openssl: Import OpenSSL 3.0.16This release incorporates the following bug fixes and mitigations:- [CVE-2024-13176](https://www.openssl.org/news/vulnerabilities.html#CVE-2024-13176- [CVE-2024-9143
openssl: Import OpenSSL 3.0.16This release incorporates the following bug fixes and mitigations:- [CVE-2024-13176](https://www.openssl.org/news/vulnerabilities.html#CVE-2024-13176- [CVE-2024-9143](https://www.openssl.org/news/vulnerabilities.html#CVE-2024-9143)Release notes can be found at:https://openssl-library.org/news/openssl-3.0-notes/index.htmlApproved by: soSecurity: FreeBSD-EN-25:07.opensslDifferential Revision: https://reviews.freebsd.org/D49296Differential Revision: https://reviews.freebsd.org/D49297(cherry picked from commit 0d0c8621fd181e507f0fb50ffcca606faf66a8c2)(cherry picked from commit cb29db243bd09d16604435639ae43ef7af0ea254)(cherry picked from commit d2a55e6a9348bb55038dbc6b727ab041085f22db)(cherry picked from commit 0d61082e3c64a43f52ec5f1bf3d85671d97d9514)
show more ...
openssl: Import OpenSSL 3.0.15.This release incorporates the following bug fixes and mitigations:- Fixed possible denial of service in X.509 name checks ([CVE-2024-6119])- Fixed possible buffer o
openssl: Import OpenSSL 3.0.15.This release incorporates the following bug fixes and mitigations:- Fixed possible denial of service in X.509 name checks ([CVE-2024-6119])- Fixed possible buffer overread in SSL_select_next_proto() ([CVE-2024-5535])Release notes can be found at:https://openssl-library.org/news/openssl-3.0-notes/index.htmlCo-authored-by: gordonMFC after: 1 weekDifferential Revision: https://reviews.freebsd.org/D46602Merge commit '108164cf95d9594884c2dcccba2691335e6f221b'(cherry picked from commit a7148ab39c03abd4d1a84997c70bf96f15dd2a09)Update config/build info for OpenSSL 3.0.15This is a companion commit to the OpenSSL 3.0.15 update.`opensslv.h` was regenerated via the following process:```cd crypto/openssl./configgit reset --hardgmake include/openssl/opensslv.h````Makefile.inc` has been updated to match.MFC after: 1 weekMFC with: a7148ab39c03abd4d1a84997c70bf96f15dd2a09Differential Revision: https://reviews.freebsd.org/D46603(cherry picked from commit cc717b574d7faa2e0b2de1a985076286cef74187)sys/crypto/openssl: update powerpc* ASMThis change updates the crypto powerpc* ASM via the prescribed processdocumented in `crypto/openssl/FREEBSD-upgrade`.This change syncs the ASM with 3.0.15's generated ASM.MFC after: 1 weekMFC with: a7148ab39c03abd4d1a84997c70bf96f15dd2a09MFC with: cc717b574d7faa2e0b2de1a985076286cef74187Differential Revision: https://reviews.freebsd.org/D46604(cherry picked from commit 77864b545b0aaa91bc78b1156c477825007a6233)
OpenSSL: Vendor import of OpenSSL 3.0.13 * Fixed PKCS12 Decoding crashes ([CVE-2024-0727]) * Fixed Excessive time spent checking invalid RSA public keys ([CVE-2023-6237]) * Fixed POLY1305 MAC
OpenSSL: Vendor import of OpenSSL 3.0.13 * Fixed PKCS12 Decoding crashes ([CVE-2024-0727]) * Fixed Excessive time spent checking invalid RSA public keys ([CVE-2023-6237]) * Fixed POLY1305 MAC implementation corrupting vector registers on PowerPC CPUs which support PowerISA 2.07 ([CVE-2023-6129]) * Fix excessive time spent in DH check / generation with large Q parameter value ([CVE-2023-5678])Release notes can be found at https://www.openssl.org/news/openssl-3.0-notes.html.Approved by: emasteMerge commit '9dd13e84fa8eca8f3462bd55485aa3da8c37f54a'(cherry picked from commit e0c4386e7e71d93b0edc0c8fa156263fc4a8b0b6)
OpenSSL: update to 3.0.12OpenSSL 3.0.12 addresses: * Fix incorrect key and IV resizing issues when calling EVP_EncryptInit_ex2(), EVP_DecryptInit_ex2() or EVP_CipherInit_ex2() with OSSL_PAR
OpenSSL: update to 3.0.12OpenSSL 3.0.12 addresses: * Fix incorrect key and IV resizing issues when calling EVP_EncryptInit_ex2(), EVP_DecryptInit_ex2() or EVP_CipherInit_ex2() with OSSL_PARAM parameters that alter the key or IV length ([CVE-2023-5363]).Relnotes: YesSponsored by: The FreeBSD Foundation(cherry picked from commit ad991e4c142ebabad7aef488ad97b189ecabb270)(cherry picked from commit 575878a533823aa3e5bab715928d9cdffbc4dcbc)
OpenSSL: update to 3.0.11OpenSSL 3.0.11 addresses: POLY1305 MAC implementation corrupts XMM registers on Windows (CVE-2023-4807)Relnotes: YesPull request: https://github.com/freebsd/freebsd
OpenSSL: update to 3.0.11OpenSSL 3.0.11 addresses: POLY1305 MAC implementation corrupts XMM registers on Windows (CVE-2023-4807)Relnotes: YesPull request: https://github.com/freebsd/freebsd-src/pull/852Sponsored by: The FreeBSD Foundation(cherry picked from commit 6f1af0d7d2af54b339b5212434cd6d4fda628d80)
Merge OpenSSL 3.0.9Migrate to OpenSSL 3.0 in advance of FreeBSD 14.0. OpenSSL 1.1.1 (theversion we were previously using) will be EOL as of 2023-09-11.Most of the base system has already been u
Merge OpenSSL 3.0.9Migrate to OpenSSL 3.0 in advance of FreeBSD 14.0. OpenSSL 1.1.1 (theversion we were previously using) will be EOL as of 2023-09-11.Most of the base system has already been updated for a seamless switchto OpenSSL 3.0. For many components we've added`-DOPENSSL_API_COMPAT=0x10100000L` to CFLAGS to specify the API version,which avoids deprecation warnings from OpenSSL 3.0. Changes have alsobeen made to avoid OpenSSL APIs that were already deprecated in OpenSSL1.1.1. The process of updating to contemporary APIs can continue afterthis merge.Additional changes are still required for libarchive and Kerberos-related libraries or tools; workarounds will immediately follow thiscommit. Fixes are in progress in the upstream projects and will beincorporated when those are next updated.There are some performance regressions in benchmarks (certain tests in`openssl speed`) and in some OpenSSL consumers in ports (e.g. haproxy).Investigation will continue for these.Netflix's testing showed no functional regression and a rather small,albeit statistically significant, increase in CPU consumption withOpenSSL 3.0.Thanks to ngie@ and des@ for updating base system components, toantoine@ and bofh@ for ports exp-runs and port fixes/workarounds, and toNetflix and everyone who tested prior to commit or contributed to thisupdate in other ways.PR: 271615PR: 271656 [exp-run]Relnotes: YesSponsored by: The FreeBSD Foundation