openssl-3/openssl-3.0.7.tar.gz.asc

Accepting request 1032747 from home:ohollmann:branches:security:tls - Temporary disable tests test_ssl_new and test_sslapi because they are failing in openSUSE_Tumbleweed - Update to 3.0.7: [bsc#1204714, CVE-2022-3602,CVE-2022-3786] * Fixed two buffer overflows in punycode decoding functions. A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after certificate chain signature verification and requires either a CA to have signed the malicious certificate or for the application to continue certificate verification despite failure to construct a path to a trusted issuer. In a TLS client, this can be triggered by connecting to a malicious server. In a TLS server, this can be triggered if the server requests client authentication and a malicious client connects. An attacker can craft a malicious email address to overflow an arbitrary number of bytes containing the `.` character (decimal 46) on the stack. This buffer overflow could result in a crash (causing a denial of service). ([CVE-2022-3786]) An attacker can craft a malicious email address to overflow four attacker-controlled bytes on the stack. This buffer overflow could result in a crash (causing a denial of service) or potentially remote code execution depending on stack layout for any given platform/compiler. ([CVE-2022-3602]) * Removed all references to invalid OSSL_PKEY_PARAM_RSA names for CRT parameters in OpenSSL code. Applications should not use the names OSSL_PKEY_PARAM_RSA_FACTOR, OSSL_PKEY_PARAM_RSA_EXPONENT and OSSL_PKEY_PARAM_RSA_COEFFICIENT. Use the numbered names such as OSSL_PKEY_PARAM_RSA_FACTOR1 instead. Using these invalid names may cause algorithms to use slower methods OBS-URL: https://build.opensuse.org/request/show/1032747 OBS-URL: https://build.opensuse.org/package/show/security:tls/openssl-3?expand=0&rev=47 2022-11-01 21:31:17 +01:00			`-----BEGIN PGP SIGNATURE-----`

			`iQJGBAABCAAwFiEE3HAyZir4heL0fyQ/UnRmohynnm0FAmNhKfISHHRvbWFzQG9w`
			`ZW5zc2wub3JnAAoJEFJ0ZqIcp55tQ84P/3vLj5HFHCSjkdthzR+sdxD+ndrdjOgT`
			`ToEGqkAntayT8eVwcWNTum71JNc3XCZZEa3KvuvuiK7+emYAhk+zV/R0obyKnNqu`
			`it7ZbhMxgWfJnXYIz6aOAZQMYyMr2EFazd5avnR4lY3DkGdvdKC/Gwx7WT+KvOZN`
			`xsrYEkupa23VFdah/pcaR+3FIYRPBn5Y8qwRIpXsPm8GZMHbJF2N4BpTEQFuwZtQ`
			`RuHnNheqeJp9DFMcGQdjYU7GTSEL8sh1QgwG+WFp0zVUWoPMzb7IfGRXQK4SHuE4`
			`qPcQOT7X7nwiFgQGDYClzlkCyduX0LCJMBl+QMOoYTj/HjXejgucrKSlZpInsfD5`
			`jAm1vyX0SKNaQ5mAXOmruBcztDAsag+XedmLlodZMgjBp3wyq8VyY2dg/EQXCHtn`
			`B/K3vJJj9kJADYD0WVre4n8x5v87lFyTHvrDvtLgZeIs8jUho7Fh9Vr5aYLqAvZ5`
			`mR4ZJYmv+K+/h4oNn2j6Q0IclOmjfq0UxB46G0l9yfr/yWo5xebwwa5HPNxwCySg`
			`+sAY0/yBoZmcI7POjtbWz6ZJr4nOvwhxnFcIlLxvgJIrNHJJNGHHYT5vCFEuNM/W`
			`8QS2+iEoTnYNi46G0q5Zr2VW2UsZGodcPO51RyWZd+EvsH+1D9ZxQxjuUzidrksy`
			`vulYjGcU9Di4`
			`=72eE`
			`-----END PGP SIGNATURE-----`