Skip to content

Commit eebdf7a

Browse files
indutnyindutny
committed
deps: update openssl to 1.0.1k
PR-URL: #289 Reviewed-By: Ben Noordhuis <[email protected]>
1 parent c8676cb commit eebdf7a

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

116 files changed

+1987
-5373
lines changed

‎deps/openssl/openssl/CHANGES

+130
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,136 @@
22
OpenSSL CHANGES
33
_______________
44

5+
Changes between 1.0.1j and 1.0.1k [8 Jan 2015]
6+
7+
*) Fix DTLS segmentation fault in dtls1_get_record. A carefully crafted DTLS
8+
message can cause a segmentation fault in OpenSSL due to a NULL pointer
9+
dereference. This could lead to a Denial Of Service attack. Thanks to
10+
Markus Stenberg of Cisco Systems, Inc. for reporting this issue.
11+
(CVE-2014-3571)
12+
[Steve Henson]
13+
14+
*) Fix DTLS memory leak in dtls1_buffer_record. A memory leak can occur in the
15+
dtls1_buffer_record function under certain conditions. In particular this
16+
could occur if an attacker sent repeated DTLS records with the same
17+
sequence number but for the next epoch. The memory leak could be exploited
18+
by an attacker in a Denial of Service attack through memory exhaustion.
19+
Thanks to Chris Mueller for reporting this issue.
20+
(CVE-2015-0206)
21+
[Matt Caswell]
22+
23+
*) Fix issue where no-ssl3 configuration sets method to NULL. When openssl is
24+
built with the no-ssl3 option and a SSL v3 ClientHello is received the ssl
25+
method would be set to NULL which could later result in a NULL pointer
26+
dereference. Thanks to Frank Schmirler for reporting this issue.
27+
(CVE-2014-3569)
28+
[Kurt Roeckx]
29+
30+
*) Abort handshake if server key exchange message is omitted for ephemeral
31+
ECDH ciphersuites.
32+
33+
Thanks to Karthikeyan Bhargavan of the PROSECCO team at INRIA for
34+
reporting this issue.
35+
(CVE-2014-3572)
36+
[Steve Henson]
37+
38+
*) Remove non-export ephemeral RSA code on client and server. This code
39+
violated the TLS standard by allowing the use of temporary RSA keys in
40+
non-export ciphersuites and could be used by a server to effectively
41+
downgrade the RSA key length used to a value smaller than the server
42+
certificate. Thanks for Karthikeyan Bhargavan of the PROSECCO team at
43+
INRIA or reporting this issue.
44+
(CVE-2015-0204)
45+
[Steve Henson]
46+
47+
*) Fixed issue where DH client certificates are accepted without verification.
48+
An OpenSSL server will accept a DH certificate for client authentication
49+
without the certificate verify message. This effectively allows a client to
50+
authenticate without the use of a private key. This only affects servers
51+
which trust a client certificate authority which issues certificates
52+
containing DH keys: these are extremely rare and hardly ever encountered.
53+
Thanks for Karthikeyan Bhargavan of the PROSECCO team at INRIA or reporting
54+
this issue.
55+
(CVE-2015-0205)
56+
[Steve Henson]
57+
58+
*) Ensure that the session ID context of an SSL is updated when its
59+
SSL_CTX is updated via SSL_set_SSL_CTX.
60+
61+
The session ID context is typically set from the parent SSL_CTX,
62+
and can vary with the CTX.
63+
[Adam Langley]
64+
65+
*) Fix various certificate fingerprint issues.
66+
67+
By using non-DER or invalid encodings outside the signed portion of a
68+
certificate the fingerprint can be changed without breaking the signature.
69+
Although no details of the signed portion of the certificate can be changed
70+
this can cause problems with some applications: e.g. those using the
71+
certificate fingerprint for blacklists.
72+
73+
1. Reject signatures with non zero unused bits.
74+
75+
If the BIT STRING containing the signature has non zero unused bits reject
76+
the signature. All current signature algorithms require zero unused bits.
77+
78+
2. Check certificate algorithm consistency.
79+
80+
Check the AlgorithmIdentifier inside TBS matches the one in the
81+
certificate signature. NB: this will result in signature failure
82+
errors for some broken certificates.
83+
84+
Thanks to Konrad Kraszewski from Google for reporting this issue.
85+
86+
3. Check DSA/ECDSA signatures use DER.
87+
88+
Reencode DSA/ECDSA signatures and compare with the original received
89+
signature. Return an error if there is a mismatch.
90+
91+
This will reject various cases including garbage after signature
92+
(thanks to Antti Karjalainen and Tuomo Untinen from the Codenomicon CROSS
93+
program for discovering this case) and use of BER or invalid ASN.1 INTEGERs
94+
(negative or with leading zeroes).
95+
96+
Further analysis was conducted and fixes were developed by Stephen Henson
97+
of the OpenSSL core team.
98+
99+
(CVE-2014-8275)
100+
[Steve Henson]
101+
102+
*) Correct Bignum squaring. Bignum squaring (BN_sqr) may produce incorrect
103+
results on some platforms, including x86_64. This bug occurs at random
104+
with a very low probability, and is not known to be exploitable in any
105+
way, though its exact impact is difficult to determine. Thanks to Pieter
106+
Wuille (Blockstream) who reported this issue and also suggested an initial
107+
fix. Further analysis was conducted by the OpenSSL development team and
108+
Adam Langley of Google. The final fix was developed by Andy Polyakov of
109+
the OpenSSL core team.
110+
(CVE-2014-3570)
111+
[Andy Polyakov]
112+
113+
*) Do not resume sessions on the server if the negotiated protocol
114+
version does not match the session's version. Resuming with a different
115+
version, while not strictly forbidden by the RFC, is of questionable
116+
sanity and breaks all known clients.
117+
[David Benjamin, Emilia K�sper]
118+
119+
*) Tighten handling of the ChangeCipherSpec (CCS) message: reject
120+
early CCS messages during renegotiation. (Note that because
121+
renegotiation is encrypted, this early CCS was not exploitable.)
122+
[Emilia K�sper]
123+
124+
*) Tighten client-side session ticket handling during renegotiation:
125+
ensure that the client only accepts a session ticket if the server sends
126+
the extension anew in the ServerHello. Previously, a TLS client would
127+
reuse the old extension state and thus accept a session ticket if one was
128+
announced in the initial ServerHello.
129+
130+
Similarly, ensure that the client requires a session ticket if one
131+
was advertised in the ServerHello. Previously, a TLS client would
132+
ignore a missing NewSessionTicket message.
133+
[Emilia K�sper]
134+
5135
Changes between 1.0.1i and 1.0.1j [15 Oct 2014]
6136

7137
*) SRTP Memory Leak.

‎deps/openssl/openssl/Configure

+5
Original file line numberDiff line numberDiff line change
@@ -804,6 +804,11 @@ PROCESS_ARGS:
804804
{
805805
$disabled{"tls1"} = "option(tls)"
806806
}
807+
elsif ($1 eq "ssl3-method")
808+
{
809+
$disabled{"ssl3-method"} = "option(ssl)";
810+
$disabled{"ssl3"} = "option(ssl)";
811+
}
807812
else
808813
{
809814
$disabled{$1} = "option";

‎deps/openssl/openssl/Makefile

+1-1
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44
## Makefile for OpenSSL
55
##
66

7-
VERSION=1.0.1j
7+
VERSION=1.0.1k
88
MAJOR=1
99
MINOR=0.1
1010
SHLIB_VERSION_NUMBER=1.0.0

‎deps/openssl/openssl/Makefile.bak

+1-1
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44
## Makefile for OpenSSL
55
##
66

7-
VERSION=1.0.1j-dev
7+
VERSION=1.0.1k-dev
88
MAJOR=1
99
MINOR=0.1
1010
SHLIB_VERSION_NUMBER=1.0.0

‎deps/openssl/openssl/NEWS

+11
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,17 @@
55
This file gives a brief overview of the major changes between each OpenSSL
66
release. For more details please read the CHANGES file.
77

8+
Major changes between OpenSSL 1.0.1j and OpenSSL 1.0.1k [8 Jan 2015]
9+
10+
o Fix for CVE-2014-3571
11+
o Fix for CVE-2015-0206
12+
o Fix for CVE-2014-3569
13+
o Fix for CVE-2014-3572
14+
o Fix for CVE-2015-0204
15+
o Fix for CVE-2015-0205
16+
o Fix for CVE-2014-8275
17+
o Fix for CVE-2014-3570
18+
819
Major changes between OpenSSL 1.0.1i and OpenSSL 1.0.1j [15 Oct 2014]
920

1021
o Fix for CVE-2014-3513

‎deps/openssl/openssl/README

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11

2-
OpenSSL 1.0.1j 15 Oct 2014
2+
OpenSSL 1.0.1k 8 Jan 2015
33

44
Copyright (c) 1998-2011 The OpenSSL Project
55
Copyright (c) 1995-1998 Eric A. Young, Tim J. Hudson

‎deps/openssl/openssl/apps/ca.c

+1-1
Original file line numberDiff line numberDiff line change
@@ -703,7 +703,7 @@ EF_ALIGNMENT=0;
703703
ERR_clear_error();
704704
#ifdef RL_DEBUG
705705
if (!p)
706-
BIO_printf(bio_err, "DEBUG: unique_subject undefined\n", p);
706+
BIO_printf(bio_err, "DEBUG: unique_subject undefined\n");
707707
#endif
708708
#ifdef RL_DEBUG
709709
BIO_printf(bio_err, "DEBUG: configured unique_subject is %d\n",

‎deps/openssl/openssl/apps/dgst.c

+2
Original file line numberDiff line numberDiff line change
@@ -273,6 +273,8 @@ int MAIN(int argc, char **argv)
273273
BIO_printf(bio_err,"-d to output debug info\n");
274274
BIO_printf(bio_err,"-hex output as hex dump\n");
275275
BIO_printf(bio_err,"-binary output in binary form\n");
276+
BIO_printf(bio_err,"-hmac arg set the HMAC key to arg\n");
277+
BIO_printf(bio_err,"-non-fips-allow allow use of non FIPS digest\n");
276278
BIO_printf(bio_err,"-sign file sign digest using private key in file\n");
277279
BIO_printf(bio_err,"-verify file verify a signature using public key in file\n");
278280
BIO_printf(bio_err,"-prverify file verify a signature using private key in file\n");

‎deps/openssl/openssl/apps/ocsp.c

+45-53
Original file line numberDiff line numberDiff line change
@@ -583,51 +583,52 @@ int MAIN(int argc, char **argv)
583583
BIO_printf (bio_err, "OCSP utility\n");
584584
BIO_printf (bio_err, "Usage ocsp [options]\n");
585585
BIO_printf (bio_err, "where options are\n");
586-
BIO_printf (bio_err, "-out file output filename\n");
587-
BIO_printf (bio_err, "-issuer file issuer certificate\n");
588-
BIO_printf (bio_err, "-cert file certificate to check\n");
589-
BIO_printf (bio_err, "-serial n serial number to check\n");
590-
BIO_printf (bio_err, "-signer file certificate to sign OCSP request with\n");
591-
BIO_printf (bio_err, "-signkey file private key to sign OCSP request with\n");
592-
BIO_printf (bio_err, "-sign_other file additional certificates to include in signed request\n");
593-
BIO_printf (bio_err, "-no_certs don't include any certificates in signed request\n");
594-
BIO_printf (bio_err, "-req_text print text form of request\n");
595-
BIO_printf (bio_err, "-resp_text print text form of response\n");
596-
BIO_printf (bio_err, "-text print text form of request and response\n");
597-
BIO_printf (bio_err, "-reqout file write DER encoded OCSP request to \"file\"\n");
598-
BIO_printf (bio_err, "-respout file write DER encoded OCSP reponse to \"file\"\n");
599-
BIO_printf (bio_err, "-reqin file read DER encoded OCSP request from \"file\"\n");
600-
BIO_printf (bio_err, "-respin file read DER encoded OCSP reponse from \"file\"\n");
601-
BIO_printf (bio_err, "-nonce add OCSP nonce to request\n");
602-
BIO_printf (bio_err, "-no_nonce don't add OCSP nonce to request\n");
603-
BIO_printf (bio_err, "-url URL OCSP responder URL\n");
604-
BIO_printf (bio_err, "-host host:n send OCSP request to host on port n\n");
605-
BIO_printf (bio_err, "-path path to use in OCSP request\n");
606-
BIO_printf (bio_err, "-CApath dir trusted certificates directory\n");
607-
BIO_printf (bio_err, "-CAfile file trusted certificates file\n");
608-
BIO_printf (bio_err, "-VAfile file validator certificates file\n");
609-
BIO_printf (bio_err, "-validity_period n maximum validity discrepancy in seconds\n");
610-
BIO_printf (bio_err, "-status_age n maximum status age in seconds\n");
611-
BIO_printf (bio_err, "-noverify don't verify response at all\n");
612-
BIO_printf (bio_err, "-verify_other file additional certificates to search for signer\n");
613-
BIO_printf (bio_err, "-trust_other don't verify additional certificates\n");
614-
BIO_printf (bio_err, "-no_intern don't search certificates contained in response for signer\n");
586+
BIO_printf (bio_err, "-out file output filename\n");
587+
BIO_printf (bio_err, "-issuer file issuer certificate\n");
588+
BIO_printf (bio_err, "-cert file certificate to check\n");
589+
BIO_printf (bio_err, "-serial n serial number to check\n");
590+
BIO_printf (bio_err, "-signer file certificate to sign OCSP request with\n");
591+
BIO_printf (bio_err, "-signkey file private key to sign OCSP request with\n");
592+
BIO_printf (bio_err, "-sign_other file additional certificates to include in signed request\n");
593+
BIO_printf (bio_err, "-no_certs don't include any certificates in signed request\n");
594+
BIO_printf (bio_err, "-req_text print text form of request\n");
595+
BIO_printf (bio_err, "-resp_text print text form of response\n");
596+
BIO_printf (bio_err, "-text print text form of request and response\n");
597+
BIO_printf (bio_err, "-reqout file write DER encoded OCSP request to \"file\"\n");
598+
BIO_printf (bio_err, "-respout file write DER encoded OCSP reponse to \"file\"\n");
599+
BIO_printf (bio_err, "-reqin file read DER encoded OCSP request from \"file\"\n");
600+
BIO_printf (bio_err, "-respin file read DER encoded OCSP reponse from \"file\"\n");
601+
BIO_printf (bio_err, "-nonce add OCSP nonce to request\n");
602+
BIO_printf (bio_err, "-no_nonce don't add OCSP nonce to request\n");
603+
BIO_printf (bio_err, "-url URL OCSP responder URL\n");
604+
BIO_printf (bio_err, "-host host:n send OCSP request to host on port n\n");
605+
BIO_printf (bio_err, "-path path to use in OCSP request\n");
606+
BIO_printf (bio_err, "-CApath dir trusted certificates directory\n");
607+
BIO_printf (bio_err, "-CAfile file trusted certificates file\n");
608+
BIO_printf (bio_err, "-VAfile file validator certificates file\n");
609+
BIO_printf (bio_err, "-validity_period n maximum validity discrepancy in seconds\n");
610+
BIO_printf (bio_err, "-status_age n maximum status age in seconds\n");
611+
BIO_printf (bio_err, "-noverify don't verify response at all\n");
612+
BIO_printf (bio_err, "-verify_other file additional certificates to search for signer\n");
613+
BIO_printf (bio_err, "-trust_other don't verify additional certificates\n");
614+
BIO_printf (bio_err, "-no_intern don't search certificates contained in response for signer\n");
615615
BIO_printf (bio_err, "-no_signature_verify don't check signature on response\n");
616-
BIO_printf (bio_err, "-no_cert_verify don't check signing certificate\n");
617-
BIO_printf (bio_err, "-no_chain don't chain verify response\n");
618-
BIO_printf (bio_err, "-no_cert_checks don't do additional checks on signing certificate\n");
619-
BIO_printf (bio_err, "-port num port to run responder on\n");
620-
BIO_printf (bio_err, "-index file certificate status index file\n");
621-
BIO_printf (bio_err, "-CA file CA certificate\n");
622-
BIO_printf (bio_err, "-rsigner file responder certificate to sign responses with\n");
623-
BIO_printf (bio_err, "-rkey file responder key to sign responses with\n");
624-
BIO_printf (bio_err, "-rother file other certificates to include in response\n");
625-
BIO_printf (bio_err, "-resp_no_certs don't include any certificates in response\n");
626-
BIO_printf (bio_err, "-nmin n number of minutes before next update\n");
627-
BIO_printf (bio_err, "-ndays n number of days before next update\n");
628-
BIO_printf (bio_err, "-resp_key_id identify reponse by signing certificate key ID\n");
629-
BIO_printf (bio_err, "-nrequest n number of requests to accept (default unlimited)\n");
630-
BIO_printf (bio_err, "-<dgst alg> use specified digest in the request\n");
616+
BIO_printf (bio_err, "-no_cert_verify don't check signing certificate\n");
617+
BIO_printf (bio_err, "-no_chain don't chain verify response\n");
618+
BIO_printf (bio_err, "-no_cert_checks don't do additional checks on signing certificate\n");
619+
BIO_printf (bio_err, "-port num port to run responder on\n");
620+
BIO_printf (bio_err, "-index file certificate status index file\n");
621+
BIO_printf (bio_err, "-CA file CA certificate\n");
622+
BIO_printf (bio_err, "-rsigner file responder certificate to sign responses with\n");
623+
BIO_printf (bio_err, "-rkey file responder key to sign responses with\n");
624+
BIO_printf (bio_err, "-rother file other certificates to include in response\n");
625+
BIO_printf (bio_err, "-resp_no_certs don't include any certificates in response\n");
626+
BIO_printf (bio_err, "-nmin n number of minutes before next update\n");
627+
BIO_printf (bio_err, "-ndays n number of days before next update\n");
628+
BIO_printf (bio_err, "-resp_key_id identify reponse by signing certificate key ID\n");
629+
BIO_printf (bio_err, "-nrequest n number of requests to accept (default unlimited)\n");
630+
BIO_printf (bio_err, "-<dgst alg> use specified digest in the request\n");
631+
BIO_printf (bio_err, "-timeout n timeout connection to OCSP responder after n seconds\n");
631632
goto end;
632633
}
633634

@@ -1398,16 +1399,7 @@ OCSP_RESPONSE *process_responder(BIO *err, OCSP_REQUEST *req,
13981399
if (use_ssl == 1)
13991400
{
14001401
BIO *sbio;
1401-
#if !defined(OPENSSL_NO_SSL2) && !defined(OPENSSL_NO_SSL3)
14021402
ctx = SSL_CTX_new(SSLv23_client_method());
1403-
#elif !defined(OPENSSL_NO_SSL3)
1404-
ctx = SSL_CTX_new(SSLv3_client_method());
1405-
#elif !defined(OPENSSL_NO_SSL2)
1406-
ctx = SSL_CTX_new(SSLv2_client_method());
1407-
#else
1408-
BIO_printf(err, "SSL is disabled\n");
1409-
goto end;
1410-
#endif
14111403
if (ctx == NULL)
14121404
{
14131405
BIO_printf(err, "Error creating SSL context.\n");

‎deps/openssl/openssl/apps/openssl.c

+3-2
Original file line numberDiff line numberDiff line change
@@ -435,9 +435,7 @@ int main(int Argc, char *ARGV[])
435435
if (prog != NULL) lh_FUNCTION_free(prog);
436436
if (arg.data != NULL) OPENSSL_free(arg.data);
437437

438-
apps_shutdown();
439438

440-
CRYPTO_mem_leaks(bio_err);
441439
if (bio_err != NULL)
442440
{
443441
BIO_free(bio_err);
@@ -450,6 +448,9 @@ int main(int Argc, char *ARGV[])
450448
OPENSSL_free(Argv);
451449
}
452450
#endif
451+
apps_shutdown();
452+
CRYPTO_mem_leaks(bio_err);
453+
453454
OPENSSL_EXIT(ret);
454455
}
455456

0 commit comments

Comments
 (0)