Skip to content

Commit 995df8c

Browse files
hadflhadfl
authored
Merge pull request #3466 from citrus-it/opensslr38
OpenSSL updates (r151038)
2 parents 2d7efd6 + 75464ff commit 995df8c

File tree

6 files changed

+227
-4
lines changed

6 files changed

+227
-4
lines changed

‎build/openssl/build-1.0.sh

+2-2
Original file line numberDiff line numberDiff line change
@@ -13,13 +13,13 @@
1313
# }}}
1414
#
1515
# Copyright 2017 OmniTI Computer Consulting, Inc. All rights reserved.
16-
# Copyright 2023 OmniOS Community Edition (OmniOSce) Association.
16+
# Copyright 2024 OmniOS Community Edition (OmniOSce) Association.
1717
#
1818
. ../../lib/functions.sh
1919

2020
PROG=openssl
2121
VER=1.0.2u
22-
DASHREV=4
22+
DASHREV=5
2323
PKG=library/security/openssl-10
2424
SUMMARY="Cryptography and SSL/TLS Toolkit"
2525
DESC="A toolkit for Secure Sockets Layer and Transport Layer protocols "

‎build/openssl/build-1.1.sh

+3-2
Original file line numberDiff line numberDiff line change
@@ -13,12 +13,13 @@
1313
# }}}
1414
#
1515
# Copyright 2017 OmniTI Computer Consulting, Inc. All rights reserved.
16-
# Copyright 2023 OmniOS Community Edition (OmniOSce) Association.
16+
# Copyright 2024 OmniOS Community Edition (OmniOSce) Association.
1717
#
1818
. ../../lib/functions.sh
1919

2020
PROG=openssl
21-
VER=1.1.1v
21+
VER=1.1.1w
22+
DASHREV=1
2223
PKG=library/security/openssl-11
2324
SUMMARY="Cryptography and SSL/TLS Toolkit"
2425
DESC="A toolkit for Secure Sockets Layer and Transport Layer protocols "

‎build/openssl/patches-1.0/CVE-2024-0727.patch

+110
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,110 @@
1+
From 09df4395b5071217b76dc7d3d2e630eb8c5a79c2 Mon Sep 17 00:00:00 2001
2+
From: Matt Caswell <matt@openssl.org>
3+
Date: Fri, 19 Jan 2024 11:28:58 +0000
4+
Subject: [PATCH] Add NULL checks where ContentInfo data can be NULL
5+
6+
PKCS12 structures contain PKCS7 ContentInfo fields. These fields are
7+
optional and can be NULL even if the "type" is a valid value. OpenSSL
8+
was not properly accounting for this and a NULL dereference can occur
9+
causing a crash.
10+
11+
CVE-2024-0727
12+
13+
Reviewed-by: Tomas Mraz <tomas@openssl.org>
14+
Reviewed-by: Hugo Landau <hlandau@openssl.org>
15+
Reviewed-by: Neil Horman <nhorman@openssl.org>
16+
(Merged from https://github.com/openssl/openssl/pull/23362)
17+
18+
(cherry picked from commit d135eeab8a5dbf72b3da5240bab9ddb7678dbd2c)
19+
diff -wpruN --no-dereference '--exclude=*.orig' a~/crypto/pkcs12/p12_add.c a/crypto/pkcs12/p12_add.c
20+
--- a~/crypto/pkcs12/p12_add.c 1970-01-01 00:00:00
21+
+++ a/crypto/pkcs12/p12_add.c 1970-01-01 00:00:00
22+
@@ -171,6 +171,13 @@ STACK_OF(PKCS12_SAFEBAG) *PKCS12_unpack_
23+
PKCS12_R_CONTENT_TYPE_NOT_DATA);
24+
return NULL;
25+
}
26+
+
27+
+ if (p7->d.data == NULL) {
28+
+ PKCS12err(PKCS12_F_PKCS12_UNPACK_P7DATA,
29+
+ PKCS12_R_DECODE_ERROR);
30+
+ return NULL;
31+
+ }
32+
+
33+
return ASN1_item_unpack(p7->d.data, ASN1_ITEM_rptr(PKCS12_SAFEBAGS));
34+
}
35+
36+
@@ -226,6 +233,13 @@ STACK_OF(PKCS12_SAFEBAG) *PKCS12_unpack_
37+
{
38+
if (!PKCS7_type_is_encrypted(p7))
39+
return NULL;
40+
+
41+
+ if (p7->d.encrypted == NULL) {
42+
+ PKCS12err(PKCS12_F_PKCS12_UNPACK_P7DATA,
43+
+ PKCS12_R_DECODE_ERROR);
44+
+ return NULL;
45+
+ }
46+
+
47+
return PKCS12_item_decrypt_d2i(p7->d.encrypted->enc_data->algorithm,
48+
ASN1_ITEM_rptr(PKCS12_SAFEBAGS),
49+
pass, passlen,
50+
@@ -253,6 +267,13 @@ STACK_OF(PKCS7) *PKCS12_unpack_authsafes
51+
PKCS12_R_CONTENT_TYPE_NOT_DATA);
52+
return NULL;
53+
}
54+
+
55+
+ if (p12->authsafes->d.data == NULL) {
56+
+ PKCS12err(PKCS12_F_PKCS12_UNPACK_AUTHSAFES,
57+
+ PKCS12_R_DECODE_ERROR);
58+
+ return NULL;
59+
+ }
60+
+
61+
return ASN1_item_unpack(p12->authsafes->d.data,
62+
ASN1_ITEM_rptr(PKCS12_AUTHSAFES));
63+
}
64+
diff -wpruN --no-dereference '--exclude=*.orig' a~/crypto/pkcs12/p12_mutl.c a/crypto/pkcs12/p12_mutl.c
65+
--- a~/crypto/pkcs12/p12_mutl.c 1970-01-01 00:00:00
66+
+++ a/crypto/pkcs12/p12_mutl.c 1970-01-01 00:00:00
67+
@@ -80,6 +80,11 @@ int PKCS12_gen_mac(PKCS12 *p12, const ch
68+
return 0;
69+
}
70+
71+
+ if (p12->authsafes->d.data == NULL) {
72+
+ PKCS12err(PKCS12_F_PKCS12_GEN_MAC, PKCS12_R_DECODE_ERROR);
73+
+ return 0;
74+
+ }
75+
+
76+
salt = p12->mac->salt->data;
77+
saltlen = p12->mac->salt->length;
78+
if (!p12->mac->iter)
79+
diff -wpruN --no-dereference '--exclude=*.orig' a~/crypto/pkcs12/p12_npas.c a/crypto/pkcs12/p12_npas.c
80+
--- a~/crypto/pkcs12/p12_npas.c 1970-01-01 00:00:00
81+
+++ a/crypto/pkcs12/p12_npas.c 1970-01-01 00:00:00
82+
@@ -126,7 +126,8 @@ static int newpass_p12(PKCS12 *p12, cons
83+
bags = PKCS12_unpack_p7data(p7);
84+
} else if (bagnid == NID_pkcs7_encrypted) {
85+
bags = PKCS12_unpack_p7encdata(p7, oldpass, -1);
86+
- if (!alg_get(p7->d.encrypted->enc_data->algorithm,
87+
+ if (p7->d.encrypted == NULL
88+
+ || !alg_get(p7->d.encrypted->enc_data->algorithm,
89+
&pbe_nid, &pbe_iter, &pbe_saltlen))
90+
goto err;
91+
} else {
92+
diff -wpruN --no-dereference '--exclude=*.orig' a~/crypto/pkcs7/pk7_mime.c a/crypto/pkcs7/pk7_mime.c
93+
--- a~/crypto/pkcs7/pk7_mime.c 1970-01-01 00:00:00
94+
+++ a/crypto/pkcs7/pk7_mime.c 1970-01-01 00:00:00
95+
@@ -78,10 +78,13 @@ int SMIME_write_PKCS7(BIO *bio, PKCS7 *p
96+
{
97+
STACK_OF(X509_ALGOR) *mdalgs;
98+
int ctype_nid = OBJ_obj2nid(p7->type);
99+
- if (ctype_nid == NID_pkcs7_signed)
100+
+ if (ctype_nid == NID_pkcs7_signed) {
101+
+ if (p7->d.sign == NULL)
102+
+ return 0;
103+
mdalgs = p7->d.sign->md_algs;
104+
- else
105+
+ } else {
106+
mdalgs = NULL;
107+
+ }
108+
109+
flags ^= SMIME_OLDMIME;
110+

‎build/openssl/patches-1.0/series

+1
Original file line numberDiff line numberDiff line change
@@ -18,3 +18,4 @@ CVE-2023-0465.patch
1818
CVE-2023-2650.patch
1919
CVE-2023-3446.patch
2020
CVE-2023-3817.patch
21+
CVE-2024-0727.patch

‎build/openssl/patches-1.1/CVE-2024-0727.patch

+110
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,110 @@
1+
From 09df4395b5071217b76dc7d3d2e630eb8c5a79c2 Mon Sep 17 00:00:00 2001
2+
From: Matt Caswell <matt@openssl.org>
3+
Date: Fri, 19 Jan 2024 11:28:58 +0000
4+
Subject: [PATCH] Add NULL checks where ContentInfo data can be NULL
5+
6+
PKCS12 structures contain PKCS7 ContentInfo fields. These fields are
7+
optional and can be NULL even if the "type" is a valid value. OpenSSL
8+
was not properly accounting for this and a NULL dereference can occur
9+
causing a crash.
10+
11+
CVE-2024-0727
12+
13+
Reviewed-by: Tomas Mraz <tomas@openssl.org>
14+
Reviewed-by: Hugo Landau <hlandau@openssl.org>
15+
Reviewed-by: Neil Horman <nhorman@openssl.org>
16+
(Merged from https://github.com/openssl/openssl/pull/23362)
17+
18+
(cherry picked from commit d135eeab8a5dbf72b3da5240bab9ddb7678dbd2c)
19+
diff -wpruN --no-dereference '--exclude=*.orig' a~/crypto/pkcs12/p12_add.c a/crypto/pkcs12/p12_add.c
20+
--- a~/crypto/pkcs12/p12_add.c 1970-01-01 00:00:00
21+
+++ a/crypto/pkcs12/p12_add.c 1970-01-01 00:00:00
22+
@@ -76,6 +76,13 @@ STACK_OF(PKCS12_SAFEBAG) *PKCS12_unpack_
23+
PKCS12_R_CONTENT_TYPE_NOT_DATA);
24+
return NULL;
25+
}
26+
+
27+
+ if (p7->d.data == NULL) {
28+
+ PKCS12err(PKCS12_F_PKCS12_UNPACK_P7DATA,
29+
+ PKCS12_R_DECODE_ERROR);
30+
+ return NULL;
31+
+ }
32+
+
33+
return ASN1_item_unpack(p7->d.data, ASN1_ITEM_rptr(PKCS12_SAFEBAGS));
34+
}
35+
36+
@@ -132,6 +139,13 @@ STACK_OF(PKCS12_SAFEBAG) *PKCS12_unpack_
37+
{
38+
if (!PKCS7_type_is_encrypted(p7))
39+
return NULL;
40+
+
41+
+ if (p7->d.encrypted == NULL) {
42+
+ PKCS12err(PKCS12_F_PKCS12_UNPACK_P7DATA,
43+
+ PKCS12_R_DECODE_ERROR);
44+
+ return NULL;
45+
+ }
46+
+
47+
return PKCS12_item_decrypt_d2i(p7->d.encrypted->enc_data->algorithm,
48+
ASN1_ITEM_rptr(PKCS12_SAFEBAGS),
49+
pass, passlen,
50+
@@ -159,6 +173,13 @@ STACK_OF(PKCS7) *PKCS12_unpack_authsafes
51+
PKCS12_R_CONTENT_TYPE_NOT_DATA);
52+
return NULL;
53+
}
54+
+
55+
+ if (p12->authsafes->d.data == NULL) {
56+
+ PKCS12err(PKCS12_F_PKCS12_UNPACK_AUTHSAFES,
57+
+ PKCS12_R_DECODE_ERROR);
58+
+ return NULL;
59+
+ }
60+
+
61+
return ASN1_item_unpack(p12->authsafes->d.data,
62+
ASN1_ITEM_rptr(PKCS12_AUTHSAFES));
63+
}
64+
diff -wpruN --no-dereference '--exclude=*.orig' a~/crypto/pkcs12/p12_mutl.c a/crypto/pkcs12/p12_mutl.c
65+
--- a~/crypto/pkcs12/p12_mutl.c 1970-01-01 00:00:00
66+
+++ a/crypto/pkcs12/p12_mutl.c 1970-01-01 00:00:00
67+
@@ -93,6 +93,11 @@ static int pkcs12_gen_mac(PKCS12 *p12, c
68+
return 0;
69+
}
70+
71+
+ if (p12->authsafes->d.data == NULL) {
72+
+ PKCS12err(PKCS12_F_PKCS12_GEN_MAC, PKCS12_R_DECODE_ERROR);
73+
+ return 0;
74+
+ }
75+
+
76+
salt = p12->mac->salt->data;
77+
saltlen = p12->mac->salt->length;
78+
if (!p12->mac->iter)
79+
diff -wpruN --no-dereference '--exclude=*.orig' a~/crypto/pkcs12/p12_npas.c a/crypto/pkcs12/p12_npas.c
80+
--- a~/crypto/pkcs12/p12_npas.c 1970-01-01 00:00:00
81+
+++ a/crypto/pkcs12/p12_npas.c 1970-01-01 00:00:00
82+
@@ -78,7 +78,8 @@ static int newpass_p12(PKCS12 *p12, cons
83+
bags = PKCS12_unpack_p7data(p7);
84+
} else if (bagnid == NID_pkcs7_encrypted) {
85+
bags = PKCS12_unpack_p7encdata(p7, oldpass, -1);
86+
- if (!alg_get(p7->d.encrypted->enc_data->algorithm,
87+
+ if (p7->d.encrypted == NULL
88+
+ || !alg_get(p7->d.encrypted->enc_data->algorithm,
89+
&pbe_nid, &pbe_iter, &pbe_saltlen))
90+
goto err;
91+
} else {
92+
diff -wpruN --no-dereference '--exclude=*.orig' a~/crypto/pkcs7/pk7_mime.c a/crypto/pkcs7/pk7_mime.c
93+
--- a~/crypto/pkcs7/pk7_mime.c 1970-01-01 00:00:00
94+
+++ a/crypto/pkcs7/pk7_mime.c 1970-01-01 00:00:00
95+
@@ -30,10 +30,13 @@ int SMIME_write_PKCS7(BIO *bio, PKCS7 *p
96+
{
97+
STACK_OF(X509_ALGOR) *mdalgs;
98+
int ctype_nid = OBJ_obj2nid(p7->type);
99+
- if (ctype_nid == NID_pkcs7_signed)
100+
+ if (ctype_nid == NID_pkcs7_signed) {
101+
+ if (p7->d.sign == NULL)
102+
+ return 0;
103+
mdalgs = p7->d.sign->md_algs;
104+
- else
105+
+ } else {
106+
mdalgs = NULL;
107+
+ }
108+
109+
flags ^= SMIME_OLDMIME;
110+

‎build/openssl/patches-1.1/series

+1
Original file line numberDiff line numberDiff line change
@@ -1 +1,2 @@
11
libs.patch
2+
CVE-2024-0727.patch

0 commit comments

Comments
 (0)