Pedro Monreal Gonzalez ae873c4025 Accepting request 1101930 from home:pmonrealgonzalez:branches:security:tls ...

- Update to 3.1.2:
  * Fix excessive time spent checking DH q parameter value
    (bsc#1213853, CVE-2023-3817). The function DH_check() performs
    various checks on DH parameters. After fixing CVE-2023-3446 it
    was discovered that a large q parameter value can also trigger
    an overly long computation during some of these checks. A
    correct q value, if present, cannot be larger than the modulus
    p parameter, thus it is unnecessary to perform these checks if
    q is larger than p. If DH_check() is called with such q parameter
    value, DH_CHECK_INVALID_Q_VALUE return flag is set and the
    computationally intensive checks are skipped.
  * Fix DH_check() excessive time with over sized modulus
    (bsc#1213487, CVE-2023-3446). The function DH_check() performs
    various checks on DH parameters. One of those checks confirms
    that the modulus ("p" parameter) is not too large. Trying to use
    a very large modulus is slow and OpenSSL will not normally use
    a modulus which is over 10,000 bits in length. However the
    DH_check() function checks numerous aspects of the key or
    parameters that have been supplied. Some of those checks use the
    supplied modulus value even if it has already been found to be
    too large. A new limit has been added to DH_check of 32,768 bits.
    Supplying a key/parameters with a modulus over this size will
    simply cause DH_check() to fail.
  * Do not ignore empty associated data entries with AES-SIV
    (bsc#1213383, CVE-2023-2975). The AES-SIV algorithm allows for
    authentication of multiple associated data entries along with the
    encryption. To authenticate empty data the application has to call
    EVP_EncryptUpdate() (or EVP_CipherUpdate()) with NULL pointer as
    the output buffer and 0 as the input buffer length. The AES-SIV
    implementation in OpenSSL just returns success for such call

OBS-URL: https://build.opensuse.org/request/show/1101930
OBS-URL: https://build.opensuse.org/package/show/security:tls/openssl-3?expand=0&rev=70

2023-08-02 10:04:19 +00:00

15 MiB (Stored with Git LFS)

Raw History

The file is too large to be shown. View Raw