FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

deps: upgrade openssl sources to 1.1.1k+quic · nodejs/node@bbdcdad · GitHub

/ node Public

Commit bbdcdad

Browse files
hassaanp
authored and
MylesBorins
committed
deps: upgrade openssl sources to 1.1.1k+quic
This updates all sources in deps/openssl/openssl by: $ git clone https://github.com/quictls/openssl $ cd openssl $ git checkout OpenSSL_1_1_1k+quic $ cd ../node/deps/openssl $ rm -rf openssl $ cp -R ../openssl openssl $ cd openssl && rm -rf .gitattributes .github/ .gitmodules .travis-apt-pin.preferences .travis-create-release.sh $ cd .. $ git add --all openssl $ git commit openssl PR-URL: #37916 Fixes: #37913 Reviewed-By: Tobias Nießen <tniessen@tnie.de> Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
1 parent 13c3924 commit bbdcdad

40 files changed

Lines changed: 600 additions & 208 deletions

‎deps/openssl/openssl/CHANGES‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,50 @@
77
https://github.com/openssl/openssl/commits/ and pick the appropriate
88
release branch.
99

10+
Changes between 1.1.1j and 1.1.1k [25 Mar 2021]
11+
12+
*) Fixed a problem with verifying a certificate chain when using the
13+
X509_V_FLAG_X509_STRICT flag. This flag enables additional security checks
14+
of the certificates present in a certificate chain. It is not set by
15+
default.
16+
17+
Starting from OpenSSL version 1.1.1h a check to disallow certificates in
18+
the chain that have explicitly encoded elliptic curve parameters was added
19+
as an additional strict check.
20+
21+
An error in the implementation of this check meant that the result of a
22+
previous check to confirm that certificates in the chain are valid CA
23+
certificates was overwritten. This effectively bypasses the check
24+
that non-CA certificates must not be able to issue other certificates.
25+
26+
If a "purpose" has been configured then there is a subsequent opportunity
27+
for checks that the certificate is a valid CA. All of the named "purpose"
28+
values implemented in libcrypto perform this check. Therefore, where
29+
a purpose is set the certificate chain will still be rejected even when the
30+
strict flag has been used. A purpose is set by default in libssl client and
31+
server certificate verification routines, but it can be overridden or
32+
removed by an application.
33+
34+
In order to be affected, an application must explicitly set the
35+
X509_V_FLAG_X509_STRICT verification flag and either not set a purpose
36+
for the certificate verification or, in the case of TLS client or server
37+
applications, override the default purpose.
38+
(CVE-2021-3450)
39+
[Tomáš Mráz]
40+
41+
*) Fixed an issue where an OpenSSL TLS server may crash if sent a maliciously
42+
crafted renegotiation ClientHello message from a client. If a TLSv1.2
43+
renegotiation ClientHello omits the signature_algorithms extension (where
44+
it was present in the initial ClientHello), but includes a
45+
signature_algorithms_cert extension then a NULL pointer dereference will
46+
result, leading to a crash and a denial of service attack.
47+
48+
A server is only vulnerable if it has TLSv1.2 and renegotiation enabled
49+
(which is the default configuration). OpenSSL TLS clients are not impacted
50+
by this issue.
51+
(CVE-2021-3449)
52+
[Peter Kästle and Samuel Sapalski]
53+
1054
Changes between 1.1.1i and 1.1.1j [16 Feb 2021]
1155

1256
*) Fixed the X509_issuer_and_serial_hash() function. It attempts to

‎deps/openssl/openssl/Configurations/unix-Makefile.tmpl‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -917,8 +917,8 @@ errors:
917917
done )
918918
919919
ordinals:
920-
( b=`pwd`; cd $(SRCDIR); $(PERL) -I$$b util/mkdef.pl crypto update )
921-
( b=`pwd`; cd $(SRCDIR); $(PERL) -I$$b util/mkdef.pl ssl update )
920+
$(PERL) $(SRCDIR)/util/mkdef.pl crypto update
921+
$(PERL) $(SRCDIR)/util/mkdef.pl ssl update
922922
923923
test_ordinals:
924924
( cd test; \

‎deps/openssl/openssl/NEWS‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,14 @@
55
This file gives a brief overview of the major changes between each OpenSSL
66
release. For more details please read the CHANGES file.
77

8+
Major changes between OpenSSL 1.1.1j and OpenSSL 1.1.1k [25 Mar 2021]
9+
10+
o Fixed a problem with verifying a certificate chain when using the
11+
X509_V_FLAG_X509_STRICT flag (CVE-2021-3450)
12+
o Fixed an issue where an OpenSSL TLS server may crash if sent a
13+
maliciously crafted renegotiation ClientHello message from a client
14+
(CVE-2021-3449)
15+
816
Major changes between OpenSSL 1.1.1i and OpenSSL 1.1.1j [16 Feb 2021]
917

1018
o Fixed a NULL pointer deref in the X509_issuer_and_serial_hash()

‎deps/openssl/openssl/README‎

Lines changed: 0 additions & 93 deletions
This file was deleted.

‎deps/openssl/openssl/README-OpenSSL.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11

2-
OpenSSL 1.1.1j 16 Feb 2021
2+
OpenSSL 1.1.1k 25 Mar 2021
33

4-
Copyright (c) 1998-2020 The OpenSSL Project
4+
Copyright (c) 1998-2021 The OpenSSL Project
55
Copyright (c) 1995-1998 Eric A. Young, Tim J. Hudson
66
All rights reserved.
77

‎deps/openssl/openssl/README.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -47,7 +47,7 @@ How are you keeping current with OpenSSL?
4747
-----------------------------------------
4848
(In other words, "What about rebasing?")
4949

50-
Our plan it to always rebase on top of an upstream release tag. In particular:
50+
Our plan is to always rebase on top of an upstream release tag. In particular:
5151
- The changes for QUIC will always be at the tip of the branch -- you will know what
5252
is from the original OpenSSL and what is for QUIC.
5353
- New versions are quickly created once upstream creates a new tag.

‎deps/openssl/openssl/apps/s_cb.c‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 1995-2020 The OpenSSL Project Authors. All Rights Reserved.
2+
* Copyright 1995-2021 The OpenSSL Project Authors. All Rights Reserved.
33
*
44
* Licensed under the OpenSSL license (the "License"). You may not use
55
* this file except in compliance with the License. You can obtain a copy
@@ -934,7 +934,8 @@ static int set_cert_cb(SSL *ssl, void *arg)
934934
if (!SSL_build_cert_chain(ssl, 0))
935935
return 0;
936936
} else if (exc->chain != NULL) {
937-
SSL_set1_chain(ssl, exc->chain);
937+
if (!SSL_set1_chain(ssl, exc->chain))
938+
return 0;
938939
}
939940
}
940941
exc = exc->prev;

‎deps/openssl/openssl/apps/s_time.c‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 1995-2020 The OpenSSL Project Authors. All Rights Reserved.
2+
* Copyright 1995-2021 The OpenSSL Project Authors. All Rights Reserved.
33
*
44
* Licensed under the OpenSSL license (the "License"). You may not use
55
* this file except in compliance with the License. You can obtain a copy
@@ -263,7 +263,8 @@ int s_time_main(int argc, char **argv)
263263
nConn, totalTime, ((double)nConn / totalTime), bytes_read);
264264
printf
265265
("%d connections in %ld real seconds, %ld bytes read per connection\n",
266-
nConn, (long)time(NULL) - finishtime + maxtime, bytes_read / nConn);
266+
nConn, (long)time(NULL) - finishtime + maxtime,
267+
nConn > 0 ? bytes_read / nConn : 0l);
267268

268269
/*
269270
* Now loop and time connections using the same session id over and over

‎deps/openssl/openssl/crypto/asn1/asn1_par.c‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 1995-2020 The OpenSSL Project Authors. All Rights Reserved.
2+
* Copyright 1995-2021 The OpenSSL Project Authors. All Rights Reserved.
33
*
44
* Licensed under the OpenSSL license (the "License"). You may not use
55
* this file except in compliance with the License. You can obtain a copy
@@ -325,6 +325,7 @@ static int asn1_parse2(BIO *bp, const unsigned char **pp, long length,
325325
}
326326
if (BIO_puts(bp, "]") <= 0)
327327
goto end;
328+
dump_cont = 0;
328329
}
329330

330331
if (!nl) {

‎deps/openssl/openssl/crypto/asn1/bio_ndef.c‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2008-2018 The OpenSSL Project Authors. All Rights Reserved.
2+
* Copyright 2008-2021 The OpenSSL Project Authors. All Rights Reserved.
33
*
44
* Licensed under the OpenSSL license (the "License"). You may not use
55
* this file except in compliance with the License. You can obtain a copy
@@ -113,6 +113,8 @@ static int ndef_prefix(BIO *b, unsigned char **pbuf, int *plen, void *parg)
113113
ndef_aux = *(NDEF_SUPPORT **)parg;
114114

115115
derlen = ASN1_item_ndef_i2d(ndef_aux->val, NULL, ndef_aux->it);
116+
if (derlen < 0)
117+
return 0;
116118
if ((p = OPENSSL_malloc(derlen)) == NULL) {
117119
ASN1err(ASN1_F_NDEF_PREFIX, ERR_R_MALLOC_FAILURE);
118120
return 0;

0 commit comments

Comments
 (0)
Back | FazBrowse Home | New Git URL