Pedro Monreal Gonzalez f8ec18178a Accepting request 1101915 from home:pmonrealgonzalez:branches:security:tls ...

- Update to 1.1.1v:
  * Fix excessive time spent checking DH q parameter value
    (bsc#1213853, CVE-2023-3817). The function DH_check() performs
    various checks on DH parameters. After fixing CVE-2023-3446 it
    was discovered that a large q parameter value can also trigger
    an overly long computation during some of these checks. A
    correct q value, if present, cannot be larger than the modulus
    p parameter, thus it is unnecessary to perform these checks if
    q is larger than p. If DH_check() is called with such q parameter
    value, DH_CHECK_INVALID_Q_VALUE return flag is set and the
    computationally intensive checks are skipped.
  * Fix DH_check() excessive time with over sized modulus
    (bsc#1213487, CVE-2023-3446). The function DH_check() performs
    various checks on DH parameters. One of those checks confirms
    that the modulus ("p" parameter) is not too large. Trying to use
    a very large modulus is slow and OpenSSL will not normally use
    a modulus which is over 10,000 bits in length. However the
    DH_check() function checks numerous aspects of the key or
    parameters that have been supplied. Some of those checks use the
    supplied modulus value even if it has already been found to be
    too large. A new limit has been added to DH_check of 32,768 bits.
    Supplying a key/parameters with a modulus over this size will
    simply cause DH_check() to fail.
  * Rebase openssl-1_1-openssl-config.patch
  * Remove security patches fixed upstream:
    - openssl-CVE-2023-3446.patch
    - openssl-CVE-2023-3446-test.patch

OBS-URL: https://build.opensuse.org/request/show/1101915
OBS-URL: https://build.opensuse.org/package/show/security:tls/openssl-1_1?expand=0&rev=141

2023-08-02 10:03:45 +00:00

9.4 MiB (Stored with Git LFS)

Raw History

The file is too large to be shown. View Raw