diff options
Diffstat (limited to 'dev-libs/openssl/files')
6 files changed, 263 insertions, 0 deletions
diff --git a/dev-libs/openssl/files/openssl-1.1.1t-CVE-2023-0465.patch b/dev-libs/openssl/files/openssl-1.1.1t-CVE-2023-0465.patch new file mode 100644 index 000000000000..c332e0bd2c9f --- /dev/null +++ b/dev-libs/openssl/files/openssl-1.1.1t-CVE-2023-0465.patch @@ -0,0 +1,48 @@ +commit b013765abfa80036dc779dd0e50602c57bb3bf95 +Author: Matt Caswell <matt@openssl.org> +Date: Tue Mar 7 16:52:55 2023 +0000 + + Ensure that EXFLAG_INVALID_POLICY is checked even in leaf certs + + Even though we check the leaf cert to confirm it is valid, we + later ignored the invalid flag and did not notice that the leaf + cert was bad. + + Fixes: CVE-2023-0465 + + Reviewed-by: Hugo Landau <hlandau@openssl.org> + Reviewed-by: Tomas Mraz <tomas@openssl.org> + (Merged from https://github.com/openssl/openssl/pull/20588) + +diff --git a/crypto/x509/x509_vfy.c b/crypto/x509/x509_vfy.c +index 925fbb5412..1dfe4f9f31 100644 +--- a/crypto/x509/x509_vfy.c ++++ b/crypto/x509/x509_vfy.c +@@ -1649,18 +1649,25 @@ static int check_policy(X509_STORE_CTX *ctx) + } + /* Invalid or inconsistent extensions */ + if (ret == X509_PCY_TREE_INVALID) { +- int i; ++ int i, cbcalled = 0; + + /* Locate certificates with bad extensions and notify callback. */ +- for (i = 1; i < sk_X509_num(ctx->chain); i++) { ++ for (i = 0; i < sk_X509_num(ctx->chain); i++) { + X509 *x = sk_X509_value(ctx->chain, i); + + if (!(x->ex_flags & EXFLAG_INVALID_POLICY)) + continue; ++ cbcalled = 1; + if (!verify_cb_cert(ctx, x, i, + X509_V_ERR_INVALID_POLICY_EXTENSION)) + return 0; + } ++ if (!cbcalled) { ++ /* Should not be able to get here */ ++ X509err(X509_F_CHECK_POLICY, ERR_R_INTERNAL_ERROR); ++ return 0; ++ } ++ /* The callback ignored the error so we return success */ + return 1; + } + if (ret == X509_PCY_TREE_FAILURE) { diff --git a/dev-libs/openssl/files/openssl-1.1.1t-CVE-2023-0466.patch b/dev-libs/openssl/files/openssl-1.1.1t-CVE-2023-0466.patch new file mode 100644 index 000000000000..9a59d2846a48 --- /dev/null +++ b/dev-libs/openssl/files/openssl-1.1.1t-CVE-2023-0466.patch @@ -0,0 +1,41 @@ +commit 0d16b7e99aafc0b4a6d729eec65a411a7e025f0a +Author: Tomas Mraz <tomas@openssl.org> +Date: Tue Mar 21 16:15:47 2023 +0100 + + Fix documentation of X509_VERIFY_PARAM_add0_policy() + + The function was incorrectly documented as enabling policy checking. + + Fixes: CVE-2023-0466 + + Reviewed-by: Matt Caswell <matt@openssl.org> + Reviewed-by: Paul Dale <pauli@openssl.org> + (Merged from https://github.com/openssl/openssl/pull/20564) + +diff --git a/doc/man3/X509_VERIFY_PARAM_set_flags.pod b/doc/man3/X509_VERIFY_PARAM_set_flags.pod +index f6f304bf7b..aa292f9336 100644 +--- a/doc/man3/X509_VERIFY_PARAM_set_flags.pod ++++ b/doc/man3/X509_VERIFY_PARAM_set_flags.pod +@@ -92,8 +92,9 @@ B<trust>. + X509_VERIFY_PARAM_set_time() sets the verification time in B<param> to + B<t>. Normally the current time is used. + +-X509_VERIFY_PARAM_add0_policy() enables policy checking (it is disabled +-by default) and adds B<policy> to the acceptable policy set. ++X509_VERIFY_PARAM_add0_policy() adds B<policy> to the acceptable policy set. ++Contrary to preexisting documentation of this function it does not enable ++policy checking. + + X509_VERIFY_PARAM_set1_policies() enables policy checking (it is disabled + by default) and sets the acceptable policy set to B<policies>. Any existing +@@ -377,6 +378,10 @@ and has no effect. + + The X509_VERIFY_PARAM_get_hostflags() function was added in OpenSSL 1.1.0i. + ++The function X509_VERIFY_PARAM_add0_policy() was historically documented as ++enabling policy checking however the implementation has never done this. ++The documentation was changed to align with the implementation. ++ + =head1 COPYRIGHT + + Copyright 2009-2020 The OpenSSL Project Authors. All Rights Reserved. diff --git a/dev-libs/openssl/files/openssl-3.0.8-CVE-2023-0465.patch b/dev-libs/openssl/files/openssl-3.0.8-CVE-2023-0465.patch new file mode 100644 index 000000000000..852706d8aa92 --- /dev/null +++ b/dev-libs/openssl/files/openssl-3.0.8-CVE-2023-0465.patch @@ -0,0 +1,46 @@ +commit 1dd43e0709fece299b15208f36cc7c76209ba0bb +Author: Matt Caswell <matt@openssl.org> +Date: Tue Mar 7 16:52:55 2023 +0000 + + Ensure that EXFLAG_INVALID_POLICY is checked even in leaf certs + + Even though we check the leaf cert to confirm it is valid, we + later ignored the invalid flag and did not notice that the leaf + cert was bad. + + Fixes: CVE-2023-0465 + + Reviewed-by: Hugo Landau <hlandau@openssl.org> + Reviewed-by: Tomas Mraz <tomas@openssl.org> + (Merged from https://github.com/openssl/openssl/pull/20587) + +diff --git a/crypto/x509/x509_vfy.c b/crypto/x509/x509_vfy.c +index 9384f1da9b..a0282c3ef1 100644 +--- a/crypto/x509/x509_vfy.c ++++ b/crypto/x509/x509_vfy.c +@@ -1654,15 +1654,23 @@ static int check_policy(X509_STORE_CTX *ctx) + goto memerr; + /* Invalid or inconsistent extensions */ + if (ret == X509_PCY_TREE_INVALID) { +- int i; ++ int i, cbcalled = 0; + + /* Locate certificates with bad extensions and notify callback. */ +- for (i = 1; i < sk_X509_num(ctx->chain); i++) { ++ for (i = 0; i < sk_X509_num(ctx->chain); i++) { + X509 *x = sk_X509_value(ctx->chain, i); + ++ if ((x->ex_flags & EXFLAG_INVALID_POLICY) != 0) ++ cbcalled = 1; + CB_FAIL_IF((x->ex_flags & EXFLAG_INVALID_POLICY) != 0, + ctx, x, i, X509_V_ERR_INVALID_POLICY_EXTENSION); + } ++ if (!cbcalled) { ++ /* Should not be able to get here */ ++ ERR_raise(ERR_LIB_X509, ERR_R_INTERNAL_ERROR); ++ return 0; ++ } ++ /* The callback ignored the error so we return success */ + return 1; + } + if (ret == X509_PCY_TREE_FAILURE) { diff --git a/dev-libs/openssl/files/openssl-3.0.8-CVE-2023-0466.patch b/dev-libs/openssl/files/openssl-3.0.8-CVE-2023-0466.patch new file mode 100644 index 000000000000..c71665d82e18 --- /dev/null +++ b/dev-libs/openssl/files/openssl-3.0.8-CVE-2023-0466.patch @@ -0,0 +1,41 @@ +commit 51e8a84ce742db0f6c70510d0159dad8f7825908 +Author: Tomas Mraz <tomas@openssl.org> +Date: Tue Mar 21 16:15:47 2023 +0100 + + Fix documentation of X509_VERIFY_PARAM_add0_policy() + + The function was incorrectly documented as enabling policy checking. + + Fixes: CVE-2023-0466 + + Reviewed-by: Matt Caswell <matt@openssl.org> + Reviewed-by: Paul Dale <pauli@openssl.org> + (Merged from https://github.com/openssl/openssl/pull/20563) + +diff --git a/doc/man3/X509_VERIFY_PARAM_set_flags.pod b/doc/man3/X509_VERIFY_PARAM_set_flags.pod +index 75a1677022..43c1900bca 100644 +--- a/doc/man3/X509_VERIFY_PARAM_set_flags.pod ++++ b/doc/man3/X509_VERIFY_PARAM_set_flags.pod +@@ -98,8 +98,9 @@ B<trust>. + X509_VERIFY_PARAM_set_time() sets the verification time in B<param> to + B<t>. Normally the current time is used. + +-X509_VERIFY_PARAM_add0_policy() enables policy checking (it is disabled +-by default) and adds B<policy> to the acceptable policy set. ++X509_VERIFY_PARAM_add0_policy() adds B<policy> to the acceptable policy set. ++Contrary to preexisting documentation of this function it does not enable ++policy checking. + + X509_VERIFY_PARAM_set1_policies() enables policy checking (it is disabled + by default) and sets the acceptable policy set to B<policies>. Any existing +@@ -400,6 +401,10 @@ The X509_VERIFY_PARAM_get_hostflags() function was added in OpenSSL 1.1.0i. + The X509_VERIFY_PARAM_get0_host(), X509_VERIFY_PARAM_get0_email(), + and X509_VERIFY_PARAM_get1_ip_asc() functions were added in OpenSSL 3.0. + ++The function X509_VERIFY_PARAM_add0_policy() was historically documented as ++enabling policy checking however the implementation has never done this. ++The documentation was changed to align with the implementation. ++ + =head1 COPYRIGHT + + Copyright 2009-2023 The OpenSSL Project Authors. All Rights Reserved. diff --git a/dev-libs/openssl/files/openssl-3.1.0-CVE-2023-0465.patch b/dev-libs/openssl/files/openssl-3.1.0-CVE-2023-0465.patch new file mode 100644 index 000000000000..a98f7cba13bd --- /dev/null +++ b/dev-libs/openssl/files/openssl-3.1.0-CVE-2023-0465.patch @@ -0,0 +1,46 @@ +commit facfb1ab745646e97a1920977ae4a9965ea61d5c +Author: Matt Caswell <matt@openssl.org> +Date: Tue Mar 7 16:52:55 2023 +0000 + + Ensure that EXFLAG_INVALID_POLICY is checked even in leaf certs + + Even though we check the leaf cert to confirm it is valid, we + later ignored the invalid flag and did not notice that the leaf + cert was bad. + + Fixes: CVE-2023-0465 + + Reviewed-by: Hugo Landau <hlandau@openssl.org> + Reviewed-by: Tomas Mraz <tomas@openssl.org> + (Merged from https://github.com/openssl/openssl/pull/20586) + +diff --git a/crypto/x509/x509_vfy.c b/crypto/x509/x509_vfy.c +index 9384f1da9b..a0282c3ef1 100644 +--- a/crypto/x509/x509_vfy.c ++++ b/crypto/x509/x509_vfy.c +@@ -1654,15 +1654,23 @@ static int check_policy(X509_STORE_CTX *ctx) + goto memerr; + /* Invalid or inconsistent extensions */ + if (ret == X509_PCY_TREE_INVALID) { +- int i; ++ int i, cbcalled = 0; + + /* Locate certificates with bad extensions and notify callback. */ +- for (i = 1; i < sk_X509_num(ctx->chain); i++) { ++ for (i = 0; i < sk_X509_num(ctx->chain); i++) { + X509 *x = sk_X509_value(ctx->chain, i); + ++ if ((x->ex_flags & EXFLAG_INVALID_POLICY) != 0) ++ cbcalled = 1; + CB_FAIL_IF((x->ex_flags & EXFLAG_INVALID_POLICY) != 0, + ctx, x, i, X509_V_ERR_INVALID_POLICY_EXTENSION); + } ++ if (!cbcalled) { ++ /* Should not be able to get here */ ++ ERR_raise(ERR_LIB_X509, ERR_R_INTERNAL_ERROR); ++ return 0; ++ } ++ /* The callback ignored the error so we return success */ + return 1; + } + if (ret == X509_PCY_TREE_FAILURE) { diff --git a/dev-libs/openssl/files/openssl-3.1.0-CVE-2023-0466.patch b/dev-libs/openssl/files/openssl-3.1.0-CVE-2023-0466.patch new file mode 100644 index 000000000000..9a315f4c00fd --- /dev/null +++ b/dev-libs/openssl/files/openssl-3.1.0-CVE-2023-0466.patch @@ -0,0 +1,41 @@ +commit fc814a30fc4f0bc54fcea7d9a7462f5457aab061 +Author: Tomas Mraz <tomas@openssl.org> +Date: Tue Mar 21 16:15:47 2023 +0100 + + Fix documentation of X509_VERIFY_PARAM_add0_policy() + + The function was incorrectly documented as enabling policy checking. + + Fixes: CVE-2023-0466 + + Reviewed-by: Paul Dale <pauli@openssl.org> + Reviewed-by: Matt Caswell <matt@openssl.org> + (Merged from https://github.com/openssl/openssl/pull/20562) + +diff --git a/doc/man3/X509_VERIFY_PARAM_set_flags.pod b/doc/man3/X509_VERIFY_PARAM_set_flags.pod +index 20aea99b5b..fcbbfc4c30 100644 +--- a/doc/man3/X509_VERIFY_PARAM_set_flags.pod ++++ b/doc/man3/X509_VERIFY_PARAM_set_flags.pod +@@ -98,8 +98,9 @@ B<trust>. + X509_VERIFY_PARAM_set_time() sets the verification time in B<param> to + B<t>. Normally the current time is used. + +-X509_VERIFY_PARAM_add0_policy() enables policy checking (it is disabled +-by default) and adds B<policy> to the acceptable policy set. ++X509_VERIFY_PARAM_add0_policy() adds B<policy> to the acceptable policy set. ++Contrary to preexisting documentation of this function it does not enable ++policy checking. + + X509_VERIFY_PARAM_set1_policies() enables policy checking (it is disabled + by default) and sets the acceptable policy set to B<policies>. Any existing +@@ -400,6 +401,10 @@ The X509_VERIFY_PARAM_get_hostflags() function was added in OpenSSL 1.1.0i. + The X509_VERIFY_PARAM_get0_host(), X509_VERIFY_PARAM_get0_email(), + and X509_VERIFY_PARAM_get1_ip_asc() functions were added in OpenSSL 3.0. + ++The function X509_VERIFY_PARAM_add0_policy() was historically documented as ++enabling policy checking however the implementation has never done this. ++The documentation was changed to align with the implementation. ++ + =head1 COPYRIGHT + + Copyright 2009-2023 The OpenSSL Project Authors. All Rights Reserved. |