From 0028006287a5fb71ae63369862f20398ece49450b010db2302b055194af0ef04 Mon Sep 17 00:00:00 2001 From: Pedro Monreal Gonzalez Date: Wed, 14 Dec 2022 20:21:17 +0000 Subject: [PATCH] Accepting request 1042985 from home:ohollmann:branches:security:tls - Fix X.509 Policy Constraints Double Locking [bsc#1206374, CVE-2022-3996] * Add patch: openssl-3-Fix-double-locking-problem.patch OBS-URL: https://build.opensuse.org/request/show/1042985 OBS-URL: https://build.opensuse.org/package/show/security:tls/openssl-3?expand=0&rev=49 --- openssl-3-Fix-double-locking-problem.patch | 34 ++++++++++++++++++++++ openssl-3.changes | 6 ++++ openssl-3.spec | 2 ++ 3 files changed, 42 insertions(+) create mode 100644 openssl-3-Fix-double-locking-problem.patch diff --git a/openssl-3-Fix-double-locking-problem.patch b/openssl-3-Fix-double-locking-problem.patch new file mode 100644 index 0000000..267d8d4 --- /dev/null +++ b/openssl-3-Fix-double-locking-problem.patch @@ -0,0 +1,34 @@ +From 4d0340a6d2f327700a059f0b8f954d6160f8eef5 Mon Sep 17 00:00:00 2001 +From: Pauli +Date: Fri, 11 Nov 2022 09:40:19 +1100 +Subject: [PATCH] x509: fix double locking problem + +This reverts commit 9aa4be691f5c73eb3c68606d824c104550c053f7 and removed the +redundant flag setting. + +Fixes #19643 + +Fixes LOW CVE-2022-3996 + +Reviewed-by: Dmitry Belyavskiy +Reviewed-by: Tomas Mraz +(Merged from https://github.com/openssl/openssl/pull/19652) +--- + crypto/x509/pcy_map.c | 4 ---- + 1 file changed, 4 deletions(-) + +diff --git a/crypto/x509/pcy_map.c b/crypto/x509/pcy_map.c +index 05406c6493f..60dfd1e3203 100644 +--- a/crypto/x509/pcy_map.c ++++ b/crypto/x509/pcy_map.c +@@ -73,10 +73,6 @@ int ossl_policy_cache_set_mapping(X509 *x, POLICY_MAPPINGS *maps) + + ret = 1; + bad_mapping: +- if (ret == -1 && CRYPTO_THREAD_write_lock(x->lock)) { +- x->ex_flags |= EXFLAG_INVALID_POLICY; +- CRYPTO_THREAD_unlock(x->lock); +- } + sk_POLICY_MAPPING_pop_free(maps, POLICY_MAPPING_free); + return ret; + diff --git a/openssl-3.changes b/openssl-3.changes index ea4bce1..393ba08 100644 --- a/openssl-3.changes +++ b/openssl-3.changes @@ -1,3 +1,9 @@ +------------------------------------------------------------------- +Wed Dec 14 16:38:05 UTC 2022 - Otto Hollmann + +- Fix X.509 Policy Constraints Double Locking [bsc#1206374, CVE-2022-3996] + * Add patch: openssl-3-Fix-double-locking-problem.patch + ------------------------------------------------------------------- Tue Nov 1 18:29:41 UTC 2022 - Otto Hollmann diff --git a/openssl-3.spec b/openssl-3.spec index aa8909a..3000ea6 100644 --- a/openssl-3.spec +++ b/openssl-3.spec @@ -48,6 +48,8 @@ Patch8: openssl-Override-default-paths-for-the-CA-directory-tree.patch # use openssl3.cnf Patch9: openssl-use-versioned-config.patch Patch10: fix-config-in-tests.patch +# PATCH-FIX-UPSTREAM bsc#1206374 CVE-2022-3996 X.509 Policy Constraints Double Locking +Patch11: openssl-3-Fix-double-locking-problem.patch BuildRequires: pkgconfig BuildRequires: pkgconfig(zlib) # Add requires for ct_log_list.cnf{,.dist}