Skip to content
  1. Jul 27, 2015
  2. Jul 15, 2015
  3. Jul 14, 2015
  4. Jul 13, 2015
  5. Jul 10, 2015
  6. Jul 09, 2015
  7. Jul 07, 2015
    • Matt Caswell's avatar
      Fix alt chains bug · cb22d2ae
      Matt Caswell authored
      
      
      This is a follow up to the alternate chains certificate forgery issue
      (CVE-2015-1793). That issue is exacerbated in 1.0.1 by a related bug which
      means that we *always* check for an alternative chain, even if we have
      already found a chain. The code is supposed to stop as soon as it has found
      one (and does do in master and 1.0.2).
      
      Reviewed-by: default avatarStephen Henson <steve@openssl.org>
      cb22d2ae
    • Matt Caswell's avatar
      Reject calls to X509_verify_cert that have not been reinitialised · b3b1eb57
      Matt Caswell authored
      
      
      The function X509_verify_cert checks the value of |ctx->chain| at the
      beginning, and if it is NULL then it initialises it, along with the value
      of ctx->untrusted. The normal way to use X509_verify_cert() is to first
      call X509_STORE_CTX_init(); then set up various parameters etc; then call
      X509_verify_cert(); then check the results; and finally call
      X509_STORE_CTX_cleanup(). The initial call to X509_STORE_CTX_init() sets
      |ctx->chain| to NULL. The only place in the OpenSSL codebase  where
      |ctx->chain| is set to anything other than a non NULL value is in
      X509_verify_cert itself. Therefore the only ways that |ctx->chain| could be
      non NULL on entry to X509_verify_cert is if one of the following occurs:
      1) An application calls X509_verify_cert() twice without re-initialising
      in between.
      2) An application reaches inside the X509_STORE_CTX structure and changes
      the value of |ctx->chain| directly.
      
      With regards to the second of these, we should discount this - it should
      not be supported to allow this.
      
      With regards to the first of these, the documentation is not exactly
      crystal clear, but the implication is that you must call
      X509_STORE_CTX_init() before each call to X509_verify_cert(). If you fail
      to do this then, at best, the results would be undefined.
      
      Calling X509_verify_cert() with |ctx->chain| set to a non NULL value is
      likely to have unexpected results, and could be dangerous. This commit
      changes the behaviour of X509_verify_cert() so that it causes an error if
      |ctx->chain| is anything other than NULL (because this indicates that we
      have not been initialised properly). It also clarifies the associated
      documentation. This is a follow up commit to CVE-2015-1793.
      
      Reviewed-by: default avatarStephen Henson <steve@openssl.org>
      b3b1eb57
    • Matt Caswell's avatar
      Add test for CVE-2015-1793 · d42d1004
      Matt Caswell authored
      
      
      This adds a test for CVE-2015-1793. This adds a new test file
      verify_extra_test.c, which could form the basis for additional
      verification tests.
      
      Reviewed-by: default avatarStephen Henson <steve@openssl.org>
      
      Conflicts:
      	test/Makefile
      d42d1004
    • Matt Caswell's avatar
      Fix alternate chains certificate forgery issue · 9a0db453
      Matt Caswell authored
      
      
      During certificate verfification, OpenSSL will attempt to find an
      alternative certificate chain if the first attempt to build such a chain
      fails. An error in the implementation of this logic can mean that an
      attacker could cause certain checks on untrusted certificates to be
      bypassed, such as the CA flag, enabling them to use a valid leaf
      certificate to act as a CA and "issue" an invalid certificate.
      
      This occurs where at least one cert is added to the first chain from the
      trust store, but that chain still ends up being untrusted. In that case
      ctx->last_untrusted is decremented in error.
      
      Patch provided by the BoringSSL project.
      
      CVE-2015-1793
      
      Reviewed-by: default avatarStephen Henson <steve@openssl.org>
      9a0db453
  8. Jul 06, 2015
  9. Jul 02, 2015
    • Dr. Stephen Henson's avatar
      Fix PSK handling. · d6be3124
      Dr. Stephen Henson authored
      
      
      The PSK identity hint should be stored in the SSL_SESSION structure
      and not in the parent context (which will overwrite values used
      by other SSL structures with the same SSL_CTX).
      
      Use BUF_strndup when copying identity as it may not be null terminated.
      
      Reviewed-by: default avatarTim Hudson <tjh@openssl.org>
      (cherry picked from commit 3c66a669)
      d6be3124
  10. Jun 29, 2015
  11. Jun 25, 2015
  12. Jun 23, 2015
  13. Jun 22, 2015
  14. Jun 21, 2015
  15. Jun 16, 2015
  16. Jun 12, 2015