openssl: Import OpenSSL 3.0.16This release incorporates the following bug fixes and mitigations:- [CVE-2024-13176](https://www.openssl.org/news/vulnerabilities.html#CVE-2024-13176- [CVE-2024-9143
openssl: Import OpenSSL 3.0.16This release incorporates the following bug fixes and mitigations:- [CVE-2024-13176](https://www.openssl.org/news/vulnerabilities.html#CVE-2024-13176- [CVE-2024-9143](https://www.openssl.org/news/vulnerabilities.html#CVE-2024-9143)Release notes can be found at:https://openssl-library.org/news/openssl-3.0-notes/index.htmlApproved by: soSecurity: FreeBSD-EN-25:07.opensslDifferential Revision: https://reviews.freebsd.org/D49296Differential Revision: https://reviews.freebsd.org/D49297(cherry picked from commit 0d0c8621fd181e507f0fb50ffcca606faf66a8c2)(cherry picked from commit cb29db243bd09d16604435639ae43ef7af0ea254)(cherry picked from commit d2a55e6a9348bb55038dbc6b727ab041085f22db)(cherry picked from commit 0d61082e3c64a43f52ec5f1bf3d85671d97d9514)
show more ...
openssl: Import OpenSSL 3.0.15.This release incorporates the following bug fixes and mitigations:- Fixed possible denial of service in X.509 name checks ([CVE-2024-6119])- Fixed possible buffer o
openssl: Import OpenSSL 3.0.15.This release incorporates the following bug fixes and mitigations:- Fixed possible denial of service in X.509 name checks ([CVE-2024-6119])- Fixed possible buffer overread in SSL_select_next_proto() ([CVE-2024-5535])Release notes can be found at:https://openssl-library.org/news/openssl-3.0-notes/index.htmlCo-authored-by: gordonMFC after: 1 weekDifferential Revision: https://reviews.freebsd.org/D46602Merge commit '108164cf95d9594884c2dcccba2691335e6f221b'(cherry picked from commit a7148ab39c03abd4d1a84997c70bf96f15dd2a09)Update config/build info for OpenSSL 3.0.15This is a companion commit to the OpenSSL 3.0.15 update.`opensslv.h` was regenerated via the following process:```cd crypto/openssl./configgit reset --hardgmake include/openssl/opensslv.h````Makefile.inc` has been updated to match.MFC after: 1 weekMFC with: a7148ab39c03abd4d1a84997c70bf96f15dd2a09Differential Revision: https://reviews.freebsd.org/D46603(cherry picked from commit cc717b574d7faa2e0b2de1a985076286cef74187)sys/crypto/openssl: update powerpc* ASMThis change updates the crypto powerpc* ASM via the prescribed processdocumented in `crypto/openssl/FREEBSD-upgrade`.This change syncs the ASM with 3.0.15's generated ASM.MFC after: 1 weekMFC with: a7148ab39c03abd4d1a84997c70bf96f15dd2a09MFC with: cc717b574d7faa2e0b2de1a985076286cef74187Differential Revision: https://reviews.freebsd.org/D46604(cherry picked from commit 77864b545b0aaa91bc78b1156c477825007a6233)
openssl: Avoid type errors in EAI-related name check logic.The incorrectly typed data is read only, used in a compare operation, soneither remote code execution, nor memory content disclosure were
openssl: Avoid type errors in EAI-related name check logic.The incorrectly typed data is read only, used in a compare operation, soneither remote code execution, nor memory content disclosure were possible.However, applications performing certificate name checks were vulnerable todenial of service.The GENERAL_TYPE data type is a union, and we must take care to access thecorrect member, based on `gen->type`, not all the member fields have the samestructure, and a segfault is possible if the wrong member field is read.The code in question was lightly refactored with the intent to make it moreobviously correct.Security: CVE-2024-6119Obtained from: OpenSSL Project(cherry picked from commit 1486960d6cdb052e4fc0109a56a0597b4e902ba1)
Update to OpenSSL 3.0.14This release resolves 3 upstream found CVEs:- Fixed potential use after free after SSL_free_buffers() is called (CVE-2024-4741)- Fixed an issue where checking excessively
Update to OpenSSL 3.0.14This release resolves 3 upstream found CVEs:- Fixed potential use after free after SSL_free_buffers() is called (CVE-2024-4741)- Fixed an issue where checking excessively long DSA keys or parameters may be very slow (CVE-2024-4603)- Fixed unbounded memory growth with session handling in TLSv1.3 (CVE-2024-2511)MFC after: 3 daysMerge commit '1070e7dca8223387baf5155524b28f62bfe7da3c'(cherry picked from commit 44096ebd22ddd0081a357011714eff8963614b65)
OpenSSL: Vendor import of OpenSSL 3.0.13 * Fixed PKCS12 Decoding crashes ([CVE-2024-0727]) * Fixed Excessive time spent checking invalid RSA public keys ([CVE-2023-6237]) * Fixed POLY1305 MAC
OpenSSL: Vendor import of OpenSSL 3.0.13 * Fixed PKCS12 Decoding crashes ([CVE-2024-0727]) * Fixed Excessive time spent checking invalid RSA public keys ([CVE-2023-6237]) * Fixed POLY1305 MAC implementation corrupting vector registers on PowerPC CPUs which support PowerISA 2.07 ([CVE-2023-6129]) * Fix excessive time spent in DH check / generation with large Q parameter value ([CVE-2023-5678])Release notes can be found at https://www.openssl.org/news/openssl-3.0-notes.html.Approved by: emasteMerge commit '9dd13e84fa8eca8f3462bd55485aa3da8c37f54a'(cherry picked from commit e0c4386e7e71d93b0edc0c8fa156263fc4a8b0b6)
Flatten OpenSSL vendor tree.
Vendor import of OpenSSL 0.9.8e.
Vendor import of OpenSSL 0.9.8d.
Vendor import of OpenSSL 0.9.8b
Remove files that are no longer part of OpenSSL from the vendorbranch. This time, these are mostly the `Makefile.ssl' files.
Vendor import of OpenSSL 0.9.7e.
Clean up the OpenSSL vendor branch by removing files that are notpart of recent releases.
Vendor import of OpenSSL 0.9.7d.
Vendor import of OpenSSL 0.9.7c
Vendor import of OpenSSL 0.9.7a.
Vendor import of OpenSSL release 0.9.7. This release includessupport for AES and OpenBSD's hardware crypto.
Import of OpenSSL 0.9.6e.
Import of OpenSSL 0.9.6d.
Initial import of OpenSSL 0.9.6c
Initial import of OpenSSL 0.9.6b
Initial import of OpenSSL 0.9.6a
Import of OpenSSL 0.9.6-STABLE snapshot dated 2001-02-10
Initial import of OpenSSL 0.9.6
Initial import of OpenSSL 0.9.5a
Initial import of OpenSSL 0.9.4, sans IDEA and RSA code for patentinfringement reasons.