A mirror of https://github.com/libressl/openbsd.git https://git.lua4.win/openbsd/atom?h=OPENBSD_7_0 2022-03-15T15:54:26+00:00 2022-03-15T15:54:26+00:00 tb 2022-03-15T15:54:26+00:00 urn:sha1:76591ba244323a2970ad751e551ba496278315b1 A bug in the implementation of the Tonelli-Shanks algorithm can lead to an infinite loop. This loop can be hit in various ways, in particular on decompressing an elliptic curve public key via EC_POINT_oct2point() - to do this, one must solve y^2 = x^3 + ax + b for y, given x. If a certificate uses explicit encoding for elliptic curve parameters, this operation needs to be done during certificate verification, leading to a DoS. In particular, everything dealing with untrusted certificates is affected, notably TLS servers explicitly configured to request client certificates (httpd, smtpd, various VPN implementations, ...). Ordinary TLS servers do not consume untrusted certificates. The problem is that we cannot assume that x^3 + ax + b is actually a square on untrusted input and neither can we assume that the modulus p is a prime. Ensuring that p is a prime is too expensive (it would likely itself lead to a DoS). To avoid the infinite loop, fix the logic to be more resilient and explicitly limit the number of iterations that can be done. The bug is such that the infinite loop can also be hit for primes = 3 (mod 4) but fortunately that case is optimized earlier. It's also worth noting that there is a size bound on the field size enforced via OPENSSL_ECC_MAX_FIELD_BITS (= 661), which help mitigate further DoS vectors in presence of this fix. Reported by Tavis Ormandy and David Benjamin, Google Patch based on the fixes by David Benjamin and Tomas Mraz, OpenSSL ok beck inoguchi This is errata/7.0/016_bignum.patch.sig 2021-11-24T09:28:56+00:00 tb 2021-11-24T09:28:56+00:00 urn:sha1:0f0b16dc977f6ca499f0f4540078d992c96da597 certificate chain. This would happen when the verification callback was in use, instructing the verifier to continue unconditionally. This could lead to incorrect decisions being made in software. This is patches/common/006_x509.patch.sig 2021-09-30T18:16:13+00:00 cvs2svn admin@example.com 2021-09-30T18:16:13+00:00 urn:sha1:d7513e7d4daf94905fd4cb0a5e5c89109d2874f7 2021-09-15T17:14:26+00:00 tb 2021-09-15T17:14:26+00:00 urn:sha1:87ad048671e38be9ceea42ed9e24726a49a0167b 2021-09-14T13:47:59+00:00 schwarze 2021-09-14T13:47:59+00:00 urn:sha1:8516f8e8e45c406ec2ca34ec57684ee01de472a5 and OPENSSL_EC_EXPLICIT_CURVE from OpenSSL commit 146ca72c Feb 19 14:35:43 2015 +0000 after tb@ changed the default from 0 to OPENSSL_EC_NAMED_CURVE in ec/ec_lib.c rev. 1.41, which is the same default that OpenSSL uses since 1.1.0. While merging, drop the description of the pre-1.1.0 behaviour. It seems irrelevant to me because tb@ found no application in Debian codesearch using OPENSSL_EC_EXPLICIT_CURVE. A former devious default that was probably never relied upon by anyone does not need to be documented. 2021-09-13T15:26:53+00:00 claudio 2021-09-13T15:26:53+00:00 urn:sha1:a8af1574ae71c3f2012323155f8e2c784780de4c as in all other palces. Check the EXFLAG_SET flag first and if not set grab the CRYPTO_LOCK_X509 before calling x509v3_cache_extensions(). OK tb@ beck@ 2021-09-12T16:23:19+00:00 tb 2021-09-12T16:23:19+00:00 urn:sha1:10e8e3b7f398be5d656d5725a95663a364220e35 The pre-OpenSSL 1.1.0 default was to use explicit curve parameter encoding. Most applications want to use named curve parameter encoding and have to opt into this explicitly. Stephen Henson changed this default in OpenSSL commit 86f300d3 6 years ago and provided a new OPENSSL_EC_EXPLICIT_CURVE define to opt back into the old default. According to Debian's codesearch, no application currently does this, which indicates that we currently have a bad default. In the future it is more likely that applications expect the new default, so we follow OpenSSL to avoid problems. Prompted by schwarze who noted that OPENSSL_EC_EXPLICIT_CURVE is missing. ok beck inoguchi jsing 2021-09-11T17:59:04+00:00 schwarze 2021-09-11T17:59:04+00:00 urn:sha1:6b26e78c6c668c2d81ebf87b49fe16389f658275 branch, which is still under a free license. While here, also merge a few other improvements, mostly regarding EC_GROUP_get_order(3) and EC_GROUP_get_cofactor(3); in particular, some statements below RETURN VALUES were outright wrong. This patch includes a few minor tweaks and an addition to HISTORY by me. Feedback and OK tb@. 2021-09-11T13:31:31+00:00 job 2021-09-11T13:31:31+00:00 urn:sha1:08b230186e0fd125a82664490d49f98aeb69a858 OK tb@ 2021-09-11T08:45:47+00:00 schwarze 2021-09-11T08:45:47+00:00 urn:sha1:b0b3e4e847df0c7cb16cc4610638c96e86735cd5 and BN_lebin2bn(3) from the OpenSSL 1.1.1 branch, which is still under a free license. While here, tweak a number of details for clarity. OK tb@