- 29 Apr, 2016 2 commits
-
-
Dr. Stephen Henson authored
Reject zero length buffers passed to X509_NAME_onelne(). Issue reported by Guido Vranken. Reviewed-by:
Matt Caswell <matt@openssl.org> (cherry picked from commit b33d1141)
-
Dr. Stephen Henson authored
This adds an explicit limit to the size of an X509_NAME structure. Some part of OpenSSL (e.g. TLS) already effectively limit the size due to restrictions on certificate size. Reviewed-by:
Matt Caswell <matt@openssl.org> (cherry picked from commit 295f3a24)
-
- 27 Apr, 2016 1 commit
-
-
Dr. Stephen Henson authored
The traditional private key encryption algorithm doesn't function properly if the IV length of the cipher is zero. These ciphers (e.g. ECB mode) are not suitable for private key encryption anyway. Reviewed-by:
Emilia Käsper <emilia@openssl.org> (cherry picked from commit d78df5df)
-
- 26 Apr, 2016 1 commit
-
-
Matt Caswell authored
The i2d_X509() function can return a negative value on error. Therefore we should make sure we check it. Issue reported by Yuan Jochen Kang. Reviewed-by:
Emilia Käsper <emilia@openssl.org> (cherry picked from commit 446ba8de)
-
- 25 Apr, 2016 2 commits
-
-
Matt Caswell authored
This causes a compilation failure when using --strict-warnings in 1.0.2 and 1.0.1 Reviewed-by:
Viktor Dukhovni <viktor@openssl.org> (cherry picked from commit 0ca67644)
-
Rich Salz authored
Thanks to Brian Carpenter for finding and reporting this. Reviewed-by:
Emilia Käsper <emilia@openssl.org> (cherry picked from commit 79356a83)
-
- 23 Apr, 2016 1 commit
-
-
Viktor Dukhovni authored
Backport of commits: 79c7f74d bdcd660e from master. Reviewed-by:
Matt Caswell <matt@openssl.org>
-
- 22 Apr, 2016 1 commit
-
-
Dr. Stephen Henson authored
If the ASN.1 BIO is presented with a large length field read it in chunks of increasing size checking for EOF on each read. This prevents small files allocating excessive amounts of data. CVE-2016-2109 Thanks to Brian Carpenter for reporting this issue. Reviewed-by:
Viktor Dukhovni <viktor@openssl.org> (cherry picked from commit c6298139)
-
- 07 Apr, 2016 1 commit
-
-
David Benjamin authored
Free up parsed X509_NAME structure if the CertificateRequest message contains excess data. The security impact is considered insignificant. This is a client side only leak and a large number of connections to malicious servers would be needed to have a significant impact. This was found by libFuzzer. Reviewed-by:
Emilia Käsper <emilia@openssl.org> Reviewed-by:
Stephen Henson <steve@openssl.org> (cherry picked from commit ec66c8c9)
-
- 26 Mar, 2016 1 commit
-
-
Dr. Stephen Henson authored
Reviewed-by:
Viktor Dukhovni <viktor@openssl.org> (cherry picked from commit 21211ade)
-
- 18 Mar, 2016 4 commits
-
-
Matt Caswell authored
no-comp on Windows was not actually suppressing compilation of the code, although it was suppressing its use. Reviewed-by:
Richard Levitte <levitte@openssl.org> (cherry picked from commit a6406c95)
-
Matt Caswell authored
Ensure we check for a NULL return from OPENSSL_malloc Issue reported by Guido Vranken. Reviewed-by:
Richard Levitte <levitte@openssl.org>
-
Matt Caswell authored
If a call to EVP_DecryptUpdate fails then a memory leak could occur. Ensure that the memory is freed appropriately. Issue reported by Guido Vranken. Reviewed-by:
Richard Levitte <levitte@openssl.org>
-
Matt Caswell authored
There is a potential double free in EVP_DigestInit_ex. This is believed to be reached only as a result of programmer error - but we should fix it anyway. Issue reported by Guido Vranken. Reviewed-by:
Richard Levitte <levitte@openssl.org> (cherry picked from commit ffe9150b)
-
- 14 Mar, 2016 1 commit
-
-
Kurt Roeckx authored
Reviewed-by:
Viktor Dukhovni <viktor@openssl.org> MR: #2341 (cherry picked from commit 42569575)
-
- 09 Mar, 2016 1 commit
-
-
Viktor Dukhovni authored
Reviewed-by:
Kurt Roeckx <kurt@openssl.org>
-
- 08 Mar, 2016 1 commit
-
-
Viktor Dukhovni authored
This improves ABI compatibility when symbol resolution is not lazy. Reviewed-by:
Richard Levitte <levitte@openssl.org>
-
- 07 Mar, 2016 3 commits
-
-
Andy Polyakov authored
Some OSes, *cough*-dows, insist on stack being "wired" to physical memory in strictly sequential manner, i.e. if stack allocation spans two pages, then reference to farmost one can be punishable by SEGV. But page walking can do good even on other OSes, because it guarantees that villain thread hits the guard page before it can make damage to innocent one... Reviewed-by:
Rich Salz <rsalz@openssl.org> (cherry picked from commit adc4f1fc ) Resolved conflicts: crypto/bn/asm/x86_64-mont.pl crypto/bn/asm/x86_64-mont5.pl Reviewed-by:
Richard Levitte <levitte@openssl.org>
-
Kurt Roeckx authored
Reviewed-by:
Viktor Dukhovni <viktor@openssl.org> (cherry picked from commit 29cce508)
-
Dr. Stephen Henson authored
Reviewed-by:
Rich Salz <rsalz@openssl.org> (cherry picked from commit 01c32b5e)
-
- 04 Mar, 2016 1 commit
-
-
Dr. Stephen Henson authored
PVK files with abnormally large length or salt fields can cause an integer overflow which can result in an OOB read and heap corruption. However this is an rarely used format and private key files do not normally come from untrusted sources the security implications not significant. Fix by limiting PVK length field to 100K and salt to 10K: these should be more than enough to cover any files encountered in practice. Issue reported by Guido Vranken. Reviewed-by:
Rich Salz <rsalz@openssl.org> (cherry picked from commit 5f57abe2)
-
- 01 Mar, 2016 11 commits
-
-
Matt Caswell authored
Reviewed-by:
Richard Levitte <levitte@openssl.org>
-
Matt Caswell authored
Reviewed-by:
Richard Levitte <levitte@openssl.org>
-
Matt Caswell authored
Reviewed-by:
Richard Levitte <levitte@openssl.org>
-
Matt Caswell authored
Update mk1mf.pl to properly handle no-weak-ssl-ciphers Reviewed-by:
Richard Levitte <levitte@openssl.org>
-
Matt Caswell authored
Reviewed-by:
Richard Levitte <levitte@openssl.org>
-
Andy Polyakov authored
Reviewed-by:
Rich Salz <rsalz@openssl.org> (cherry picked from commit 902b30df)
-
Andy Polyakov authored
[Backport from master] CVE-2016-0702 Reviewed-by:
Richard Levitte <levitte@openssl.org>
-
Andy Polyakov authored
Performance penalty varies from platform to platform, and even key length. For rsa2048 sign it was observed to reach almost 10%. CVE-2016-0702 Reviewed-by:
Richard Levitte <levitte@openssl.org>
-
Viktor Dukhovni authored
Reviewed-by:
Emilia Käsper <emilia@openssl.org>
-
Viktor Dukhovni authored
Reviewed-by:
Emilia Käsper <emilia@openssl.org>
-
Viktor Dukhovni authored
SSLv2 is by default disabled at build-time. Builds that are not configured with "enable-ssl2" will not support SSLv2. Even if "enable-ssl2" is used, users who want to negotiate SSLv2 via the version-flexible SSLv23_method() will need to explicitly call either of: SSL_CTX_clear_options(ctx, SSL_OP_NO_SSLv2); or SSL_clear_options(ssl, SSL_OP_NO_SSLv2); as appropriate. Even if either of those is used, or the application explicitly uses the version-specific SSLv2_method() or its client or server variants, SSLv2 ciphers vulnerable to exhaustive search key recovery have been removed. Specifically, the SSLv2 40-bit EXPORT ciphers, and SSLv2 56-bit DES are no longer available. Mitigation for CVE-2016-0800 Reviewed-by:
Emilia Käsper <emilia@openssl.org>
-
- 29 Feb, 2016 1 commit
-
-
Matt Caswell authored
In the BN_hex2bn function the number of hex digits is calculated using an int value |i|. Later |bn_expand| is called with a value of |i * 4|. For large values of |i| this can result in |bn_expand| not allocating any memory because |i * 4| is negative. This leaves ret->d as NULL leading to a subsequent NULL ptr deref. For very large values of |i|, the calculation |i * 4| could be a positive value smaller than |i|. In this case memory is allocated to ret->d, but it is insufficiently sized leading to heap corruption. A similar issue exists in BN_dec2bn. This could have security consequences if BN_hex2bn/BN_dec2bn is ever called by user applications with very large untrusted hex/dec data. This is anticipated to be a rare occurrence. All OpenSSL internal usage of this function uses data that is not expected to be untrusted, e.g. config file data or application command line arguments. If user developed applications generate config file data based on untrusted data then it is possible that this could also lead to security consequences. This is also anticipated to be a rare. Issue reported by Guido Vranken. CVE-2016-0797 Reviewed-by:
Andy Polyakov <appro@openssl.org> (cherry picked from commit c1753084)
-
- 27 Feb, 2016 1 commit
-
-
Kurt Roeckx authored
This reverts commit 23a58779 . This broke existing engines that didn't properly implement the sign and verify functions. Reviewed-by:
Richard Levitte <levitte@openssl.org> MR: #2077
-
- 25 Feb, 2016 2 commits
-
-
Matt Caswell authored
The internal |fmtstr| function used in processing a "%s" format string in the BIO_*printf functions could overflow while calculating the length of a string and cause an OOB read when printing very long strings. Additionally the internal |doapr_outch| function can attempt to write to an OOB memory location (at an offset from the NULL pointer) in the event of a memory allocation failure. In 1.0.2 and below this could be caused where the size of a buffer to be allocated is greater than INT_MAX. E.g. this could be in processing a very long "%s" format string. Memory leaks can also occur. These issues will only occur on certain platforms where sizeof(size_t) > sizeof(int). E.g. many 64 bit systems. The first issue may mask the second issue dependent on compiler behaviour. These problems could enable attacks where large amounts of untrusted data is passed to the BIO_*printf functions. If applications use these functions in this way then they could be vulnerable. OpenSSL itself uses these functions when printing out human-readable dumps of ASN.1 data. Therefore applications that print this data could be vulnerable if the data is from untrusted sources. OpenSSL command line applications could also be vulnerable where they print out ASN.1 data, or if untrusted data is passed as command line arguments. Libssl is not considered directly vulnerable. Additionally certificates etc received via remote connections via libssl are also unlikely to be able to trigger these issues because of message size limits enforced within libssl. CVE-2016-0799 Issue reported by Guido Vranken. Reviewed-by:
Andy Polyakov <appro@openssl.org> (cherry picked from commit 578b956f)
-
Emilia Kasper authored
The SRP user database lookup method SRP_VBASE_get_by_user had confusing memory management semantics; the returned pointer was sometimes newly allocated, and sometimes owned by the callee. The calling code has no way of distinguishing these two cases. Specifically, SRP servers that configure a secret seed to hide valid login information are vulnerable to a memory leak: an attacker connecting with an invalid username can cause a memory leak of around 300 bytes per connection. Servers that do not configure SRP, or configure SRP but do not configure a seed are not vulnerable. In Apache, the seed directive is known as SSLSRPUnknownUserSeed. To mitigate the memory leak, the seed handling in SRP_VBASE_get_by_user is now disabled even if the user has configured a seed. Applications are advised to migrate to SRP_VBASE_get1_by_user. However, note that OpenSSL makes no strong guarantees about the indistinguishability of valid and invalid logins. In particular, computations are currently not carried out in constant time. Reviewed-by:
Rich Salz <rsalz@openssl.org>
-
- 23 Feb, 2016 1 commit
-
-
FdaSilvaYY authored
Signed-off-by:
Rich Salz <rsalz@openssl.org> Reviewed-by:
Kurt Roeckx <kurt@openssl.org> (cherry picked from commit 04f2a0b5)
-
- 19 Feb, 2016 1 commit
-
-
Dr. Stephen Henson authored
Fix double free bug when parsing malformed DSA private keys. Thanks to Adam Langley (Google/BoringSSL) for discovering this bug using libFuzzer. CVE-2016-0705 Reviewed-by:
Emilia Käsper <emilia@openssl.org> (cherry picked from commit 6c88c71b)
-
- 12 Feb, 2016 1 commit
-
-
Andy Polyakov authored
It's never problem if CRYPTO_ctr128_encrypt is called from EVP, because buffer in question is always aligned within EVP_CIPHER_CTX structure. RT#4218 Reviewed-by:
Richard Levitte <levitte@openssl.org> (cherry picked from commit 5e4bbeb4)
-
- 11 Feb, 2016 1 commit
-
-
Andy Polyakov authored
Trouble is that LINK variable assignment in make-file interferes with LINK environment variable, which can be used to modify Microsoft's LINK.EXE behaviour. RT#4289 Reviewed-by:
Richard Levitte <levitte@openssl.org> (cherry picked from commit d44bb1c3) Resolved conflicts: util/pl/VC-32.pl (cherry picked from commit 0fffd522)
-