Merge pull request #3465 from citrus-it/opensslr46

OpenSSL updates (r151046)

build/openssl/build-1.0.sh

@@ -13,14 +13,14 @@
 # }}}
 #
 # Copyright 2017 OmniTI Computer Consulting, Inc.  All rights reserved.
-# Copyright 2023 OmniOS Community Edition (OmniOSce) Association.
+# Copyright 2024 OmniOS Community Edition (OmniOSce) Association.
 #
 . ../../lib/build.sh
 . common.sh
 
 PROG=openssl
 VER=1.0.2u
-DASHREV=2
+DASHREV=3
 PKG=library/security/openssl-10
 SUMMARY="Cryptography and SSL/TLS Toolkit"
 DESC="A toolkit for Secure Sockets Layer and Transport Layer protocols "

build/openssl/build-1.1.sh

@@ -13,13 +13,14 @@
 # }}}
 #
 # Copyright 2017 OmniTI Computer Consulting, Inc.  All rights reserved.
-# Copyright 2023 OmniOS Community Edition (OmniOSce) Association.
+# Copyright 2024 OmniOS Community Edition (OmniOSce) Association.
 #
 . ../../lib/build.sh
 . common.sh
 
 PROG=openssl
-VER=1.1.1v
+VER=1.1.1w
+DASHREV=1
 PKG=library/security/openssl-11
 SUMMARY="Cryptography and SSL/TLS Toolkit"
 DESC="A toolkit for Secure Sockets Layer and Transport Layer protocols "

build/openssl/build-3.sh

@@ -13,13 +13,13 @@
 # }}}
 #
 # Copyright 2017 OmniTI Computer Consulting, Inc.  All rights reserved.
-# Copyright 2023 OmniOS Community Edition (OmniOSce) Association.
+# Copyright 2024 OmniOS Community Edition (OmniOSce) Association.
 #
 . ../../lib/build.sh
 . common.sh
 
 PROG=openssl
-VER=3.0.12
+VER=3.0.13
 PKG=library/security/openssl-3
 SUMMARY="Cryptography and SSL/TLS Toolkit"
 DESC="A toolkit for Secure Sockets Layer and Transport Layer protocols "

build/openssl/patches-1.0/CVE-2024-0727.patch

@@ -0,0 +1,110 @@
+From 09df4395b5071217b76dc7d3d2e630eb8c5a79c2 Mon Sep 17 00:00:00 2001
+From: Matt Caswell <[email protected]>
+Date: Fri, 19 Jan 2024 11:28:58 +0000
+Subject: [PATCH] Add NULL checks where ContentInfo data can be NULL
+
+PKCS12 structures contain PKCS7 ContentInfo fields. These fields are
+optional and can be NULL even if the "type" is a valid value. OpenSSL
+was not properly accounting for this and a NULL dereference can occur
+causing a crash.
+
+CVE-2024-0727
+
+Reviewed-by: Tomas Mraz <[email protected]>
+Reviewed-by: Hugo Landau <[email protected]>
+Reviewed-by: Neil Horman <[email protected]>
+(Merged from https://github.com/openssl/openssl/pull/23362)
+
+(cherry picked from commit d135eeab8a5dbf72b3da5240bab9ddb7678dbd2c)
+diff -wpruN --no-dereference '--exclude=*.orig' a~/crypto/pkcs12/p12_add.c a/crypto/pkcs12/p12_add.c
+--- a~/crypto/pkcs12/p12_add.c	1970-01-01 00:00:00
++++ a/crypto/pkcs12/p12_add.c	1970-01-01 00:00:00
+@@ -171,6 +171,13 @@ STACK_OF(PKCS12_SAFEBAG) *PKCS12_unpack_
+                   PKCS12_R_CONTENT_TYPE_NOT_DATA);
+         return NULL;
+     }
++
++    if (p7->d.data == NULL) {
++        PKCS12err(PKCS12_F_PKCS12_UNPACK_P7DATA,
++                  PKCS12_R_DECODE_ERROR);
++        return NULL;
++    }
++
+     return ASN1_item_unpack(p7->d.data, ASN1_ITEM_rptr(PKCS12_SAFEBAGS));
+ }
+
+@@ -226,6 +233,13 @@ STACK_OF(PKCS12_SAFEBAG) *PKCS12_unpack_
+ {
+     if (!PKCS7_type_is_encrypted(p7))
+         return NULL;
++
++    if (p7->d.encrypted == NULL) {
++        PKCS12err(PKCS12_F_PKCS12_UNPACK_P7DATA,
++                  PKCS12_R_DECODE_ERROR);
++        return NULL;
++    }
++
+     return PKCS12_item_decrypt_d2i(p7->d.encrypted->enc_data->algorithm,
+                                    ASN1_ITEM_rptr(PKCS12_SAFEBAGS),
+                                    pass, passlen,
+@@ -253,6 +267,13 @@ STACK_OF(PKCS7) *PKCS12_unpack_authsafes
+                   PKCS12_R_CONTENT_TYPE_NOT_DATA);
+         return NULL;
+     }
++
++    if (p12->authsafes->d.data == NULL) {
++        PKCS12err(PKCS12_F_PKCS12_UNPACK_AUTHSAFES,
++                  PKCS12_R_DECODE_ERROR);
++        return NULL;
++    }
++
+     return ASN1_item_unpack(p12->authsafes->d.data,
+                             ASN1_ITEM_rptr(PKCS12_AUTHSAFES));
+ }
+diff -wpruN --no-dereference '--exclude=*.orig' a~/crypto/pkcs12/p12_mutl.c a/crypto/pkcs12/p12_mutl.c
+--- a~/crypto/pkcs12/p12_mutl.c	1970-01-01 00:00:00
++++ a/crypto/pkcs12/p12_mutl.c	1970-01-01 00:00:00
+@@ -80,6 +80,11 @@ int PKCS12_gen_mac(PKCS12 *p12, const ch
+         return 0;
+     }
+
++    if (p12->authsafes->d.data == NULL) {
++        PKCS12err(PKCS12_F_PKCS12_GEN_MAC, PKCS12_R_DECODE_ERROR);
++        return 0;
++    }
++
+     salt = p12->mac->salt->data;
+     saltlen = p12->mac->salt->length;
+     if (!p12->mac->iter)
+diff -wpruN --no-dereference '--exclude=*.orig' a~/crypto/pkcs12/p12_npas.c a/crypto/pkcs12/p12_npas.c
+--- a~/crypto/pkcs12/p12_npas.c	1970-01-01 00:00:00
++++ a/crypto/pkcs12/p12_npas.c	1970-01-01 00:00:00
+@@ -126,7 +126,8 @@ static int newpass_p12(PKCS12 *p12, cons
+             bags = PKCS12_unpack_p7data(p7);
+         } else if (bagnid == NID_pkcs7_encrypted) {
+             bags = PKCS12_unpack_p7encdata(p7, oldpass, -1);
+-            if (!alg_get(p7->d.encrypted->enc_data->algorithm,
++            if (p7->d.encrypted == NULL
++                    || !alg_get(p7->d.encrypted->enc_data->algorithm,
+                          &pbe_nid, &pbe_iter, &pbe_saltlen))
+                 goto err;
+         } else {
+diff -wpruN --no-dereference '--exclude=*.orig' a~/crypto/pkcs7/pk7_mime.c a/crypto/pkcs7/pk7_mime.c
+--- a~/crypto/pkcs7/pk7_mime.c	1970-01-01 00:00:00
++++ a/crypto/pkcs7/pk7_mime.c	1970-01-01 00:00:00
+@@ -78,10 +78,13 @@ int SMIME_write_PKCS7(BIO *bio, PKCS7 *p
+ {
+     STACK_OF(X509_ALGOR) *mdalgs;
+     int ctype_nid = OBJ_obj2nid(p7->type);
+-    if (ctype_nid == NID_pkcs7_signed)
++    if (ctype_nid == NID_pkcs7_signed) {
++	if (p7->d.sign == NULL)
++		return 0;
+         mdalgs = p7->d.sign->md_algs;
+-    else
++    } else {
+         mdalgs = NULL;
++    }
+
+     flags ^= SMIME_OLDMIME;
+

build/openssl/patches-1.0/series

@@ -19,3 +19,4 @@ CVE-2023-0465.patch
 CVE-2023-2650.patch
 CVE-2023-3446.patch
 CVE-2023-3817.patch
+CVE-2024-0727.patch

build/openssl/patches-1.1/CVE-2024-0727.patch

@@ -0,0 +1,110 @@
+From 09df4395b5071217b76dc7d3d2e630eb8c5a79c2 Mon Sep 17 00:00:00 2001
+From: Matt Caswell <[email protected]>
+Date: Fri, 19 Jan 2024 11:28:58 +0000
+Subject: [PATCH] Add NULL checks where ContentInfo data can be NULL
+
+PKCS12 structures contain PKCS7 ContentInfo fields. These fields are
+optional and can be NULL even if the "type" is a valid value. OpenSSL
+was not properly accounting for this and a NULL dereference can occur
+causing a crash.
+
+CVE-2024-0727
+
+Reviewed-by: Tomas Mraz <[email protected]>
+Reviewed-by: Hugo Landau <[email protected]>
+Reviewed-by: Neil Horman <[email protected]>
+(Merged from https://github.com/openssl/openssl/pull/23362)
+
+(cherry picked from commit d135eeab8a5dbf72b3da5240bab9ddb7678dbd2c)
+diff -wpruN --no-dereference '--exclude=*.orig' a~/crypto/pkcs12/p12_add.c a/crypto/pkcs12/p12_add.c
+--- a~/crypto/pkcs12/p12_add.c	1970-01-01 00:00:00
++++ a/crypto/pkcs12/p12_add.c	1970-01-01 00:00:00
+@@ -76,6 +76,13 @@ STACK_OF(PKCS12_SAFEBAG) *PKCS12_unpack_
+                   PKCS12_R_CONTENT_TYPE_NOT_DATA);
+         return NULL;
+     }
++
++    if (p7->d.data == NULL) {
++        PKCS12err(PKCS12_F_PKCS12_UNPACK_P7DATA,
++                  PKCS12_R_DECODE_ERROR);
++        return NULL;
++    }
++
+     return ASN1_item_unpack(p7->d.data, ASN1_ITEM_rptr(PKCS12_SAFEBAGS));
+ }
+
+@@ -132,6 +139,13 @@ STACK_OF(PKCS12_SAFEBAG) *PKCS12_unpack_
+ {
+     if (!PKCS7_type_is_encrypted(p7))
+         return NULL;
++
++    if (p7->d.encrypted == NULL) {
++        PKCS12err(PKCS12_F_PKCS12_UNPACK_P7DATA,
++                  PKCS12_R_DECODE_ERROR);
++        return NULL;
++    }
++
+     return PKCS12_item_decrypt_d2i(p7->d.encrypted->enc_data->algorithm,
+                                    ASN1_ITEM_rptr(PKCS12_SAFEBAGS),
+                                    pass, passlen,
+@@ -159,6 +173,13 @@ STACK_OF(PKCS7) *PKCS12_unpack_authsafes
+                   PKCS12_R_CONTENT_TYPE_NOT_DATA);
+         return NULL;
+     }
++
++    if (p12->authsafes->d.data == NULL) {
++        PKCS12err(PKCS12_F_PKCS12_UNPACK_AUTHSAFES,
++                  PKCS12_R_DECODE_ERROR);
++        return NULL;
++    }
++
+     return ASN1_item_unpack(p12->authsafes->d.data,
+                             ASN1_ITEM_rptr(PKCS12_AUTHSAFES));
+ }
+diff -wpruN --no-dereference '--exclude=*.orig' a~/crypto/pkcs12/p12_mutl.c a/crypto/pkcs12/p12_mutl.c
+--- a~/crypto/pkcs12/p12_mutl.c	1970-01-01 00:00:00
++++ a/crypto/pkcs12/p12_mutl.c	1970-01-01 00:00:00
+@@ -93,6 +93,11 @@ static int pkcs12_gen_mac(PKCS12 *p12, c
+         return 0;
+     }
+
++    if (p12->authsafes->d.data == NULL) {
++        PKCS12err(PKCS12_F_PKCS12_GEN_MAC, PKCS12_R_DECODE_ERROR);
++        return 0;
++    }
++
+     salt = p12->mac->salt->data;
+     saltlen = p12->mac->salt->length;
+     if (!p12->mac->iter)
+diff -wpruN --no-dereference '--exclude=*.orig' a~/crypto/pkcs12/p12_npas.c a/crypto/pkcs12/p12_npas.c
+--- a~/crypto/pkcs12/p12_npas.c	1970-01-01 00:00:00
++++ a/crypto/pkcs12/p12_npas.c	1970-01-01 00:00:00
+@@ -78,7 +78,8 @@ static int newpass_p12(PKCS12 *p12, cons
+             bags = PKCS12_unpack_p7data(p7);
+         } else if (bagnid == NID_pkcs7_encrypted) {
+             bags = PKCS12_unpack_p7encdata(p7, oldpass, -1);
+-            if (!alg_get(p7->d.encrypted->enc_data->algorithm,
++            if (p7->d.encrypted == NULL
++                    || !alg_get(p7->d.encrypted->enc_data->algorithm,
+                          &pbe_nid, &pbe_iter, &pbe_saltlen))
+                 goto err;
+         } else {
+diff -wpruN --no-dereference '--exclude=*.orig' a~/crypto/pkcs7/pk7_mime.c a/crypto/pkcs7/pk7_mime.c
+--- a~/crypto/pkcs7/pk7_mime.c	1970-01-01 00:00:00
++++ a/crypto/pkcs7/pk7_mime.c	1970-01-01 00:00:00
+@@ -30,10 +30,13 @@ int SMIME_write_PKCS7(BIO *bio, PKCS7 *p
+ {
+     STACK_OF(X509_ALGOR) *mdalgs;
+     int ctype_nid = OBJ_obj2nid(p7->type);
+-    if (ctype_nid == NID_pkcs7_signed)
++    if (ctype_nid == NID_pkcs7_signed) {
++	if (p7->d.sign == NULL)
++		return 0;
+         mdalgs = p7->d.sign->md_algs;
+-    else
++    } else {
+         mdalgs = NULL;
++    }
+
+     flags ^= SMIME_OLDMIME;
+

build/openssl/patches-1.1/series

@@ -1 +1,2 @@
 libs.patch
+CVE-2024-0727.patch