Skip to content

Commit 63d51c8

Browse files
nodejs-github-bottargos
nodejs-github-bot
authored and
targos
committed
deps: upgrade openssl sources to quictls/openssl-3.0.15+quic1
PR-URL: #55184 Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com> Reviewed-By: Richard Lau <rlau@redhat.com> Reviewed-By: Michael Dawson <midawson@redhat.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
1 parent 29e6484 commit 63d51c8

File tree

205 files changed

+2458
-863
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

205 files changed

+2458
-863
lines changed

‎deps/openssl/openssl/CHANGES.md

+35-1
Original file line numberDiff line numberDiff line change
@@ -28,12 +28,36 @@ breaking changes, and mappings for the large list of deprecated functions.
2828

2929
[Migration guide]: https://github.com/openssl/openssl/tree/master/doc/man7/migration_guide.pod
3030

31-
### Changes between 3.0.14 and 3.0.14+quic [7 Jun 2024]
31+
### Changes between 3.0.15 and 3.0.15+quic [3 Sep 2024]
3232

3333
* Add QUIC API support from BoringSSL
3434

3535
*Todd Short*
3636

37+
### Changes between 3.0.14 and 3.0.15 [3 Sep 2024]
38+
39+
* Fixed possible denial of service in X.509 name checks.
40+
41+
Applications performing certificate name checks (e.g., TLS clients checking
42+
server certificates) may attempt to read an invalid memory address when
43+
comparing the expected name with an `otherName` subject alternative name of
44+
an X.509 certificate. This may result in an exception that terminates the
45+
application program.
46+
47+
([CVE-2024-6119])
48+
49+
*Viktor Dukhovni*
50+
51+
* Fixed possible buffer overread in SSL_select_next_proto().
52+
53+
Calling the OpenSSL API function SSL_select_next_proto with an empty
54+
supported client protocols buffer may cause a crash or memory contents
55+
to be sent to the peer.
56+
57+
([CVE-2024-5535])
58+
59+
*Matt Caswell*
60+
3761
### Changes between 3.0.13 and 3.0.14 [4 Jun 2024]
3862

3963
* Fixed potential use after free after SSL_free_buffers() is called.
@@ -76,6 +100,14 @@ breaking changes, and mappings for the large list of deprecated functions.
76100

77101
*Tomáš Mráz*
78102

103+
* Improved EC/DSA nonce generation routines to avoid bias and timing
104+
side channel leaks.
105+
106+
Thanks to Florian Sieck from Universität zu Lübeck and George Pantelakis
107+
and Hubert Kario from Red Hat for reporting the issues.
108+
109+
*Tomáš Mráz and Paul Dale*
110+
79111
* Fixed an issue where some non-default TLS server configurations can cause
80112
unbounded memory growth when processing TLSv1.3 sessions. An attacker may
81113
exploit certain server configurations to trigger unbounded memory growth that
@@ -19896,6 +19928,8 @@ ndif
1989619928

1989719929
<!-- Links -->
1989819930

19931+
[CVE-2024-6119]: https://www.openssl.org/news/vulnerabilities.html#CVE-2024-6119
19932+
[CVE-2024-5535]: https://www.openssl.org/news/vulnerabilities.html#CVE-2024-5535
1989919933
[CVE-2024-4741]: https://www.openssl.org/news/vulnerabilities.html#CVE-2024-4741
1990019934
[CVE-2024-4603]: https://www.openssl.org/news/vulnerabilities.html#CVE-2024-4603
1990119935
[CVE-2024-2511]: https://www.openssl.org/news/vulnerabilities.html#CVE-2024-2511

‎deps/openssl/openssl/CONTRIBUTING.md

+3-3
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ HOW TO CONTRIBUTE TO OpenSSL
33

44
Please visit our [Getting Started] page for other ideas about how to contribute.
55

6-
[Getting Started]: <https://www.openssl.org/community/getting-started.html>
6+
[Getting Started]: <https://openssl-library.org/community/getting-started>
77

88
Development is done on GitHub in the [openssl/openssl] repository.
99

@@ -77,8 +77,8 @@ guidelines:
7777
Clean builds via GitHub Actions are required. They are started automatically
7878
whenever a PR is created or updated by committers.
7979
80-
[coding style]: https://www.openssl.org/policies/technical/coding-style.html
81-
[documentation policy]: https://openssl.org/policies/technical/documentation-policy.html
80+
[coding style]: https://openssl-library.org/policies/technical/coding-style/
81+
[documentation policy]: https://openssl-library.org/policies/technical/documentation-policy/
8282
8383
5. When at all possible, code contributions should include tests. These can
8484
either be added to an existing test, or completely new. Please see

‎deps/openssl/openssl/Configurations/10-main.conf

+36
Original file line numberDiff line numberDiff line change
@@ -1264,6 +1264,25 @@ my %targets = (
12641264
AR => add("-X32"),
12651265
RANLIB => add("-X32"),
12661266
},
1267+
# To enable openxl compiler for aix
1268+
# If 17.1 openxl runtime is available, -latomic can be used
1269+
# instead of -DBROKEN_CLANG_ATOMICS
1270+
"aix-clang" => {
1271+
inherit_from => [ "aix-common" ],
1272+
CC => "ibm-clang",
1273+
CFLAGS => picker(debug => "-O0 -g",
1274+
release => "-O"),
1275+
cflags => combine("-Wno-implicit-function-declaration -mcmodel=large -DBROKEN_CLANG_ATOMICS",
1276+
threads("-pthread")),
1277+
ex_libs => add(threads("-pthread")),
1278+
bn_ops => "BN_LLONG RC4_CHAR",
1279+
asm_arch => 'ppc32',
1280+
perlasm_scheme => "aix32",
1281+
shared_cflag => "-fpic",
1282+
shared_ldflag => add("-shared"),
1283+
AR => add("-X32"),
1284+
RANLIB => add("-X32"),
1285+
},
12671286
"aix64-cc" => {
12681287
inherit_from => [ "aix-common" ],
12691288
CC => "cc",
@@ -1282,6 +1301,23 @@ my %targets = (
12821301
AR => add("-X64"),
12831302
RANLIB => add("-X64"),
12841303
},
1304+
"aix64-clang" => {
1305+
inherit_from => [ "aix-common" ],
1306+
CC => "ibm-clang",
1307+
CFLAGS => picker(debug => "-O0 -g",
1308+
release => "-O"),
1309+
cflags => combine("-maix64 -Wno-implicit-function-declaration -mcmodel=large",
1310+
threads("-pthread")),
1311+
ex_libs => add(threads("-pthread")),
1312+
bn_ops => "SIXTY_FOUR_BIT_LONG RC4_CHAR",
1313+
asm_arch => 'ppc64',
1314+
perlasm_scheme => "aix64",
1315+
shared_cflag => "-fpic",
1316+
shared_ldflag => add("-shared"),
1317+
shared_extension => "64.so.\$(SHLIB_VERSION_NUMBER)",
1318+
AR => add("-X64"),
1319+
RANLIB => add("-X64"),
1320+
},
12851321

12861322
# SIEMENS BS2000/OSD: an EBCDIC-based mainframe
12871323
"BS2000-OSD" => {

‎deps/openssl/openssl/Configurations/15-ios.conf

+1-1
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ my %targets = (
1010
template => 1,
1111
inherit_from => [ "darwin-common" ],
1212
sys_id => "iOS",
13-
disable => [ "shared", "async" ],
13+
disable => [ "async" ],
1414
},
1515
"ios-xcrun" => {
1616
inherit_from => [ "ios-common" ],

‎deps/openssl/openssl/Configure

+8-2
Original file line numberDiff line numberDiff line change
@@ -178,7 +178,6 @@ my @gcc_devteam_warn = qw(
178178
# -Wextended-offsetof -- no, needed in CMS ASN1 code
179179
my @clang_devteam_warn = qw(
180180
-Wno-unknown-warning-option
181-
-Wswitch-default
182181
-Wno-parentheses-equality
183182
-Wno-language-extension-token
184183
-Wno-extended-offsetof
@@ -1586,7 +1585,7 @@ if (!$disabled{makedepend}) {
15861585
disable('unavailable', 'makedepend') unless $config{makedep_scheme};
15871586
}
15881587

1589-
if (!$disabled{asm} && !$predefined_C{__MACH__} && $^O ne 'VMS') {
1588+
if (!$disabled{asm} && !$predefined_C{__MACH__} && $^O ne 'VMS' && !$predefined_C{_AIX}) {
15901589
# probe for -Wa,--noexecstack option...
15911590
if ($predefined_C{__clang__}) {
15921591
# clang has builtin assembler, which doesn't recognize --help,
@@ -3410,6 +3409,13 @@ sub absolutedir {
34103409
return rel2abs($dir);
34113410
}
34123411

3412+
# realpath() on Windows seems to check if the directory actually exists,
3413+
# which isn't what is wanted here. All we want to know is if a directory
3414+
# spec is absolute, not if it exists.
3415+
if ($^O eq "MSWin32") {
3416+
return rel2abs($dir);
3417+
}
3418+
34133419
# We use realpath() on Unix, since no other will properly clean out
34143420
# a directory spec.
34153421
use Cwd qw/realpath/;

‎deps/openssl/openssl/INSTALL.md

+2-2
Original file line numberDiff line numberDiff line change
@@ -1168,7 +1168,7 @@ Configure OpenSSL
11681168
### Automatic Configuration
11691169

11701170
In previous version, the `config` script determined the platform type and
1171-
compiler and then called `Configure`. Starting with this release, they are
1171+
compiler and then called `Configure`. Starting with version 3.0, they are
11721172
the same.
11731173

11741174
#### Unix / Linux / macOS
@@ -1622,7 +1622,7 @@ More about our support resources can be found in the [SUPPORT] file.
16221622

16231623
### Configuration Errors
16241624

1625-
If the `./Configure` or `./Configure` command fails with an error message,
1625+
If the `./config` or `./Configure` command fails with an error message,
16261626
read the error message carefully and try to figure out whether you made
16271627
a mistake (e.g., by providing a wrong option), or whether the script is
16281628
working incorrectly. If you think you encountered a bug, please

‎deps/openssl/openssl/NEWS.md

+15
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,19 @@ OpenSSL Releases
1818
OpenSSL 3.0
1919
-----------
2020

21+
### Major changes between OpenSSL 3.0.14 and OpenSSL 3.0.15 [3 Sep 2024]
22+
23+
OpenSSL 3.0.15 is a security patch release. The most severe CVE fixed in this
24+
release is Moderate.
25+
26+
This release incorporates the following bug fixes and mitigations:
27+
28+
* Fixed possible denial of service in X.509 name checks
29+
([CVE-2024-6119])
30+
31+
* Fixed possible buffer overread in SSL_select_next_proto()
32+
([CVE-2024-5535])
33+
2134
### Major changes between OpenSSL 3.0.13 and OpenSSL 3.0.14 [4 Jun 2024]
2235

2336
* Fixed potential use after free after SSL_free_buffers() is called
@@ -1482,6 +1495,8 @@ OpenSSL 0.9.x
14821495

14831496
<!-- Links -->
14841497

1498+
[CVE-2024-6119]: https://www.openssl.org/news/vulnerabilities.html#CVE-2024-6119
1499+
[CVE-2024-5535]: https://www.openssl.org/news/vulnerabilities.html#CVE-2024-5535
14851500
[CVE-2024-4741]: https://www.openssl.org/news/vulnerabilities.html#CVE-2024-4741
14861501
[CVE-2024-4603]: https://www.openssl.org/news/vulnerabilities.html#CVE-2024-4603
14871502
[CVE-2024-2511]: https://www.openssl.org/news/vulnerabilities.html#CVE-2024-2511

‎deps/openssl/openssl/README.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ What This Is
44
This is a fork of [OpenSSL](https://www.openssl.org) to enable QUIC. In addition
55
to the website, the official source distribution is at
66
<https://github.com/openssl/openssl>. The OpenSSL `README` can be found at
7-
[README-OpenSSL.md](https://github.com/quictls/openssl/blob/openssl-3.0.13%2Bquic/README-OpenSSL.md)
7+
[README-OpenSSL.md](https://github.com/quictls/openssl/blob/openssl-3.0.15%2Bquic/README-OpenSSL.md)
88

99
This fork adds APIs that can be used by QUIC implementations for connection
1010
handshakes. Quoting the IETF Working group

‎deps/openssl/openssl/VERSION.dat

+2-2
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
MAJOR=3
22
MINOR=0
3-
PATCH=14
3+
PATCH=15
44
PRE_RELEASE_TAG=
55
BUILD_METADATA=quic
6-
RELEASE_DATE="4 Jun 2024"
6+
RELEASE_DATE="3 Sep 2024"
77
SHLIB_VERSION=81.3

‎deps/openssl/openssl/apps/cms.c

+2-2
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2008-2023 The OpenSSL Project Authors. All Rights Reserved.
2+
* Copyright 2008-2024 The OpenSSL Project Authors. All Rights Reserved.
33
*
44
* Licensed under the Apache License 2.0 (the "License"). You may not use
55
* this file except in compliance with the License. You can obtain a copy
@@ -132,7 +132,7 @@ const OPTIONS cms_options[] = {
132132
{"binary", OPT_BINARY, '-',
133133
"Treat input as binary: do not translate to canonical form"},
134134
{"crlfeol", OPT_CRLFEOL, '-',
135-
"Use CRLF as EOL termination instead of CR only" },
135+
"Use CRLF as EOL termination instead of LF only" },
136136
{"asciicrlf", OPT_ASCIICRLF, '-',
137137
"Perform CRLF canonicalisation when signing"},
138138

‎deps/openssl/openssl/apps/dgst.c

+5-4
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 1995-2023 The OpenSSL Project Authors. All Rights Reserved.
2+
* Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
33
*
44
* Licensed under the Apache License 2.0 (the "License"). You may not use
55
* this file except in compliance with the License. You can obtain a copy
@@ -478,7 +478,7 @@ int dgst_main(int argc, char **argv)
478478
static void show_digests(const OBJ_NAME *name, void *arg)
479479
{
480480
struct doall_dgst_digests *dec = (struct doall_dgst_digests *)arg;
481-
const EVP_MD *md = NULL;
481+
EVP_MD *md = NULL;
482482

483483
/* Filter out signed digests (a.k.a signature algorithms) */
484484
if (strstr(name->name, "rsa") != NULL || strstr(name->name, "RSA") != NULL)
@@ -490,8 +490,7 @@ static void show_digests(const OBJ_NAME *name, void *arg)
490490
/* Filter out message digests that we cannot use */
491491
md = EVP_MD_fetch(app_get0_libctx(), name->name, app_get0_propq());
492492
if (md == NULL) {
493-
md = EVP_get_digestbyname(name->name);
494-
if (md == NULL)
493+
if (EVP_get_digestbyname(name->name) == NULL)
495494
return;
496495
}
497496

@@ -502,6 +501,8 @@ static void show_digests(const OBJ_NAME *name, void *arg)
502501
} else {
503502
BIO_printf(dec->bio, " ");
504503
}
504+
505+
EVP_MD_free(md);
505506
}
506507

507508
/*

‎deps/openssl/openssl/apps/lib/opt.c

+2-2
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2015-2021 The OpenSSL Project Authors. All Rights Reserved.
2+
* Copyright 2015-2024 The OpenSSL Project Authors. All Rights Reserved.
33
*
44
* Licensed under the Apache License 2.0 (the "License"). You may not use
55
* this file except in compliance with the License. You can obtain a copy
@@ -616,7 +616,7 @@ int opt_uintmax(const char *value, ossl_uintmax_t *result)
616616
opt_number_error(value);
617617
return 0;
618618
}
619-
*result = (ossl_intmax_t)m;
619+
*result = (ossl_uintmax_t)m;
620620
errno = oerrno;
621621
return 1;
622622
}

‎deps/openssl/openssl/apps/lib/s_cb.c

+2-1
Original file line numberDiff line numberDiff line change
@@ -649,7 +649,7 @@ void msg_cb(int write_p, int version, int content_type, const void *buf,
649649
(void)BIO_flush(bio);
650650
}
651651

652-
static STRINT_PAIR tlsext_types[] = {
652+
static const STRINT_PAIR tlsext_types[] = {
653653
{"server name", TLSEXT_TYPE_server_name},
654654
{"max fragment length", TLSEXT_TYPE_max_fragment_length},
655655
{"client certificate URL", TLSEXT_TYPE_client_certificate_url},
@@ -688,6 +688,7 @@ static STRINT_PAIR tlsext_types[] = {
688688
{"psk kex modes", TLSEXT_TYPE_psk_kex_modes},
689689
{"certificate authorities", TLSEXT_TYPE_certificate_authorities},
690690
{"post handshake auth", TLSEXT_TYPE_post_handshake_auth},
691+
{"early_data", TLSEXT_TYPE_early_data},
691692
{NULL}
692693
};
693694

‎deps/openssl/openssl/apps/smime.c

+2-2
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 1999-2021 The OpenSSL Project Authors. All Rights Reserved.
2+
* Copyright 1999-2024 The OpenSSL Project Authors. All Rights Reserved.
33
*
44
* Licensed under the Apache License 2.0 (the "License"). You may not use
55
* this file except in compliance with the License. You can obtain a copy
@@ -118,7 +118,7 @@ const OPTIONS smime_options[] = {
118118
"Do not load certificates from the default certificates store"},
119119
{"nochain", OPT_NOCHAIN, '-',
120120
"set PKCS7_NOCHAIN so certificates contained in the message are not used as untrusted CAs" },
121-
{"crlfeol", OPT_CRLFEOL, '-', "Use CRLF as EOL termination instead of CR only"},
121+
{"crlfeol", OPT_CRLFEOL, '-', "Use CRLF as EOL termination instead of LF only"},
122122

123123
OPT_R_OPTIONS,
124124
OPT_V_OPTIONS,

0 commit comments

Comments
 (0)