90b8ed725a
This release incorporates the following bug fixes and mitigations:
fixed Improper validation of PBMAC1 parameters in PKCS#12 MAC verification.
(CVE-2025-11187)
fixed Stack buffer overflow in CMS AuthEnvelopedData parsing.
(CVE-2025-15467)
fixed NULL dereference in SSL_CIPHER_find () function on unknown cipher ID.
(CVE-2025-15468)
fixed openssl dgst one-shot codepath silently truncates inputs >16 MiB.
(CVE-2025-15469)
fixed TLS 1.3 CompressedCertificate excessive memory allocation.
(CVE-2025-66199)
fixed Heap out-of-bounds write in BIO_f_linebuffer on short writes.
(CVE-2025-68160)
fixed Unauthenticated/unencrypted trailing bytes with low-level OCB function calls.
(CVE-2025-69418)
fixed Out of bounds write in PKCS12_get_friendlyname () UTF-8 conversion.
(CVE-2025-69419)
fixed Missing ASN1_TYPE validation in TS_RESP_verify_response () function.
(CVE-2025-69420)
fixed NULL Pointer Dereference in PKCS12_item_decrypt_d2i_ex () function.
(CVE-2025-69421)
fixed Missing ASN1_TYPE validation in PKCS#12 parsing.
(CVE-2026-22795)
fixed ASN1_TYPE Type Confusion in the PKCS7_digest_from_attributes () function.
(CVE-2026-22796)
Adjust patches due to formatting changes.
Link: https://github.com/openwrt/openwrt/pull/21752
Signed-off-by: Ivan Pavlov <AuthorReflex@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/21755
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit df6db01f4f)
42 lines
1.6 KiB
Diff
42 lines
1.6 KiB
Diff
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
|
|
From: Eneas U de Queiroz <cote2004-github@yahoo.com>
|
|
Date: Mon, 11 Mar 2019 09:29:13 -0300
|
|
Subject: e_devcrypto: default to not use digests in engine
|
|
|
|
Digests are almost always slower when using /dev/crypto because of the
|
|
cost of the context switches. Only for large blocks it is worth it.
|
|
|
|
Also, when forking, the open context structures are duplicated, but the
|
|
internal kernel sessions are still shared between forks, which means an
|
|
update/close operation in one fork affects all processes using that
|
|
session.
|
|
|
|
This affects digests, especially for HMAC, where the session with the
|
|
key hash is used as a source for subsequent operations. At least one
|
|
popular application does this across a fork. Disabling digests by
|
|
default will mitigate the problem, while still allowing the user to
|
|
turn them on if it is safe and fast enough.
|
|
|
|
Signed-off-by: Eneas U de Queiroz <cote2004-github@yahoo.com>
|
|
|
|
--- a/engines/e_devcrypto.c
|
|
+++ b/engines/e_devcrypto.c
|
|
@@ -887,7 +887,7 @@ static void prepare_digest_methods(void)
|
|
for (i = 0, known_digest_nids_amount = 0; i < OSSL_NELEM(digest_data);
|
|
i++) {
|
|
|
|
- selected_digests[i] = 1;
|
|
+ selected_digests[i] = 0;
|
|
|
|
/*
|
|
* Check that the digest is usable
|
|
@@ -1096,7 +1096,7 @@ static const ENGINE_CMD_DEFN devcrypto_c
|
|
#ifdef IMPLEMENT_DIGEST
|
|
{ DEVCRYPTO_CMD_DIGESTS,
|
|
"DIGESTS",
|
|
- "either ALL, NONE, or a comma-separated list of digests to enable [default=ALL]",
|
|
+ "either ALL, NONE, or a comma-separated list of digests to enable [default=NONE]",
|
|
ENGINE_CMD_FLAG_STRING },
|
|
#endif
|
|
|