774

772775
if (defined($generator)) {
773-
# If the target is named foo.S in build.info, we want to
774-
# end up generating foo.s in two steps.
775-
if ($args{src} =~ /\.S$/) {
776-
return <<"EOF";
777-
$target: "$gen0" $deps
778-
cmd /C "set "ASM=\$(AS)" & $generator \$@.S"
779-
\$(CPP) $incs $cppflags $defs \$@.S > \$@.i
780-
move /Y \$@.i \$@
781-
del /Q \$@.S
782-
EOF
783-
}
784-
# Otherwise....
785776
return <<"EOF";
786777
$target: "$gen0" $deps
787778
cmd /C "set "ASM=\$(AS)" & $generator \$@"

‎deps/openssl/openssl/Configure

+5-5
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
#! /usr/bin/env perl
22
# -*- mode: perl; -*-
3-
# Copyright 2016-2022 The OpenSSL Project Authors. All Rights Reserved.
3+
# Copyright 2016-2023 The OpenSSL Project Authors. All Rights Reserved.
44
#
55
# Licensed under the Apache License 2.0 (the "License"). You may not use
66
# this file except in compliance with the License. You can obtain a copy
@@ -1397,7 +1397,7 @@ $target{build_scheme} = [ $target{build_scheme} ]
13971397
my ($builder, $builder_platform, @builder_opts) =
13981398
@{$target{build_scheme}};
13991399

1400-
foreach my $checker (($builder_platform."-".$target{build_file}."-checker.pm",
1400+
foreach my $checker (($builder_platform."-".$config{build_file}."-checker.pm",
14011401
$builder_platform."-checker.pm")) {
14021402
my $checker_path = catfile($srcdir, "Configurations", $checker);
14031403
if (-f $checker_path) {
@@ -1870,8 +1870,8 @@ if ($builder eq "unified") {
18701870
# Store the name of the template file we will build the build file from
18711871
# in %config. This may be useful for the build file itself.
18721872
my @build_file_template_names =
1873-
( $builder_platform."-".$target{build_file}.".tmpl",
1874-
$target{build_file}.".tmpl" );
1873+
( $builder_platform."-".$config{build_file}.".tmpl",
1874+
$config{build_file}.".tmpl" );
18751875
my @build_file_templates = ();
18761876

18771877
# First, look in the user provided directory, if given
@@ -2888,7 +2888,7 @@ exit(0);
28882888
#
28892889
sub death_handler {
28902890
die @_ if $^S; # To prevent the added message in eval blocks
2891-
my $build_file = $target{build_file} // "build file";
2891+
my $build_file = $config{build_file} // "build file";
28922892
my @message = ( <<"_____", @_ );
28932893
28942894
Failure! $build_file wasn't produced.

‎deps/openssl/openssl/INSTALL.md

+10-3
Original file line numberDiff line numberDiff line change
@@ -244,9 +244,8 @@ and issue the following command.
244244

245245
$ nmake install
246246

247-
The easiest way to elevate the Command Prompt is to press and hold down
248-
the both the `<CTRL>` and `<SHIFT>` key while clicking the menu item in the
249-
task menu.
247+
The easiest way to elevate the Command Prompt is to press and hold down both
248+
the `<CTRL>` and `<SHIFT>` keys while clicking the menu item in the task menu.
250249

251250
The default installation location is
252251

@@ -1208,6 +1207,14 @@ and `descrip.mms` on OpenVMS) from a suitable template in `Configurations/`,
12081207
and defines various macros in `include/openssl/configuration.h` (generated
12091208
from `include/openssl/configuration.h.in`.
12101209

1210+
If none of the generated build files suit your purpose, it's possible to
1211+
write your own build file template and give its name through the environment
1212+
variable `BUILDFILE`. For example, Ninja build files could be supported by
1213+
writing `Configurations/build.ninja.tmpl` and then configure with `BUILDFILE`
1214+
set like this (Unix syntax shown, you'll have to adapt for other platforms):
1215+
1216+
$ BUILDFILE=build.ninja perl Configure [options...]
1217+
12111218
### Out of Tree Builds
12121219

12131220
OpenSSL can be configured to build in a build directory separate from the

0 commit comments

Comments
 (0)