[openssl-dev] [openssl.org #4685] [PATCH v2] Add missing prototype for FIPS callback
The call to FIPS_crypto_set_id_callback() was added in revision a43cfd7bb1fc681d563e, but there is no prototype for it in . --- Moved the function prototype upwards, because declarations can only be placed at the top of a function in C. crypto/o_init.c | 5 + 1 file changed, 5 insertions(+) diff --git a/crypto/o_init.c b/crypto/o_init.c index 185841e..18bb858 100644 --- a/crypto/o_init.c +++ b/crypto/o_init.c @@ -58,6 +58,11 @@ #ifdef OPENSSL_FIPS # include # include + +# ifndef OPENSSL_NO_DEPRECATED +/* the prototype is missing in */ +void FIPS_crypto_set_id_callback(unsigned long (*func)(void)); +# endif #endif /* -- 2.7.3 -- Ticket here: http://rt.openssl.org/Ticket/Display.html?id=4685 Please log in as guest with password guest if prompted -- openssl-dev mailing list To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-dev
[openssl-dev] CVE-2016-2178 - Constant time flag not preserved in DSA signing
I'm trying to understand the severity of this issue. The demo exploit described here http://eprint.iacr.org/2016/594 relies on the fact the target program and the attacker share the same memory image of the OpenSSL shared library. If my program is statically linked to OpenSSL will that make it more resistant to this type of attack? Or will page de-duplication techniques like Linux KSM make it just as vulnerable as a dynamically linked program? /leif -- openssl-dev mailing list To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-dev
[openssl-dev] [openssl.org #4686] [BUG] Failure to compile if HAVE_CRYPTODEV is defined in OpenSSL 1.0.2i
On Mon Sep 26 14:34:17 2016, rs...@akamai.com wrote: > We have a fix waiting for internal review; see GitHub issue 1546. That's not related to this issue. Cheers, Richard -- Richard Levitte levi...@openssl.org -- Ticket here: http://rt.openssl.org/Ticket/Display.html?id=4686 Please log in as guest with password guest if prompted -- openssl-dev mailing list To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-dev
[openssl-dev] [openssl.org #4686] [BUG] Failure to compile if HAVE_CRYPTODEV is defined in OpenSSL 1.0.2i
That has already been fixed in the 1.0.2 branch, and is part of 1.0.2j, which
was released today.
Cheers,
Richard
On Mon Sep 26 14:32:31 2016, jan-markus.pumpa...@bittium.com wrote:
>
>
> Hi,
>
> When building the OpenSSL 1.0.2i with -DHAVE_CRYPTODEV flag the build
> will fail in crypto/engine/eng_cryptodev.c. I am using 64-bit Ubuntu
> 14.04 in my build machine with gcc toolchain.
>
> For me it looks like there has been a typo in the OPENSSL_malloc
> return value check. Attached patch solves the issue. Below is the
> original error message:
>
> | gcc -I.. -I../.. -I../modes -I../asn1 -I../evp -I../../include
> -fPIC -DOPENSSL_PIC -DOPENSSL_THREADS -D_REENTRANT -DDSO_DLFCN
> -DHAVE_DLFCN_H -DL_ENDIAN -DTERMIO -i/build/tmp/sysroots/x86_64-
> linux/usr/include -O2 -pipe -Wall -Wa,--noexecstack -DHAVE_CRYPTODEV
> -DUSE_CRYPTODEV_DIGESTS -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT
> -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DRC4_ASM -DSHA1_ASM
> -DSHA256_ASM -DSHA512_ASM -DMD5_ASM -DAES_ASM -DVPAES_ASM -DBSAES_ASM
> -DWHIRLPOOL_ASM -DGHASH_ASM -DECP_NISTZ256_ASM
> -ibuild/tmp/sysroots/x86_64-linux/usr/include -c -o eng_cryptodev.o
> eng_cryptodev.c
> | eng_cryptodev.c: In function 'cryptodev_digest_copy':
> | eng_cryptodev.c:942:23: error: 'struct dev_crypto_state' has no
> member named 'ac_data'
> | if (dstate->ac_data == NULL) {
> | ^
> | make[2]: *** [eng_cryptodev.o] Error 1
>
>
> Kind regards,
> Jan-Markus Pumpanen
>
>
> Please note: This e-mail may contain confidential information
> intended solely for the addressee. If you have received this
> e-mail in error, please do not disclose it to anyone, notify
> the sender promptly, and delete the message from your system.
> Thank you.
--
Richard Levitte
levi...@openssl.org
--
Ticket here: http://rt.openssl.org/Ticket/Display.html?id=4686
Please log in as guest with password guest if prompted
--
openssl-dev mailing list
To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-dev
Re: [openssl-dev] [openssl.org #4686] [BUG] Failure to compile if HAVE_CRYPTODEV is defined in OpenSSL 1.0.2i
We have a fix waiting for internal review; see GitHub issue 1546. -- Ticket here: http://rt.openssl.org/Ticket/Display.html?id=4686 Please log in as guest with password guest if prompted -- openssl-dev mailing list To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-dev
[openssl-dev] [openssl.org #4686] [BUG] Failure to compile if HAVE_CRYPTODEV is defined in OpenSSL 1.0.2i
Hi,
When building the OpenSSL 1.0.2i with -DHAVE_CRYPTODEV flag the build will fail
in crypto/engine/eng_cryptodev.c. I am using 64-bit Ubuntu 14.04 in my build
machine with gcc toolchain.
For me it looks like there has been a typo in the OPENSSL_malloc return value
check. Attached patch solves the issue. Below is the original error message:
| gcc -I.. -I../.. -I../modes -I../asn1 -I../evp -I../../include -fPIC
-DOPENSSL_PIC -DOPENSSL_THREADS -D_REENTRANT -DDSO_DLFCN -DHAVE_DLFCN_H
-DL_ENDIAN -DTERMIO -i/build/tmp/sysroots/x86_64-linux/usr/include -O2
-pipe -Wall -Wa,--noexecstack -DHAVE_CRYPTODEV -DUSE_CRYPTODEV_DIGESTS
-DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5
-DOPENSSL_BN_ASM_GF2m -DRC4_ASM -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DMD5_ASM
-DAES_ASM -DVPAES_ASM -DBSAES_ASM -DWHIRLPOOL_ASM -DGHASH_ASM
-DECP_NISTZ256_ASM -ibuild/tmp/sysroots/x86_64-linux/usr/include -c -o
eng_cryptodev.o eng_cryptodev.c
| eng_cryptodev.c: In function 'cryptodev_digest_copy':
| eng_cryptodev.c:942:23: error: 'struct dev_crypto_state' has no member named
'ac_data'
| if (dstate->ac_data == NULL) {
|^
| make[2]: *** [eng_cryptodev.o] Error 1
Kind regards,
Jan-Markus Pumpanen
Please note: This e-mail may contain confidential information
intended solely for the addressee. If you have received this
e-mail in error, please do not disclose it to anyone, notify
the sender promptly, and delete the message from your system.
Thank you.
--
Ticket here: http://rt.openssl.org/Ticket/Display.html?id=4686
Please log in as guest with password guest if prompted
--- clean-openssl-1.0.2i/crypto/engine/eng_cryptodev.c 2016-09-22 13:23:06.0 +0300
+++ openssl-1.0.2i/crypto/engine/eng_cryptodev.c 2016-09-26 16:07:24.724568163 +0300
@@ -939,7 +939,7 @@
if (fstate->mac_len != 0) {
if (fstate->mac_data != NULL) {
dstate->mac_data = OPENSSL_malloc(fstate->mac_len);
-if (dstate->ac_data == NULL) {
+if (dstate->mac_data == NULL) {
printf("cryptodev_digest_init: malloc failed\n");
return 0;
}
--
openssl-dev mailing list
To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-dev
[openssl-dev] [openssl.org #4685] [PATCH] Add missing prototype for FIPS callback
The call to FIPS_crypto_set_id_callback() was added in revision a43cfd7bb1fc681d563e, but there is no prototype for it in . --- This leads to warnings on some platforms (e.g. x86_64-ncp-linux-gnu-gcc): o_init.c:77:5: warning: implicit declaration of function 'FIPS_crypto_set_id_callback' [-Wimplicit-function-declaration] and to an error on iOS (clang -arch arm64): o_init.c:77:5: error: implicit declaration of function 'FIPS_crypto_set_id_callback' is invalid in C99 [-Werror,-Wimplicit-function-declaration] crypto/o_init.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/crypto/o_init.c b/crypto/o_init.c index 185841e..a399318 100644 --- a/crypto/o_init.c +++ b/crypto/o_init.c @@ -74,6 +74,8 @@ void OPENSSL_init(void) #ifdef OPENSSL_FIPS FIPS_set_locking_callbacks(CRYPTO_lock, CRYPTO_add_lock); # ifndef OPENSSL_NO_DEPRECATED +/* the prototype is missing in */ +void FIPS_crypto_set_id_callback(unsigned long (*func)(void)); FIPS_crypto_set_id_callback(CRYPTO_thread_id); # endif FIPS_set_error_callbacks(ERR_put_error, ERR_add_error_vdata); -- 2.7.3 -- Ticket here: http://rt.openssl.org/Ticket/Display.html?id=4685 Please log in as guest with password guest if prompted -- openssl-dev mailing list To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-dev
Re: [openssl-dev] OpenSSL Security Advisory
On 26/09/16 14:16, David Woodhouse wrote: > On Mon, 2016-09-26 at 10:35 +, OpenSSL wrote: > >> Content-Type: text/plain; charset="iso-8859-1" > >> This issue was reported to OpenSSL on 23rd September 2016 by Robert Święcki > > Found by whom? Welcome to the 21st century... :) Yes. Sorry. A problem in our .muttrc file. Fixed now. Matt -- openssl-dev mailing list To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-dev
Re: [openssl-dev] OpenSSL Security Advisory
On Mon, 2016-09-26 at 10:35 +, OpenSSL wrote: > Content-Type: text/plain; charset="iso-8859-1" > This issue was reported to OpenSSL on 23rd September 2016 by Robert Święcki Found by whom? Welcome to the 21st century... :) -- dwmw2 smime.p7s Description: S/MIME cryptographic signature -- openssl-dev mailing list To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-dev
[openssl-dev] OpenSSL Security Advisory
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 OpenSSL Security Advisory [26 Sep 2016] This security update addresses issues that were caused by patches included in our previous security update, released on 22nd September 2016. Given the Critical severity of one of these flaws we have chosen to release this advisory immediately to prevent upgrades to the affected version, rather than delaying in order to provide our usual public pre-notification. Fix Use After Free for large message sizes (CVE-2016-6309) == Severity: Critical This issue only affects OpenSSL 1.1.0a, released on 22nd September 2016. The patch applied to address CVE-2016-6307 resulted in an issue where if a message larger than approx 16k is received then the underlying buffer to store the incoming message is reallocated and moved. Unfortunately a dangling pointer to the old location is left which results in an attempt to write to the previously freed location. This is likely to result in a crash, however it could potentially lead to execution of arbitrary code. OpenSSL 1.1.0 users should upgrade to 1.1.0b This issue was reported to OpenSSL on 23rd September 2016 by Robert ÅwiÄcki (Google Security Team), and was found using honggfuzz. The fix was developed by Matt Caswell of the OpenSSL development team. Missing CRL sanity check (CVE-2016-7052) Severity: Moderate This issue only affects OpenSSL 1.0.2i, released on 22nd September 2016. A bug fix which included a CRL sanity check was added to OpenSSL 1.1.0 but was omitted from OpenSSL 1.0.2i. As a result any attempt to use CRLs in OpenSSL 1.0.2i will crash with a null pointer exception. OpenSSL 1.0.2i users should upgrade to 1.0.2j The issue was reported to OpenSSL on 22nd September 2016 by Bruce Stephens and Thomas Jakobi. The fix was developed by Matt Caswell of the OpenSSL development team. References == URL for this Security Advisory: https://www.openssl.org/news/secadv/20160926.txt Note: the online version of the advisory may be updated with additional details over time. For details of OpenSSL severity classifications please see: https://www.openssl.org/policies/secpolicy.html -BEGIN PGP SIGNATURE- Version: GnuPG v1 iQEcBAEBAgAGBQJX6PBJAAoJENnE0m0OYESRGacIALa7/Vg0SQzqjhD/KphCdKos BjkDcEO00y3JDyYqqQxfcrM9jSwBbrNzmHdEzBcPlvvDq9qhGwsODKbGylI2St5r zVHw1qA60/+Hu9PjaGT24a8MX+fPjA4RObB/BGZ7ViucZzCxqqtJob73InKwM8+9 OyjTmrphbyFa/Hk/OUWVzjatzQjEN+a5QplRTR2Sd4fBZDWowrtOdPGmbBQfRRgm AbEO5ZPaVKBoRuMk6JsR3LFymZ2FpHjLs9HNBtSmLLdzfIXxVE+uOb9b5wdAMP/3 4cTMkhfeS3RF0GuMT3EyH/EuZS6KkjuE8y/aVTq5s3yhK3ah5kT85IO1ps0yDx0= =WJwY -END PGP SIGNATURE- -- openssl-dev mailing list To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-dev
[openssl-dev] OpenSSL version 1.1.0b published
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 OpenSSL version 1.1.0b released === OpenSSL - The Open Source toolkit for SSL/TLS https://www.openssl.org/ The OpenSSL project team is pleased to announce the release of version 1.1.0b of our open source toolkit for SSL/TLS. For details of changes and known issues see the release notes at: https://www.openssl.org/news/openssl-1.1.0-notes.html OpenSSL 1.1.0b is available for download via HTTP and FTP from the following master locations (you can find the various FTP mirrors under https://www.openssl.org/source/mirror.html): * https://www.openssl.org/source/ * ftp://ftp.openssl.org/source/ The distribution file name is: o openssl-1.1.0b.tar.gz Size: 5162355 SHA1 checksum: cbf391d0d68a9f144c24c5c3c5028c07fa00264c SHA256 checksum: a45de072bf9be4dea437230aaf036000f0e68c6a665931c57e76b5b036cef6f7 The checksums were calculated using the following commands: openssl sha1 openssl-1.1.0b.tar.gz openssl sha256 openssl-1.1.0b.tar.gz Yours, The OpenSSL Project Team. -BEGIN PGP SIGNATURE- Version: GnuPG v1 iQEcBAEBAgAGBQJX6O5iAAoJENnE0m0OYESRdEUIAKzNLCT+L0z6R6mUoHYMFT/4 jctbb93RX1nu3wx9ssRdlBikpVBa6vfsS2U4MWwyYSkRTbBHVlHuezq1/2FduXPF nsLT/tjPNmXqQPPTsceKx/p7nDAnSdapz6e36HJ/8erUR7nngHKUdalV0OqoQLeX Lz6ncYVH42qFPATMM4xJzcunmY3g+CXTORHAGBZLOM0HfSgAka/iQVC8aUlYWOMO E0pMalw9yRHzsFcR++9I/vpr9TcBj/falISsaGrgAxVNMkINYRITU8wWSO3+0y+N EkSi079/CNQx2LwoVW2qTPWdbbqMgYrUG3jsBlZUeVwvLfcXsVy2FHUep+FIb4k= =SQB4 -END PGP SIGNATURE- -- openssl-dev mailing list To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-dev
[openssl-dev] OpenSSL version 1.0.2j published
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 OpenSSL version 1.0.2j released === OpenSSL - The Open Source toolkit for SSL/TLS https://www.openssl.org/ The OpenSSL project team is pleased to announce the release of version 1.0.2j of our open source toolkit for SSL/TLS. For details of changes and known issues see the release notes at: https://www.openssl.org/news/openssl-1.0.2-notes.html OpenSSL 1.0.2j is available for download via HTTP and FTP from the following master locations (you can find the various FTP mirrors under https://www.openssl.org/source/mirror.html): * https://www.openssl.org/source/ * ftp://ftp.openssl.org/source/ The distribution file name is: o openssl-1.0.2j.tar.gz Size: 5307912 SHA1 checksum: bdfbdb416942f666865fa48fe13c2d0e588df54f SHA256 checksum: e7aff292be21c259c6af26469c7a9b3ba26e9abaaffd325e3dccc9785256c431 The checksums were calculated using the following commands: openssl sha1 openssl-1.0.2j.tar.gz openssl sha256 openssl-1.0.2j.tar.gz Yours, The OpenSSL Project Team. -BEGIN PGP SIGNATURE- Version: GnuPG v1 iQEcBAEBAgAGBQJX6O9BAAoJENnE0m0OYESRsT8H/R7NWjLkFqUOwOTjyiqOKDWa YUAUNtSM+NWgHBS8GZwNlYyvCv7oIPIuJ1cG4mwTnWc2qpUFbbOkc6bhn/VhPWi5 bW6xOlof5Xbn86G5KM5HPe9t5Gay4RiU9+ePVa8Vkn4c3UcPNYVrYdDXEjv3UvJq 3VSOJDlAndaqMyBTtX5uK82pfd63kZWi9p2a+NCEojGcBSD/cyUYQpMUdomGU5K+ ZaRh2bHLNUjGUDLDqlgTDMv8p+OYUtQ6bgGpwBYw5zQeTZy7c43yTqUjvmuEaxaj XEeJqkv59Jty5uKqYmasVHgFY+EGsE0vw3troBrNFq2ZbVCqBx41C/kOZ3828HQ= =fLO/ -END PGP SIGNATURE- -- openssl-dev mailing list To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-dev
