diff --git a/openssl-1_1-ossl-sli-002-ran-make-update.patch b/openssl-1_1-ossl-sli-002-ran-make-update.patch index 45a240a..70b96a1 100644 --- a/openssl-1_1-ossl-sli-002-ran-make-update.patch +++ b/openssl-1_1-ossl-sli-002-ran-make-update.patch @@ -30,11 +30,11 @@ + +# This include will look through the directory that will contain the +# engine declarations for any engines provided by other packages. -+.include /etc/ssl/engines1_1.d ++.include /etc/ssl/engines1.1.d + +# This include will look through the directory that will contain the +# definitions of the engines declared in the engine section. -+.include /etc/ssl/engdef1_1.d ++.include /etc/ssl/engdef1.1.d + +[ oid_section ] + diff --git a/openssl-1_1-use-include-directive.patch b/openssl-1_1-use-include-directive.patch index 4e4bc73..10822c7 100644 --- a/openssl-1_1-use-include-directive.patch +++ b/openssl-1_1-use-include-directive.patch @@ -16,11 +16,11 @@ Index: openssl-1.1.1m/apps/openssl.cnf + +# This include will look through the directory that will contain the +# engine declarations for any engines provided by other packages. -+.include /etc/ssl/engines1_1.d ++.include /etc/ssl/engines1.1.d + +# This include will look through the directory that will contain the +# definitions of the engines declared in the engine section. -+.include /etc/ssl/engdef1_1.d ++.include /etc/ssl/engdef1.1.d + +[ oid_section ] + diff --git a/openssl-1_1.changes b/openssl-1_1.changes index 98dc60e..9d62232 100644 --- a/openssl-1_1.changes +++ b/openssl-1_1.changes @@ -1,3 +1,20 @@ +------------------------------------------------------------------- +Mon Feb 5 16:29:26 UTC 2024 - Otto Hollmann + +- Rename engines directories to the same name like in SLE: + /etc/ssl/engines1_1.d -> /etc/ssl/engines1.1.d + /etc/ssl/engdef1_1.d -> /etc/ssl/engdef1.1.d + * Add migration script to move files (bsc#1219562) + /etc/ssl/engines.d/* -> /etc/ssl/engines1.1.d + /etc/ssl/engdef.d/* -> /etc/ssl/engdef1.1.d + +------------------------------------------------------------------- +Tue Jan 30 14:15:25 UTC 2024 - Otto Hollmann + +- Security fix: [bsc#1219243, CVE-2024-0727] + * Add NULL checks where ContentInfo data can be NULL + * Add openssl-CVE-2024-0727.patch + ------------------------------------------------------------------- Mon Jan 22 09:34:28 UTC 2024 - Otto Hollmann diff --git a/openssl-1_1.spec b/openssl-1_1.spec index 9d98b7d..2ab9594 100644 --- a/openssl-1_1.spec +++ b/openssl-1_1.spec @@ -19,8 +19,8 @@ %define ssletcdir %{_sysconfdir}/ssl %define maj_min 1.1 %define _rname openssl -%global sslengcnf %{ssletcdir}/engines1_1.d -%global sslengdef %{ssletcdir}/engdef1_1.d +%global sslengcnf %{ssletcdir}/engines1.1.d +%global sslengdef %{ssletcdir}/engdef1.1.d %if 0%{?sle_version} >= 150400 || 0%{?suse_version} >= 1550 # Enable livepatching support for SLE15-SP4 onwards. It requires # compiler support introduced there. @@ -192,6 +192,8 @@ Patch114: openssl-Improve-performance-for-6x-unrolling-with-vpermxor-i.pat Patch115: openssl-CVE-2023-5678.patch # PATCH-FIX-OPENSUSE skip SHA1 test in FIPS mode Patch116: openssl-Skip_SHA1-test-in-FIPS-mode.patch +# PATCH-FIX-UPSTREAM: bsc#1219243 CVE-2024-0727: denial of service via null dereference +Patch117: openssl-CVE-2024-0727.patch BuildRequires: jitterentropy-devel >= 3.4.0 BuildRequires: pkgconfig BuildRequires: pkgconfig(zlib) @@ -459,6 +461,46 @@ unset LD_LIBRARY_PATH }} +%pre +# Migrate old engines.d to engines1.1.d.rpmsave +if [ ! -L %{ssletcdir}/engines.d ] && [ -d %{ssletcdir}/engines.d ]; then + mkdir %{ssletcdir}/engines1.1.d.rpmsave ||: + mv -v %{ssletcdir}/engines.d/* %{ssletcdir}/engines1.1.d.rpmsave ||: + rmdir %{ssletcdir}/engines.d ||: +fi + +# Migrate old engdef.d to engdef1.1.d.rpmsave +if [ ! -L %{ssletcdir}/engdef.d ] && [ -d %{ssletcdir}/engdef.d ]; then + mkdir %{ssletcdir}/engdef1.1.d.rpmsave ||: + mv -v %{ssletcdir}/engdef.d/* %{ssletcdir}/engdef1.1.d.rpmsave ||: + rmdir %{ssletcdir}/engdef.d ||: +fi + +%posttrans +# Restore engines1.1.d.rpmsave to engines1.1.d +if [ -d %{ssletcdir}/engines1.1.d.rpmsave ]; then + mv -v %{ssletcdir}/engines1.1.d.rpmsave/* %{ssletcdir}/engines1.1.d ||: + rmdir %{ssletcdir}/engines1.1.d.rpmsave ||: +fi + +# Restore engdef1.1.d.rpmsave to engdef1.1.d +if [ -d %{ssletcdir}/engdef1.1.d.rpmsave ]; then + mv -v %{ssletcdir}/engdef1.1.d.rpmsave/* %{ssletcdir}/engdef1.1.d ||: + rmdir %{ssletcdir}/engdef1.1.d.rpmsave ||: +fi + +# Move engines1_1.d to engines1.1.d +if [ -d %{ssletcdir}/engines1_1.d ]; then + mv -v %{ssletcdir}/engines1_1.d/* %{ssletcdir}/engines1.1.d ||: + rmdir %{ssletcdir}/engines1_1.d ||: +fi + +# Move engdef1_1.d to engdef1.1.d +if [ -d %{ssletcdir}/engdef1_1.d ]; then + mv -v %{ssletcdir}/engdef1_1.d/* %{ssletcdir}/engdef1.1.d ||: + rmdir %{ssletcdir}/engdef1_1.d ||: +fi + %post -n libopenssl1_1 -p /sbin/ldconfig %postun -n libopenssl1_1 -p /sbin/ldconfig diff --git a/openssl-CVE-2024-0727.patch b/openssl-CVE-2024-0727.patch new file mode 100644 index 0000000..8e0b906 --- /dev/null +++ b/openssl-CVE-2024-0727.patch @@ -0,0 +1,158 @@ +From 09df4395b5071217b76dc7d3d2e630eb8c5a79c2 Mon Sep 17 00:00:00 2001 +From: Matt Caswell +Date: Fri, 19 Jan 2024 11:28:58 +0000 +Subject: [PATCH] Add NULL checks where ContentInfo data can be NULL + +PKCS12 structures contain PKCS7 ContentInfo fields. These fields are +optional and can be NULL even if the "type" is a valid value. OpenSSL +was not properly accounting for this and a NULL dereference can occur +causing a crash. + +CVE-2024-0727 + +Reviewed-by: Tomas Mraz +Reviewed-by: Hugo Landau +Reviewed-by: Neil Horman +(Merged from https://github.com/openssl/openssl/pull/23362) + +(cherry picked from commit d135eeab8a5dbf72b3da5240bab9ddb7678dbd2c) +--- + crypto/pkcs12/p12_add.c | 18 ++++++++++++++++++ + crypto/pkcs12/p12_mutl.c | 5 +++++ + crypto/pkcs12/p12_npas.c | 5 +++-- + crypto/pkcs7/pk7_mime.c | 7 +++++-- + 4 files changed, 31 insertions(+), 4 deletions(-) + +Index: openssl-1.1.1w/crypto/pkcs12/p12_add.c +=================================================================== +--- openssl-1.1.1w.orig/crypto/pkcs12/p12_add.c ++++ openssl-1.1.1w/crypto/pkcs12/p12_add.c +@@ -76,6 +76,12 @@ STACK_OF(PKCS12_SAFEBAG) *PKCS12_unpack_ + PKCS12_R_CONTENT_TYPE_NOT_DATA); + return NULL; + } ++ ++ if (p7->d.data == NULL) { ++ PKCS12err(PKCS12_F_PKCS12_UNPACK_P7DATA, PKCS12_R_DECODE_ERROR); ++ return NULL; ++ } ++ + return ASN1_item_unpack(p7->d.data, ASN1_ITEM_rptr(PKCS12_SAFEBAGS)); + } + +@@ -132,6 +138,12 @@ STACK_OF(PKCS12_SAFEBAG) *PKCS12_unpack_ + { + if (!PKCS7_type_is_encrypted(p7)) + return NULL; ++ ++ if (p7->d.encrypted == NULL) { ++ PKCS12err(PKCS12_F_PKCS12_UNPACK_P7ENCDATA, PKCS12_R_DECODE_ERROR); ++ return NULL; ++ } ++ + return PKCS12_item_decrypt_d2i(p7->d.encrypted->enc_data->algorithm, + ASN1_ITEM_rptr(PKCS12_SAFEBAGS), + pass, passlen, +@@ -159,6 +171,13 @@ STACK_OF(PKCS7) *PKCS12_unpack_authsafes + PKCS12_R_CONTENT_TYPE_NOT_DATA); + return NULL; + } ++ ++ if (p12->authsafes->d.data == NULL) { ++ PKCS12err(PKCS12_F_PKCS12_UNPACK_AUTHSAFES, ++ PKCS12_R_DECODE_ERROR); ++ return NULL; ++ } ++ + return ASN1_item_unpack(p12->authsafes->d.data, + ASN1_ITEM_rptr(PKCS12_AUTHSAFES)); + } +Index: openssl-1.1.1w/crypto/pkcs12/p12_mutl.c +=================================================================== +--- openssl-1.1.1w.orig/crypto/pkcs12/p12_mutl.c ++++ openssl-1.1.1w/crypto/pkcs12/p12_mutl.c +@@ -93,6 +93,11 @@ static int pkcs12_gen_mac(PKCS12 *p12, c + return 0; + } + ++ if (p12->authsafes->d.data == NULL) { ++ PKCS12err(PKCS12_F_PKCS12_GEN_MAC, PKCS12_R_DECODE_ERROR); ++ return 0; ++ } ++ + salt = p12->mac->salt->data; + saltlen = p12->mac->salt->length; + if (!p12->mac->iter) +Index: openssl-1.1.1w/crypto/pkcs12/p12_npas.c +=================================================================== +--- openssl-1.1.1w.orig/crypto/pkcs12/p12_npas.c ++++ openssl-1.1.1w/crypto/pkcs12/p12_npas.c +@@ -78,8 +78,9 @@ static int newpass_p12(PKCS12 *p12, cons + bags = PKCS12_unpack_p7data(p7); + } else if (bagnid == NID_pkcs7_encrypted) { + bags = PKCS12_unpack_p7encdata(p7, oldpass, -1); +- if (!alg_get(p7->d.encrypted->enc_data->algorithm, +- &pbe_nid, &pbe_iter, &pbe_saltlen)) ++ if (p7->d.encrypted == NULL ++ || !alg_get(p7->d.encrypted->enc_data->algorithm, ++ &pbe_nid, &pbe_iter, &pbe_saltlen)) + goto err; + } else { + continue; +Index: openssl-1.1.1w/crypto/pkcs7/pk7_mime.c +=================================================================== +--- openssl-1.1.1w.orig/crypto/pkcs7/pk7_mime.c ++++ openssl-1.1.1w/crypto/pkcs7/pk7_mime.c +@@ -30,10 +30,13 @@ int SMIME_write_PKCS7(BIO *bio, PKCS7 *p + { + STACK_OF(X509_ALGOR) *mdalgs; + int ctype_nid = OBJ_obj2nid(p7->type); +- if (ctype_nid == NID_pkcs7_signed) ++ if (ctype_nid == NID_pkcs7_signed) { ++ if (p7->d.sign == NULL) ++ return 0; + mdalgs = p7->d.sign->md_algs; +- else ++ } else { + mdalgs = NULL; ++ } + + flags ^= SMIME_OLDMIME; + +Index: openssl-1.1.1w/crypto/err/openssl.txt +=================================================================== +--- openssl-1.1.1w.orig/crypto/err/openssl.txt ++++ openssl-1.1.1w/crypto/err/openssl.txt +@@ -1079,6 +1079,7 @@ PKCS12_F_PKCS12_SETUP_MAC:122:PKCS12_set + PKCS12_F_PKCS12_SET_MAC:123:PKCS12_set_mac + PKCS12_F_PKCS12_UNPACK_AUTHSAFES:130:PKCS12_unpack_authsafes + PKCS12_F_PKCS12_UNPACK_P7DATA:131:PKCS12_unpack_p7data ++PKCS12_F_PKCS12_UNPACK_P7ENCDATA:233:PKCS12_unpack_p7encdata + PKCS12_F_PKCS12_VERIFY_MAC:126:PKCS12_verify_mac + PKCS12_F_PKCS8_ENCRYPT:125:PKCS8_encrypt + PKCS12_F_PKCS8_SET0_PBE:132:PKCS8_set0_pbe +Index: openssl-1.1.1w/crypto/pkcs12/pk12err.c +=================================================================== +--- openssl-1.1.1w.orig/crypto/pkcs12/pk12err.c ++++ openssl-1.1.1w/crypto/pkcs12/pk12err.c +@@ -58,6 +58,8 @@ static const ERR_STRING_DATA PKCS12_str_ + "PKCS12_unpack_authsafes"}, + {ERR_PACK(ERR_LIB_PKCS12, PKCS12_F_PKCS12_UNPACK_P7DATA, 0), + "PKCS12_unpack_p7data"}, ++ {ERR_PACK(ERR_LIB_PKCS12, PKCS12_F_PKCS12_UNPACK_P7ENCDATA, 0), ++ "PKCS12_unpack_p7encdata"}, + {ERR_PACK(ERR_LIB_PKCS12, PKCS12_F_PKCS12_VERIFY_MAC, 0), + "PKCS12_verify_mac"}, + {ERR_PACK(ERR_LIB_PKCS12, PKCS12_F_PKCS8_ENCRYPT, 0), "PKCS8_encrypt"}, +Index: openssl-1.1.1w/include/openssl/pkcs12err.h +=================================================================== +--- openssl-1.1.1w.orig/include/openssl/pkcs12err.h ++++ openssl-1.1.1w/include/openssl/pkcs12err.h +@@ -49,6 +49,7 @@ int ERR_load_PKCS12_strings(void); + # define PKCS12_F_PKCS12_SET_MAC 123 + # define PKCS12_F_PKCS12_UNPACK_AUTHSAFES 130 + # define PKCS12_F_PKCS12_UNPACK_P7DATA 131 ++# define PKCS12_F_PKCS12_UNPACK_P7ENCDATA 233 + # define PKCS12_F_PKCS12_VERIFY_MAC 126 + # define PKCS12_F_PKCS8_ENCRYPT 125 + # define PKCS12_F_PKCS8_SET0_PBE 132