openbsd/src/lib/libcrypto, branch OPENBSD_6_7

Fix a NULL dereference in GENERAL_NAME_cmp()

2020-12-08T15:10:03+00:00

Comparing two GENERAL_NAME structures containing an EDIPARTYNAME can lead to a crash. This enables a denial of service attack for an attacker who can control both sides of the comparison. Issue reported to OpenSSL on Nov 9 by David Benjamin. OpenSSL shared the information with us on Dec 1st. Fix from Matt Caswell (OpenSSL) with a few small tweaks. ok jsing this is errata/6.7/031_asn1.patch.sig

OpenBSD 6.7 errata 010, June 11, 2020 (6.7/010_x509.patch.sig)

2020-06-10T03:56:22+00:00

original commit: CVSROOT: /cvs Module name: src Changes by: jsing@cvs.openbsd.org 2020/05/31 11:23:39 Modified files: lib/libcrypto/x509: x509_vfy.c Log message: When building a chain look for non-expired certificates first. Currently, when building a certificate chain we look up an issuer and if it is the only issuer certificate available we still use it even if it has expired. When X509_V_FLAG_TRUSTED_FIRST is not in use, untrusted certificates are processed first and if one of these happens to be expired it will be used to build the chain, even if there is another non-expired option in the trusted store. Rework this code so that we first look for a non-expired untrusted certificate. If one does not exist then we take a look in the trusted store to see if we would be able to build the chain and only if there is not, do we then look for an expired untrusted certificate. This makes certificate validation possible for various sites that are serving expired AddTrust certificates. Issue reported by Christian Heimes via GitHub. ok beck@ tb@

LibreSSL 3.1.2

2020-05-21T02:27:34+00:00

Bump LibreSSL version to 3.1.1

2020-05-06T15:45:22+00:00

ok bcook inoguchi deraadt

Disallow setting the AES-GCM IV length to 0

2020-04-30T18:43:11+00:00

It is possible to do this by abusing the EVP_CTRL_INIT API. Pointed out by jsing. ok inoguchi jsing (as part of a larger diff)

Disallow the use of zero length IVs in AES-GCM via

2020-04-27T19:31:02+00:00

EVP_AEAD_CTX_{open,seal}, as this leaks the authentication key. Issue reported and fix tested by Guido Vranken. ok beck, jsing This commit adds a constant to a public header despite library lock, as discussed with deraadt and sthen.

sync cert.pem with Mozilla's root ca list, ok beck@

2020-04-10T12:13:17+00:00

When printing the serialNumber, fall back to the colon separated hex

2020-04-10T07:05:24+00:00

bytes in case ASN1_INTEGER_get() failed. This happens more often since asn1/a_int.c -r1.34. Matches OpenSSL behavior. Issue in openssl x509 -text output reported by sthen ok jsing sthen

Void functions obviously do not return values; no need to elaborate.

2020-03-29T17:05:02+00:00

Patch from Martin Vahlensieck .

Be concise: do not say that void functions return no values, that's obvious.

2020-03-28T22:40:58+00:00

Useless text reported by Martin Vahlensieck (academicsolutions.ch) on tech@.