openssl: Import OpenSSL 3.0.16This release incorporates the following bug fixes and mitigations:- [CVE-2024-13176](https://www.openssl.org/news/vulnerabilities.html#CVE-2024-13176- [CVE-2024-9143
openssl: Import OpenSSL 3.0.16This release incorporates the following bug fixes and mitigations:- [CVE-2024-13176](https://www.openssl.org/news/vulnerabilities.html#CVE-2024-13176- [CVE-2024-9143](https://www.openssl.org/news/vulnerabilities.html#CVE-2024-9143)Release notes can be found at:https://openssl-library.org/news/openssl-3.0-notes/index.htmlApproved by: soSecurity: FreeBSD-EN-25:07.opensslDifferential Revision: https://reviews.freebsd.org/D49296Differential Revision: https://reviews.freebsd.org/D49297(cherry picked from commit 0d0c8621fd181e507f0fb50ffcca606faf66a8c2)(cherry picked from commit cb29db243bd09d16604435639ae43ef7af0ea254)(cherry picked from commit d2a55e6a9348bb55038dbc6b727ab041085f22db)(cherry picked from commit 0d61082e3c64a43f52ec5f1bf3d85671d97d9514)
show more ...
OpenSSL: Vendor import of OpenSSL 3.0.13 * Fixed PKCS12 Decoding crashes ([CVE-2024-0727]) * Fixed Excessive time spent checking invalid RSA public keys ([CVE-2023-6237]) * Fixed POLY1305 MAC
OpenSSL: Vendor import of OpenSSL 3.0.13 * Fixed PKCS12 Decoding crashes ([CVE-2024-0727]) * Fixed Excessive time spent checking invalid RSA public keys ([CVE-2023-6237]) * Fixed POLY1305 MAC implementation corrupting vector registers on PowerPC CPUs which support PowerISA 2.07 ([CVE-2023-6129]) * Fix excessive time spent in DH check / generation with large Q parameter value ([CVE-2023-5678])Release notes can be found at https://www.openssl.org/news/openssl-3.0-notes.html.Approved by: emasteMerge commit '9dd13e84fa8eca8f3462bd55485aa3da8c37f54a'(cherry picked from commit e0c4386e7e71d93b0edc0c8fa156263fc4a8b0b6)
OpenSSL: update to 3.0.11OpenSSL 3.0.11 addresses: POLY1305 MAC implementation corrupts XMM registers on Windows (CVE-2023-4807)Relnotes: YesPull request: https://github.com/freebsd/freebsd
OpenSSL: update to 3.0.11OpenSSL 3.0.11 addresses: POLY1305 MAC implementation corrupts XMM registers on Windows (CVE-2023-4807)Relnotes: YesPull request: https://github.com/freebsd/freebsd-src/pull/852Sponsored by: The FreeBSD Foundation(cherry picked from commit 6f1af0d7d2af54b339b5212434cd6d4fda628d80)
OpenSSL: update to 3.0.10OpenSSL 3.0.10 addresses:- CVE-2023-3817- CVE-2023-3446- CVE-2023-2975(Note that the vendor branch commit incorrectly referenced 3.0.9.)Relnotes: YesPull request: h
OpenSSL: update to 3.0.10OpenSSL 3.0.10 addresses:- CVE-2023-3817- CVE-2023-3446- CVE-2023-2975(Note that the vendor branch commit incorrectly referenced 3.0.9.)Relnotes: YesPull request: https://github.com/freebsd/freebsd-src/pull/808Sponsored by: The FreeBSD Foundation
Merge OpenSSL 3.0.9Migrate to OpenSSL 3.0 in advance of FreeBSD 14.0. OpenSSL 1.1.1 (theversion we were previously using) will be EOL as of 2023-09-11.Most of the base system has already been u
Merge OpenSSL 3.0.9Migrate to OpenSSL 3.0 in advance of FreeBSD 14.0. OpenSSL 1.1.1 (theversion we were previously using) will be EOL as of 2023-09-11.Most of the base system has already been updated for a seamless switchto OpenSSL 3.0. For many components we've added`-DOPENSSL_API_COMPAT=0x10100000L` to CFLAGS to specify the API version,which avoids deprecation warnings from OpenSSL 3.0. Changes have alsobeen made to avoid OpenSSL APIs that were already deprecated in OpenSSL1.1.1. The process of updating to contemporary APIs can continue afterthis merge.Additional changes are still required for libarchive and Kerberos-related libraries or tools; workarounds will immediately follow thiscommit. Fixes are in progress in the upstream projects and will beincorporated when those are next updated.There are some performance regressions in benchmarks (certain tests in`openssl speed`) and in some OpenSSL consumers in ports (e.g. haproxy).Investigation will continue for these.Netflix's testing showed no functional regression and a rather small,albeit statistically significant, increase in CPU consumption withOpenSSL 3.0.Thanks to ngie@ and des@ for updating base system components, toantoine@ and bofh@ for ports exp-runs and port fixes/workarounds, and toNetflix and everyone who tested prior to commit or contributed to thisupdate in other ways.PR: 271615PR: 271656 [exp-run]Relnotes: YesSponsored by: The FreeBSD Foundation