- 15 Aug, 2016 2 commits
-
-
Dr. Stephen Henson authored
If an oversize BIGNUM is presented to BN_bn2dec() it can cause BN_div_word() to fail and not reduce the value of 't' resulting in OOB writes to the bn_data buffer and eventually crashing. Fix by checking return value of BN_div_word() and checking writes don't overflow buffer. Thanks to Shi Lei for reporting this bug. CVE-2016-2182 Reviewed-by:
Tim Hudson <tjh@openssl.org> (cherry picked from commit 07bed46f) Conflicts: crypto/bn/bn_print.c
-
Dr. Stephen Henson authored
Check for error return in BN_div_word(). Reviewed-by:
Tim Hudson <tjh@openssl.org> (cherry picked from commit 8b9afbc0)
-
- 05 Aug, 2016 2 commits
-
-
Dr. Stephen Henson authored
Thanks to Hanno Böck for reporting this bug. Reviewed-by:
Rich Salz <rsalz@openssl.org> (cherry picked from commit 39a43280) Conflicts: crypto/pkcs12/p12_utl.c
-
Dr. Stephen Henson authored
Fix error path leaks in a2i_ASN1_STRING(), a2i_ASN1_INTEGER() and a2i_ASN1_ENUMERATED(). Thanks to Shi Lei for reporting these issues. Reviewed-by:
Rich Salz <rsalz@openssl.org> (cherry picked from commit e1be1dce)
-
- 04 Aug, 2016 3 commits
-
-
Kurt Roeckx authored
GH: #1322 Reviewed-by:
Rich Salz <rsalz@openssl.org> Reviewed-by:
Stephen Henson <steve@openssl.org> (cherry picked from commit 32baafb2)
-
Dr. Stephen Henson authored
Thanks to Shi Lei for reporting this bug. Reviewed-by:
Rich Salz <rsalz@openssl.org> (cherry picked from commit 81f69e5b)
-
Dr. Stephen Henson authored
Thanks to Shi Lei for reporting this issue. Reviewed-by:
Rich Salz <rsalz@openssl.org> (cherry picked from commit af601b83)
-
- 03 Aug, 2016 1 commit
-
-
Dr. Stephen Henson authored
Use correct length in old ASN.1 indefinite length sequence decoder (only used by SSL_SESSION). This bug was discovered by Hanno Böck using libfuzzer. Reviewed-by:
Rich Salz <rsalz@openssl.org> (cherry picked from commit 436dead2)
-
- 02 Aug, 2016 3 commits
-
-
Dr. Stephen Henson authored
Reviewed-by:
Rich Salz <rsalz@openssl.org> (cherry picked from commit 134ab513)
-
Dr. Stephen Henson authored
Reviewed-by:
Richard Levitte <levitte@openssl.org> (cherry picked from commit e9f17097)
-
Dr. Stephen Henson authored
Reviewed-by:
Richard Levitte <levitte@openssl.org> (cherry picked from commit 56f9953c)
-
- 22 Jul, 2016 1 commit
-
-
Dr. Stephen Henson authored
TS_OBJ_print_bio() misuses OBJ_txt2obj: it should print the result as a null terminated buffer. The length value returned is the total length the complete text reprsentation would need not the amount of data written. CVE-2016-2180 Thanks to Shi Lei for reporting this bug. Reviewed-by:
Matt Caswell <matt@openssl.org> (cherry picked from commit 0ed26acc)
-
- 30 Jun, 2016 1 commit
-
-
Matt Caswell authored
Ensure things really do get cleared when we intend them to. Addresses an OCAP Audit issue. Reviewed-by:
Andy Polyakov <appro@openssl.org> (cherry picked from commit cb5ebf96)
-
- 29 Jun, 2016 3 commits
-
-
Richard Levitte authored
Reviewed-by:
Rich Salz <rsalz@openssl.org> (cherry picked from commit 6ad8c482)
-
Richard Levitte authored
While travelling up the certificate chain, the internal proxy_path_length must be updated with the pCPathLengthConstraint value, or verification will not work properly. This corresponds to RFC 3820, 4.1.4 (a). Reviewed-by:
Rich Salz <rsalz@openssl.org> (cherry picked from commit 30aeb312)
-
Richard Levitte authored
The subject name MUST be the same as the issuer name, with a single CN entry added. RT#1852 Reviewed-by:
Rich Salz <rsalz@openssl.org> (cherry picked from commit 338fb168)
-
- 27 Jun, 2016 1 commit
-
-
Matt Caswell authored
RAND_pseudo_bytes() allows random data to be returned even in low entropy conditions. Sometimes this is ok. Many times it is not. For the avoidance of any doubt, replace existing usage of RAND_pseudo_bytes() with RAND_bytes(). Reviewed-by:
Rich Salz <rsalz@openssl.org>
-
- 07 Jun, 2016 1 commit
-
-
Matt Caswell authored
The previous "fix" still left "k" exposed to constant time problems in the later BN_mod_inverse() call. Ensure both k and kq have the BN_FLG_CONSTTIME flag set at the earliest opportunity after creation. CVE-2016-2178 Reviewed-by:
Rich Salz <rsalz@openssl.org> (cherry picked from commit b7d0f283)
-
- 06 Jun, 2016 1 commit
-
-
Cesar Pereida authored
Operations in the DSA signing algorithm should run in constant time in order to avoid side channel attacks. A flaw in the OpenSSL DSA implementation means that a non-constant time codepath is followed for certain operations. This has been demonstrated through a cache-timing attack to be sufficient for an attacker to recover the private DSA key. CVE-2016-2178 Reviewed-by:
Richard Levitte <levitte@openssl.org> Reviewed-by:
Matt Caswell <matt@openssl.org> (cherry picked from commit 621eaf49)
-
- 03 Jun, 2016 1 commit
-
-
Matt Caswell authored
Fix typos and clarify a few things in the CONTRIBUTING file. Reviewed-by:
Rich Salz <rsalz@openssl.org>
-
- 01 Jun, 2016 1 commit
-
-
Matt Caswell authored
A common idiom in the codebase is: if (p + len > limit) { return; /* Too long */ } Where "p" points to some malloc'd data of SIZE bytes and limit == p + SIZE "len" here could be from some externally supplied data (e.g. from a TLS message). The rules of C pointer arithmetic are such that "p + len" is only well defined where len <= SIZE. Therefore the above idiom is actually undefined behaviour. For example this could cause problems if some malloc implementation provides an address for "p" such that "p + len" actually overflows for values of len that are too big and therefore p + len < limit! Issue reported by Guido Vranken. CVE-2016-2177 Reviewed-by:
Rich Salz <rsalz@openssl.org>
-
- 26 May, 2016 2 commits
-
-
Viktor Dukhovni authored
Set ctx->error = X509_V_ERR_OUT_OF_MEM when verificaiton cannot continue due to malloc failure. Similarly for issuer lookup failures and caller errors (bad parameters or invalid state). Also, when X509_verify_cert() returns <= 0 make sure that the verification status does not remain X509_V_OK, as a last resort set it it to X509_V_ERR_UNSPECIFIED, just in case some code path returns an error without setting an appropriate value of ctx->error. Add new and some missing error codes to X509 error -> SSL alert switch. Reviewed-by:
Rich Salz <rsalz@openssl.org>
-
Viktor Dukhovni authored
Reviewed-by:
Rich Salz <rsalz@openssl.org>
-
- 23 May, 2016 1 commit
-
-
Matt Caswell authored
The functions SRP_Calc_client_key() and SRP_Calc_server_key() were incorrectly returning a valid pointer in the event of error. Issue reported by Yuan Jochen Kang Reviewed-by:
Richard Levitte <levitte@openssl.org> (cherry picked from commit 308ff286)
-
- 19 May, 2016 1 commit
-
-
Matt Caswell authored
In the X509 app check that the obtained public key is valid before we attempt to use it. Issue reported by Yuan Jochen Kang. Reviewed-by:
Viktor Dukhovni <viktor@openssl.org>
-
- 11 May, 2016 2 commits
-
-
Rich Salz authored
Reviewed-by:
Richard Levitte <levitte@openssl.org> (cherry picked from commit c393a5de)
-
Dr. Stephen Henson authored
Reviewed-by:
Viktor Dukhovni <viktor@openssl.org>
-
- 09 May, 2016 1 commit
-
-
Dr. Stephen Henson authored
RT#3826 Reviewed-by:
Tim Hudson <tjh@openssl.org> (cherry picked from commit 2b4825d0)
-
- 06 May, 2016 3 commits
-
-
Dr. Stephen Henson authored
PR#4449 Reviewed-by:
Rich Salz <rsalz@openssl.org> (cherry picked from commit b1f8ba4d)
-
Dr. Stephen Henson authored
PR#4466 Reviewed-by:
Rich Salz <rsalz@openssl.org> (cherry picked from commit 06227924)
-
Dr. Stephen Henson authored
Reviewed-by:
Rich Salz <rsalz@openssl.org> (cherry picked from commit 708cf5de)
-
- 05 May, 2016 2 commits
-
-
Dr. Stephen Henson authored
The default ASN.1 handling can be used for SEED. This also makes CMS work with SEED. PR#4504 Reviewed-by:
Rich Salz <rsalz@openssl.org> (cherry picked from commit c0aa8c27)
-
Dr. Stephen Henson authored
Try to set the ASN.1 parameters for CMS encryption even if the IV length is zero as the underlying cipher should still set the type. This will correctly result in errors if an attempt is made to use an unsupported cipher type. Reviewed-by:
Rich Salz <rsalz@openssl.org> (cherry picked from commit 3fd60dc4) Conflicts: crypto/cms/cms_enc.c
-
- 04 May, 2016 3 commits
-
-
Dr. Stephen Henson authored
The name length limit check in x509_name_ex_d2i() includes the containing structure as well as the actual X509_NAME. This will cause large CRLs to be rejected. Fix by limiting the length passed to ASN1_item_ex_d2i() which will then return an error if the passed X509_NAME exceeds the length. RT#4531 Reviewed-by:
Rich Salz <rsalz@openssl.org> (cherry picked from commit 4e0d184a)
-
Dr. Stephen Henson authored
RT#4527 Reviewed-by:
Matt Caswell <matt@openssl.org> (cherry picked from commit 3340e8bb)
-
Dr. Stephen Henson authored
Reviewed-by:
Matt Caswell <matt@openssl.org> (cherry picked from commit b1b3e14f)
-
- 03 May, 2016 4 commits
-
-
Matt Caswell authored
Reviewed-by:
Rich Salz <rsalz@openssl.org>
-
Matt Caswell authored
Reviewed-by:
Rich Salz <rsalz@openssl.org>
-
Matt Caswell authored
Reviewed-by:
Rich Salz <rsalz@openssl.org>
-
Matt Caswell authored
Reviewed-by:
Richard Levitte <levitte@openssl.org>
-