Commit Graph

168 Commits

Author SHA256 Message Date
Ana Guerrero
4b12eccbeb Accepting request 1146592 from security:tls
Automatic submission by obs-autosubmit

OBS-URL: https://build.opensuse.org/request/show/1146592
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/openssl-1_1?expand=0&rev=58
2024-02-15 19:59:15 +00:00
Ana Guerrero
6ec88babc3 Accepting request 1144566 from security:tls
OBS-URL: https://build.opensuse.org/request/show/1144566
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/openssl-1_1?expand=0&rev=57
2024-02-08 18:01:57 +00:00
Otto Hollmann
153dccd656 Accepting request 1144956 from home:pmonrealgonzalez:branches:security:tls
- Enable running the regression tests in FIPS mode.

OBS-URL: https://build.opensuse.org/request/show/1144956
OBS-URL: https://build.opensuse.org/package/show/security:tls/openssl-1_1?expand=0&rev=157
2024-02-07 15:55:49 +00:00
Otto Hollmann
d7adac4e7f Accepting request 1144565 from home:ohollmann:branches:security:tls
- Rename engines directories to the same name like in SLE:
    /etc/ssl/engines1_1.d -> /etc/ssl/engines1.1.d
    /etc/ssl/engdef1_1.d -> /etc/ssl/engdef1.1.d
  * Add migration script to move files (bsc#1219562)
    /etc/ssl/engines.d/* -> /etc/ssl/engines1.1.d
    /etc/ssl/engdef.d/* -> /etc/ssl/engdef1.1.d

- Security fix: [bsc#1219243, CVE-2024-0727]
  * Add NULL checks where ContentInfo data can be NULL
  * Add openssl-CVE-2024-0727.patch

OBS-URL: https://build.opensuse.org/request/show/1144565
OBS-URL: https://build.opensuse.org/package/show/security:tls/openssl-1_1?expand=0&rev=156
2024-02-06 12:52:41 +00:00
Ana Guerrero
428491c2b0 Accepting request 1141238 from security:tls
OBS-URL: https://build.opensuse.org/request/show/1141238
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/openssl-1_1?expand=0&rev=56
2024-01-25 17:39:52 +00:00
11b0eddfc3 Accepting request 1141235 from home:ohollmann:branches:security:tls
- Because OpenSSL 1.1.1 is no longer default, let's rename engine
  directories to contain version of OpenSSL and let unversioned for
  the default OpenSSL. [bsc#1194187, bsc#1207472, bsc#1218933]
  * /etc/ssl/engines.d ->  /etc/ssl/engines1_1.d
  * /etc/ssl/engdef.d -> /etc/ssl/engdef1_1.d
  * Update patches:
    - openssl-1_1-ossl-sli-002-ran-make-update.patch
    - openssl-1_1-use-include-directive.patch

OBS-URL: https://build.opensuse.org/request/show/1141235
OBS-URL: https://build.opensuse.org/package/show/security:tls/openssl-1_1?expand=0&rev=154
2024-01-24 12:36:49 +00:00
Ana Guerrero
b7632f2b6b Accepting request 1130033 from security:tls
Automatic submission by obs-autosubmit

OBS-URL: https://build.opensuse.org/request/show/1130033
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/openssl-1_1?expand=0&rev=55
2023-12-01 20:24:50 +00:00
Otto Hollmann
f18ebf3adf Accepting request 1128352 from home:ohollmann:branches:security:tls
- Skip SHA1 test in 20-test_dgst.t when in FIPS mode
  * Add openssl-Skip_SHA1-test-in-FIPS-mode.patch
- FIPS: add openssl-1_1-fips-bsc1190652_release_num_in_version_string.patch
  * bsc#1190652 - Provide a service to output module name/identifier
    and version
- Sync patches with SLE:
  * Merge openssl-keep_EVP_KDF_functions_version.patch into
    openssl-1.1.1-evp-kdf.patch
  * Refresh openssl-1_1-fips-bsc1215215_fips_in_version_string.patch
  * Remove openssl-no-date.patch

OBS-URL: https://build.opensuse.org/request/show/1128352
OBS-URL: https://build.opensuse.org/package/show/security:tls/openssl-1_1?expand=0&rev=152
2023-11-23 14:31:37 +00:00
Ana Guerrero
2e9c11df10 Accepting request 1126787 from security:tls
- Security fix: [bsc#1216922, CVE-2023-5678]
  * Fix excessive time spent in DH check / generation with large Q
    parameter value.
  * Applications that use the functions DH_generate_key() to generate
    an X9.42 DH key may experience long delays. Likewise,
    applications that use DH_check_pub_key(), DH_check_pub_key_ex
    () or EVP_PKEY_public_check() to check an X9.42 DH key or X9.42
    DH parameters may experience long delays. Where the key or
    parameters that are being checked have been obtained from an
    untrusted source this may lead to a Denial of Service.
  * Add openssl-CVE-2023-5678.patch
- Remove trailing spaces from changelog

- Remove a hack for bsc#936563
  bsc936563_hack.patch (bsc#936563)
- Build with no-ssl3, for details on why this is needed read
  require us to patch dependant packages as the relevant
  functions are still available (SSLv3_(client|server)_method)
- openssl.keyring: use Matt Caswells current key.
- openSSL 1.0.1j
- openssl.keyring: the 1.0.1i release was done by
- 012-Fix-eckey_priv_encode.patch eckey_priv_encode should
- 0001-Axe-builtin-printf-implementation-use-glibc-instead.patch
  it is already in RPM_OPT_FLAGS and is replaced by
- Remove the "gmp" and "capi" shared engines, nobody noticed
  but they are just dummies that do nothing.
- Use enable-rfc3779 to allow projects such as rpki.net
- openssl-buffreelistbug-aka-CVE-2010-5298.patch fix
- openssl-gcc-attributes.patch: fix thinko, CRYPTO_realloc_clean does
- openssl-gcc-attributes.patch

OBS-URL: https://build.opensuse.org/request/show/1126787
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/openssl-1_1?expand=0&rev=54
2023-11-17 19:48:11 +00:00
Otto Hollmann
6a02bab132 Accepting request 1126087 from home:ohollmann:branches:security:tls
- Security fix: [bsc#1216922, CVE-2023-5678]
  * Fix excessive time spent in DH check / generation with large Q
    parameter value.
  * Applications that use the functions DH_generate_key() to generate
    an X9.42 DH key may experience long delays. Likewise,
    applications that use DH_check_pub_key(), DH_check_pub_key_ex
    () or EVP_PKEY_public_check() to check an X9.42 DH key or X9.42
    DH parameters may experience long delays. Where the key or
    parameters that are being checked have been obtained from an
    untrusted source this may lead to a Denial of Service.
  * Add openssl-CVE-2023-5678.patch
- Remove trailing spaces from changelog

- Remove a hack for bsc#936563
  bsc936563_hack.patch (bsc#936563)
- Build with no-ssl3, for details on why this is needed read
  require us to patch dependant packages as the relevant
  functions are still available (SSLv3_(client|server)_method)
- openssl.keyring: use Matt Caswells current key.
- openSSL 1.0.1j
- openssl.keyring: the 1.0.1i release was done by
- 012-Fix-eckey_priv_encode.patch eckey_priv_encode should
- 0001-Axe-builtin-printf-implementation-use-glibc-instead.patch
  it is already in RPM_OPT_FLAGS and is replaced by
- Remove the "gmp" and "capi" shared engines, nobody noticed
  but they are just dummies that do nothing.
- Use enable-rfc3779 to allow projects such as rpki.net
- openssl-buffreelistbug-aka-CVE-2010-5298.patch fix
- openssl-gcc-attributes.patch: fix thinko, CRYPTO_realloc_clean does
- openssl-gcc-attributes.patch

OBS-URL: https://build.opensuse.org/request/show/1126087
OBS-URL: https://build.opensuse.org/package/show/security:tls/openssl-1_1?expand=0&rev=150
2023-11-15 09:54:14 +00:00
Ana Guerrero
c5f7b4fa0d Accepting request 1120190 from security:tls
OBS-URL: https://build.opensuse.org/request/show/1120190
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/openssl-1_1?expand=0&rev=53
2023-10-26 15:12:05 +00:00
Otto Hollmann
b51c004cd8 Accepting request 1119558 from home:ohollmann:branches:security:tls
- Performance enhancements for cryptography from OpenSSL 3.x
  [jsc#PED-5086, jsc#PED-3514]
  * Add patches:
    - openssl-ec-Use-static-linkage-on-nistp521-felem_-square-mul-.patch
    - openssl-ec-56-bit-Limb-Solinas-Strategy-for-secp384r1.patch
    - openssl-ec-powerpc64le-Add-asm-implementation-of-felem_-squa.patch
    - openssl-ecc-Remove-extraneous-parentheses-in-secp384r1.patch
    - openssl-powerpc-ecc-Fix-stack-allocation-secp384r1-asm.patch
    - openssl-Improve-performance-for-6x-unrolling-with-vpermxor-i.patch

OBS-URL: https://build.opensuse.org/request/show/1119558
OBS-URL: https://build.opensuse.org/package/show/security:tls/openssl-1_1?expand=0&rev=148
2023-10-25 07:52:22 +00:00
Ana Guerrero
9bf9d51b0a Accepting request 1116068 from security:tls
OBS-URL: https://build.opensuse.org/request/show/1116068
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/openssl-1_1?expand=0&rev=52
2023-10-08 10:17:11 +00:00
Otto Hollmann
861b7f632f Accepting request 1116067 from home:ohollmann:branches:security:tls
- Displays "fips" in the version string (bsc#1215215)
  * Add openssl-1_1-fips-bsc1215215_fips_in_version_string.patch

OBS-URL: https://build.opensuse.org/request/show/1116067
OBS-URL: https://build.opensuse.org/package/show/security:tls/openssl-1_1?expand=0&rev=146
2023-10-06 13:41:55 +00:00
Ana Guerrero
73c9c30222 Accepting request 1111406 from security:tls
OBS-URL: https://build.opensuse.org/request/show/1111406
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/openssl-1_1?expand=0&rev=51
2023-09-17 17:28:45 +00:00
8f01c56ec8 Accepting request 1111331 from home:ohollmann:branches:security:tls
- Update to 1.1.1w:
 * Fix POLY1305 MAC implementation corrupting XMM registers on Windows.
   The POLY1305 MAC (message authentication code) implementation in OpenSSL
   does not save the contents of non-volatile XMM registers on Windows 64
   platform when calculating the MAC of data larger than 64 bytes. Before
   returning to the caller all the XMM registers are set to zero rather than
   restoring their previous content. The vulnerable code is used only on newer
   x86_64 processors supporting the AVX512-IFMA instructions.
   The consequences of this kind of internal application state corruption can
   be various - from no consequences, if the calling application does not
   depend on the contents of non-volatile XMM registers at all, to the worst
   consequences, where the attacker could get complete control of the
   application process. However given the contents of the registers are just
   zeroized so the attacker cannot put arbitrary values inside, the most likely
   consequence, if any, would be an incorrect result of some application
   dependent calculations or a crash leading to a denial of service.
   (CVE-2023-4807)

- Add missing FIPS patches from SLE:
  * Add patches:
    - bsc1185319-FIPS-KAT-for-ECDSA.patch
    - bsc1198207-FIPS-add-hash_hmac-drbg-kat.patch
    - openssl-1.1.1-fips-fix-memory-leaks.patch
    - openssl-1_1-FIPS-PBKDF2-KAT-requirements.patch
    - openssl-1_1-FIPS_drbg-rewire.patch
    - openssl-1_1-Zeroization.patch
    - openssl-1_1-fips-drbg-selftest.patch
    - openssl-1_1-fips-list-only-approved-digest-and-pubkey-algorithms.patch
    - openssl-1_1-jitterentropy-3.4.0.patch
    - openssl-1_1-ossl-sli-000-fix-build-error.patch

OBS-URL: https://build.opensuse.org/request/show/1111331
OBS-URL: https://build.opensuse.org/package/show/security:tls/openssl-1_1?expand=0&rev=144
2023-09-14 19:44:42 +00:00
Dominique Leuenberger
19fa66a431 Accepting request 1101937 from security:tls
OBS-URL: https://build.opensuse.org/request/show/1101937
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/openssl-1_1?expand=0&rev=50
2023-08-02 14:48:14 +00:00
5c433ba865 Accepting request 1101936 from home:pmonrealgonzalez:branches:security:tls
* Update openssl.keyring with the OTC members that sign releases

OBS-URL: https://build.opensuse.org/request/show/1101936
OBS-URL: https://build.opensuse.org/package/show/security:tls/openssl-1_1?expand=0&rev=142
2023-08-02 10:17:50 +00:00
f8ec18178a Accepting request 1101915 from home:pmonrealgonzalez:branches:security:tls
- Update to 1.1.1v:
  * Fix excessive time spent checking DH q parameter value
    (bsc#1213853, CVE-2023-3817). The function DH_check() performs
    various checks on DH parameters. After fixing CVE-2023-3446 it
    was discovered that a large q parameter value can also trigger
    an overly long computation during some of these checks. A
    correct q value, if present, cannot be larger than the modulus
    p parameter, thus it is unnecessary to perform these checks if
    q is larger than p. If DH_check() is called with such q parameter
    value, DH_CHECK_INVALID_Q_VALUE return flag is set and the
    computationally intensive checks are skipped.
  * Fix DH_check() excessive time with over sized modulus
    (bsc#1213487, CVE-2023-3446). The function DH_check() performs
    various checks on DH parameters. One of those checks confirms
    that the modulus ("p" parameter) is not too large. Trying to use
    a very large modulus is slow and OpenSSL will not normally use
    a modulus which is over 10,000 bits in length. However the
    DH_check() function checks numerous aspects of the key or
    parameters that have been supplied. Some of those checks use the
    supplied modulus value even if it has already been found to be
    too large. A new limit has been added to DH_check of 32,768 bits.
    Supplying a key/parameters with a modulus over this size will
    simply cause DH_check() to fail.
  * Rebase openssl-1_1-openssl-config.patch
  * Remove security patches fixed upstream:
    - openssl-CVE-2023-3446.patch
    - openssl-CVE-2023-3446-test.patch

OBS-URL: https://build.opensuse.org/request/show/1101915
OBS-URL: https://build.opensuse.org/package/show/security:tls/openssl-1_1?expand=0&rev=141
2023-08-02 10:03:45 +00:00
Otto Hollmann
a620e0aeaf Accepting request 1100559 from home:ohollmann:branches:security:tls
- Dont pass zero length input to EVP_Cipher because assembler
  optimized AES cannot handle zero size. [bsc#1213517]
  * Add openssl-dont-pass-zero-length-input-to-EVP_Cipher.patch

OBS-URL: https://build.opensuse.org/request/show/1100559
OBS-URL: https://build.opensuse.org/package/show/security:tls/openssl-1_1?expand=0&rev=140
2023-07-25 08:04:18 +00:00
Ana Guerrero
eacff36a04 Accepting request 1099670 from security:tls
OBS-URL: https://build.opensuse.org/request/show/1099670
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/openssl-1_1?expand=0&rev=49
2023-07-24 16:12:06 +00:00
2f6ae03793 Accepting request 1099668 from home:pmonrealgonzalez:branches:security:tls
- Security fix: [bsc#1213487, CVE-2023-3446]
  * Fix DH_check() excessive time with over sized modulus.
  * The function DH_check() performs various checks on DH parameters.
    One of those checks confirms that the modulus ("p" parameter) is
    not too large. Trying to use a very large modulus is slow and
    OpenSSL will not normally use a modulus which is over 10,000 bits
    in length.
    However the DH_check() function checks numerous aspects of the
    key or parameters that have been supplied. Some of those checks
    use the supplied modulus value even if it has already been found
    to be too large.
    A new limit has been added to DH_check of 32,768 bits. Supplying
    a key/parameters with a modulus over this size will simply cause
    DH_check() to fail.
  * Add openssl-CVE-2023-3446.patch openssl-CVE-2023-3446-test.patch

OBS-URL: https://build.opensuse.org/request/show/1099668
OBS-URL: https://build.opensuse.org/package/show/security:tls/openssl-1_1?expand=0&rev=139
2023-07-20 08:42:02 +00:00
Dominique Leuenberger
62282c4f2b Accepting request 1095762 from security:tls
Reintroduce change, sync with openssl 3.0

OBS-URL: https://build.opensuse.org/request/show/1095762
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/openssl-1_1?expand=0&rev=48
2023-06-29 15:27:51 +00:00
Dominique Leuenberger
6de92f70b8 Revert; change needs to be synced with openssl 3.0 update
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/openssl-1_1?expand=0&rev=47
2023-06-28 08:21:17 +00:00
Dominique Leuenberger
2f3c226fb9 Accepting request 1095609 from security:tls
- Improve cross-package provides/conflicts [boo#1210313]
  * Add Provides/Conflicts: ssl-devel
  * Remove explicit conflicts with other devel-libraries

OBS-URL: https://build.opensuse.org/request/show/1095609
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/openssl-1_1?expand=0&rev=46
2023-06-27 21:16:16 +00:00
Otto Hollmann
effdf84ffa Accepting request 1094355 from security:tls:unstable
- Improve cross-package provides/conflicts [boo#1210313]
  * Add Provides/Conflicts: ssl-devel
  * Remove explicit conflicts with other devel-libraries

OBS-URL: https://build.opensuse.org/request/show/1094355
OBS-URL: https://build.opensuse.org/package/show/security:tls/openssl-1_1?expand=0&rev=136
2023-06-21 13:11:59 +00:00
Dominique Leuenberger
28cda60acd Accepting request 1089973 from security:tls
- Update to 1.1.1u:
  * Mitigate for the time it takes for `OBJ_obj2txt` to translate gigantic
    OBJECT IDENTIFIER sub-identifiers to canonical numeric text form.
    OBJ_obj2txt() would translate any size OBJECT IDENTIFIER to canonical
    numeric text form.  For gigantic sub-identifiers, this would take a very
    long time, the time complexity being O(n^2) where n is the size of that
    sub-identifier.  (CVE-2023-2650, bsc#1211430)
    To mitigitate this, `OBJ_obj2txt()` will only translate an OBJECT
    IDENTIFIER to canonical numeric text form if the size of that OBJECT
    IDENTIFIER is 586 bytes or less, and fail otherwise.
    The basis for this restriction is RFC 2578 (STD 58), section 3.5. OBJECT
    IDENTIFIER values, which stipulates that OBJECT IDENTIFIERS may have at
    most 128 sub-identifiers, and that the maximum value that each sub-
    identifier may have is 2^32-1 (4294967295 decimal).
    For each byte of every sub-identifier, only the 7 lower bits are part of
    the value, so the maximum amount of bytes that an OBJECT IDENTIFIER with
    these restrictions may occupy is 32 * 128 / 7, which is approximately 586
    bytes.
    Ref: https://datatracker.ietf.org/doc/html/rfc2578#section-3.5
  * Reworked the Fix for the Timing Oracle in RSA Decryption
    (CVE-2022-4304, bsc#1207534). The previous fix for this timing side
    channel turned out to cause a severe 2-3x performance regression in the
    typical use case compared to 1.1.1s. The new fix uses existing constant
    time code paths, and restores the previous performance level while fully
    eliminating all existing timing side channels. The fix was developed by
    Bernd Edlinger with testing support by Hubert Kario.
  * Corrected documentation of X509_VERIFY_PARAM_add0_policy() to mention that
    it does not enable policy checking. Thanks to David Benjamin for
    discovering this issue. (CVE-2023-0466, bsc#1209873)
  * Fixed an issue where invalid certificate policies in leaf certificates are

OBS-URL: https://build.opensuse.org/request/show/1089973
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/openssl-1_1?expand=0&rev=45
2023-06-02 22:06:18 +00:00
Otto Hollmann
7cf818f410 Accepting request 1089971 from security:tls:unstable
OBS-URL: https://build.opensuse.org/request/show/1089971
OBS-URL: https://build.opensuse.org/package/show/security:tls/openssl-1_1?expand=0&rev=134
2023-05-31 09:13:51 +00:00
Dominique Leuenberger
db074c08d6 Accepting request 1077221 from security:tls
- Security Fix: [CVE-2023-0465, bsc#1209878]
  * Invalid certificate policies in leaf certificates are silently ignored
  * Add openssl-CVE-2023-0465.patch
- Security Fix: [CVE-2023-0466, bsc#1209873]
  * Certificate policy check not enabled
  * Add openssl-CVE-2023-0466.patch

OBS-URL: https://build.opensuse.org/request/show/1077221
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/openssl-1_1?expand=0&rev=44
2023-04-06 13:55:53 +00:00
Otto Hollmann
1d1d2b5e7a Accepting request 1076892 from home:ohollmann:branches:security:tls-tmp
- Security Fix: [CVE-2023-0465, bsc#1209878]
  * Invalid certificate policies in leaf certificates are silently ignored
  * Add openssl-CVE-2023-0465.patch
- Security Fix: [CVE-2023-0466, bsc#1209873]
  * Certificate policy check not enabled
  * Add openssl-CVE-2023-0466.patch

OBS-URL: https://build.opensuse.org/request/show/1076892
OBS-URL: https://build.opensuse.org/package/show/security:tls/openssl-1_1?expand=0&rev=132
2023-04-03 11:03:23 +00:00
Dominique Leuenberger
42076e4ce0 Accepting request 1074722 from security:tls
- Security Fix: [CVE-2023-0464, bsc#1209624]
  * Excessive Resource Usage Verifying X.509 Policy Constraints
  * Add openssl-CVE-2023-0464.patch

OBS-URL: https://build.opensuse.org/request/show/1074722
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/openssl-1_1?expand=0&rev=43
2023-03-29 21:26:47 +00:00
Otto Hollmann
ba8c5e2a55 Accepting request 1074654 from home:ohollmann:branches:security:tls-tmp
- Security Fix: [CVE-2023-0464, bsc#1209624]
  * Excessive Resource Usage Verifying X.509 Policy Constraints
  * Add openssl-CVE-2023-0464.patch

OBS-URL: https://build.opensuse.org/request/show/1074654
OBS-URL: https://build.opensuse.org/package/show/security:tls/openssl-1_1?expand=0&rev=130
2023-03-27 11:57:25 +00:00
Dominique Leuenberger
4377a5e5ee Accepting request 1063743 from security:tls
- Update to 1.1.1t:
  * Fixed X.400 address type confusion in X.509 GeneralName.
    There is a type confusion vulnerability relating to X.400 address processing
    inside an X.509 GeneralName. X.400 addresses were parsed as an ASN1_STRING
    but subsequently interpreted by GENERAL_NAME_cmp as an ASN1_TYPE. This
    vulnerability may allow an attacker who can provide a certificate chain and
    CRL (neither of which need have a valid signature) to pass arbitrary
    pointers to a memcmp call, creating a possible read primitive, subject to
    some constraints. Refer to the advisory for more information. Thanks to
    David Benjamin for discovering this issue. [bsc#1207533, CVE-2023-0286]
    This issue has been fixed by changing the public header file definition of
    GENERAL_NAME so that x400Address reflects the implementation. It was not
    possible for any existing application to successfully use the existing
    definition; however, if any application references the x400Address field
    (e.g. in dead code), note that the type of this field has changed. There is
    no ABI change.
  * Fixed Use-after-free following BIO_new_NDEF.
    The public API function BIO_new_NDEF is a helper function used for
    streaming ASN.1 data via a BIO. It is primarily used internally to OpenSSL
    to support the SMIME, CMS and PKCS7 streaming capabilities, but may also
    be called directly by end user applications.
    The function receives a BIO from the caller, prepends a new BIO_f_asn1
    filter BIO onto the front of it to form a BIO chain, and then returns
    the new head of the BIO chain to the caller. Under certain conditions,
    for example if a CMS recipient public key is invalid, the new filter BIO
    is freed and the function returns a NULL result indicating a failure.
    However, in this case, the BIO chain is not properly cleaned up and the
    BIO passed by the caller still retains internal pointers to the previously
    freed filter BIO. If the caller then goes on to call BIO_pop() on the BIO
    then a use-after-free will occur. This will most likely result in a crash.

OBS-URL: https://build.opensuse.org/request/show/1063743
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/openssl-1_1?expand=0&rev=42
2023-02-14 15:44:47 +00:00
Otto Hollmann
8fb8948616 Accepting request 1063668 from home:ohollmann:branches:security:tls
- Update to 1.1.1t:
  * Fixed X.400 address type confusion in X.509 GeneralName.
    There is a type confusion vulnerability relating to X.400 address processing
    inside an X.509 GeneralName. X.400 addresses were parsed as an ASN1_STRING
    but subsequently interpreted by GENERAL_NAME_cmp as an ASN1_TYPE. This
    vulnerability may allow an attacker who can provide a certificate chain and
    CRL (neither of which need have a valid signature) to pass arbitrary
    pointers to a memcmp call, creating a possible read primitive, subject to
    some constraints. Refer to the advisory for more information. Thanks to
    David Benjamin for discovering this issue. [bsc#1207533, CVE-2023-0286]
    This issue has been fixed by changing the public header file definition of
    GENERAL_NAME so that x400Address reflects the implementation. It was not
    possible for any existing application to successfully use the existing
    definition; however, if any application references the x400Address field
    (e.g. in dead code), note that the type of this field has changed. There is
    no ABI change.
  * Fixed Use-after-free following BIO_new_NDEF.
    The public API function BIO_new_NDEF is a helper function used for
    streaming ASN.1 data via a BIO. It is primarily used internally to OpenSSL
    to support the SMIME, CMS and PKCS7 streaming capabilities, but may also
    be called directly by end user applications.
    The function receives a BIO from the caller, prepends a new BIO_f_asn1
    filter BIO onto the front of it to form a BIO chain, and then returns
    the new head of the BIO chain to the caller. Under certain conditions,
    for example if a CMS recipient public key is invalid, the new filter BIO
    is freed and the function returns a NULL result indicating a failure.
    However, in this case, the BIO chain is not properly cleaned up and the
    BIO passed by the caller still retains internal pointers to the previously
    freed filter BIO. If the caller then goes on to call BIO_pop() on the BIO
    then a use-after-free will occur. This will most likely result in a crash.

OBS-URL: https://build.opensuse.org/request/show/1063668
OBS-URL: https://build.opensuse.org/package/show/security:tls/openssl-1_1?expand=0&rev=128
2023-02-08 08:03:11 +00:00
Dominique Leuenberger
11ddbc986a Accepting request 1062225 from security:tls
OBS-URL: https://build.opensuse.org/request/show/1062225
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/openssl-1_1?expand=0&rev=41
2023-02-02 17:08:04 +00:00
6d27aa3f13 Accepting request 1062217 from security:tls:unstable
- Set OpenSSL 3.0 as the default openssl [bsc#1205042]
  * For compatibility with OpenSSL 3.0, the OpenSSL master
    configuration file openssl.cnf has been renamed to
    openssl-1_1.cnf. The executables openssl, c_rehash, CA.pl and
    tsget.pl have been also renamed to openssl-1_1, c_rehash-1_1,
    CA-1_1.pl and tsget-1_1.pl, respectively.
  * Add openssl-1_1-devel as conflicting with libopenssl-3-devel
  * Add openssl-1_1-openssl-config.patch

OBS-URL: https://build.opensuse.org/request/show/1062217
OBS-URL: https://build.opensuse.org/package/show/security:tls/openssl-1_1?expand=0&rev=126
2023-01-31 12:15:21 +00:00
Dominique Leuenberger
1db74d6acf Accepting request 1042988 from security:tls
OBS-URL: https://build.opensuse.org/request/show/1042988
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/openssl-1_1?expand=0&rev=40
2022-12-18 16:22:17 +00:00
93c266235b Accepting request 1042984 from home:ohollmann:branches:security:tls
OBS-URL: https://build.opensuse.org/request/show/1042984
OBS-URL: https://build.opensuse.org/package/show/security:tls/openssl-1_1?expand=0&rev=124
2022-12-14 20:20:45 +00:00
Otto Hollmann
0ce74d253b Accepting request 1042846 from home:ohollmann:branches:security:tls
- POWER10 performance enhancements for cryptography [jsc#PED-512]
  * openssl-1_1-AES-GCM-performance-optimzation-with-stitched-method.patch
  * openssl-1_1-Fixed-counter-overflow.patch
  * openssl-1_1-chacha20-performance-optimizations-for-ppc64le-with-.patch
  * openssl-1_1-Fixed-conditional-statement-testing-64-and-256-bytes.patch
  * openssl-1_1-Fix-AES-GCM-on-Power-8-CPUs.patch

OBS-URL: https://build.opensuse.org/request/show/1042846
OBS-URL: https://build.opensuse.org/package/show/security:tls/openssl-1_1?expand=0&rev=123
2022-12-14 09:46:30 +00:00
Dominique Leuenberger
48848f012a Accepting request 1032895 from security:tls
OBS-URL: https://build.opensuse.org/request/show/1032895
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/openssl-1_1?expand=0&rev=39
2022-11-03 18:12:58 +00:00
4cf96f27f1 Accepting request 1032887 from home:ohollmann:branches:security:tls
- Updated openssl.keyring with key A21FAB74B0088AA361152586B8EF1A6BA9DA2D5C
- Update to 1.1.1s:
  * Fixed a regression introduced in 1.1.1r version not refreshing the
    certificate data to be signed before signing the certificate.
- Update to 1.1.1r:
  * Fixed the linux-mips64 Configure target which was missing the
    SIXTY_FOUR_BIT bn_ops flag. This was causing heap corruption on that
    platform.
  * Fixed a strict aliasing problem in bn_nist. Clang-14 optimisation was
    causing incorrect results in some cases as a result.
  * Fixed SSL_pending() and SSL_has_pending() with DTLS which were failing to
    report correct results in some cases
  * Fixed a regression introduced in 1.1.1o for re-signing certificates with
    different key sizes
  * Added the loongarch64 target
  * Fixed a DRBG seed propagation thread safety issue
  * Fixed a memory leak in tls13_generate_secret
  * Fixed reported performance degradation on aarch64. Restored the
    implementation prior to commit 2621751 ("aes/asm/aesv8-armx.pl: avoid
    32-bit lane assignment in CTR mode") for 64bit targets only, since it is
    reportedly 2-17% slower and the silicon errata only affects 32bit targets.
    The new algorithm is still used for 32 bit targets.
  * Added a missing header for memcmp that caused compilation failure on some
    platforms

OBS-URL: https://build.opensuse.org/request/show/1032887
OBS-URL: https://build.opensuse.org/package/show/security:tls/openssl-1_1?expand=0&rev=121
2022-11-02 13:56:40 +00:00
Richard Brown
f932996074 Accepting request 1007224 from security:tls
OBS-URL: https://build.opensuse.org/request/show/1007224
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/openssl-1_1?expand=0&rev=38
2022-10-01 15:41:27 +00:00
ba6be953da Accepting request 1007029 from home:ohollmann:branches:home:jsikes:branches:security:tls
- Added openssl-1_1-paramgen-default_to_rfc7919.patch
  * bsc#1180995
  * Default to RFC7919 groups when generating ECDH parameters
    using 'genpkey' or 'dhparam' in FIPS mode.

OBS-URL: https://build.opensuse.org/request/show/1007029
OBS-URL: https://build.opensuse.org/package/show/security:tls/openssl-1_1?expand=0&rev=119
2022-09-30 10:26:12 +00:00
Dominique Leuenberger
c72c767e80 Accepting request 987305 from security:tls
OBS-URL: https://build.opensuse.org/request/show/987305
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/openssl-1_1?expand=0&rev=37
2022-07-08 12:01:24 +00:00
Jason Sikes
bc10d3dbd2 Accepting request 987301 from home:jsikes:branches:security:tls
Fixed CVE-2022-2097. Enjoy!

OBS-URL: https://build.opensuse.org/request/show/987301
OBS-URL: https://build.opensuse.org/package/show/security:tls/openssl-1_1?expand=0&rev=117
2022-07-07 02:51:21 +00:00
Jason Sikes
71b469adbb Accepting request 985766 from home:Andreas_Schwab:Factory
- openssl-riscv64-config.patch: backport of riscv64 config support

OBS-URL: https://build.opensuse.org/request/show/985766
OBS-URL: https://build.opensuse.org/package/show/security:tls/openssl-1_1?expand=0&rev=116
2022-07-07 02:47:54 +00:00
Dominique Leuenberger
32bcc01e6d Accepting request 985235 from security:tls
OBS-URL: https://build.opensuse.org/request/show/985235
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/openssl-1_1?expand=0&rev=36
2022-06-28 13:21:07 +00:00
Jason Sikes
282de1dff4 Accepting request 984626 from home:jsikes:branches:security:tls
update to 1.1.1p. Enjoy!

OBS-URL: https://build.opensuse.org/request/show/984626
OBS-URL: https://build.opensuse.org/package/show/security:tls/openssl-1_1?expand=0&rev=114
2022-06-27 07:21:15 +00:00
Dominique Leuenberger
af41bdf3bd Accepting request 981089 from security:tls
- Update to 1.1.1o: [CVE-2022-1292, bsc#1199166]
  * Fixed a bug in the c_rehash script which was not properly sanitising
    shell metacharacters to prevent command injection.
  * Rebased openssl-s390x-assembly-pack-add-OPENSSL_s390xcap-environment.patch
  * Rebased openssl-s390x-assembly-pack-add-support-for-pcc-and-kma-inst.patch
- Added openssl-update_expired_certificates.patch
  * Openssl failed tests because of expired certificates.
  * bsc#1185637
  * Sourced from https://github.com/openssl/openssl/pull/18446/commits

OBS-URL: https://build.opensuse.org/request/show/981089
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/openssl-1_1?expand=0&rev=35
2022-06-09 12:09:46 +00:00
9e96c4741f OBS-URL: https://build.opensuse.org/package/show/security:tls/openssl-1_1?expand=0&rev=112 2022-06-07 06:45:15 +00:00