Skip to content

Commit da15e7e

Browse files
nodejs-github-botmarco-ippolito
nodejs-github-bot
authored and
marco-ippolito
committed
deps: upgrade openssl sources to quictls/openssl-3.0.15+quic1
PR-URL: #55184 Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com> Reviewed-By: Richard Lau <rlau@redhat.com> Reviewed-By: Michael Dawson <midawson@redhat.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
1 parent 381f1f9 commit da15e7e

File tree

205 files changed

+2458
-863
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

205 files changed

+2458
-863
lines changed

‎deps/openssl/openssl/CHANGES.md

Lines changed: 35 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -28,12 +28,36 @@ breaking changes, and mappings for the large list of deprecated functions.
2828

2929
[Migration guide]: https://github.com/openssl/openssl/tree/master/doc/man7/migration_guide.pod
3030

31-
### Changes between 3.0.14 and 3.0.14+quic [7 Jun 2024]
31+
### Changes between 3.0.15 and 3.0.15+quic [3 Sep 2024]
3232

3333
* Add QUIC API support from BoringSSL
3434

3535
*Todd Short*
3636

37+
### Changes between 3.0.14 and 3.0.15 [3 Sep 2024]
38+
39+
* Fixed possible denial of service in X.509 name checks.
40+
41+
Applications performing certificate name checks (e.g., TLS clients checking
42+
server certificates) may attempt to read an invalid memory address when
43+
comparing the expected name with an `otherName` subject alternative name of
44+
an X.509 certificate. This may result in an exception that terminates the
45+
application program.
46+
47+
([CVE-2024-6119])
48+
49+
*Viktor Dukhovni*
50+
51+
* Fixed possible buffer overread in SSL_select_next_proto().
52+
53+
Calling the OpenSSL API function SSL_select_next_proto with an empty
54+
supported client protocols buffer may cause a crash or memory contents
55+
to be sent to the peer.
56+
57+
([CVE-2024-5535])
58+
59+
*Matt Caswell*
60+
3761
### Changes between 3.0.13 and 3.0.14 [4 Jun 2024]
3862

3963
* Fixed potential use after free after SSL_free_buffers() is called.
@@ -76,6 +100,14 @@ breaking changes, and mappings for the large list of deprecated functions.
76100

77101
*Tomáš Mráz*
78102

103+
* Improved EC/DSA nonce generation routines to avoid bias and timing
104+
side channel leaks.
105+
106+
Thanks to Florian Sieck from Universität zu Lübeck and George Pantelakis
107+
and Hubert Kario from Red Hat for reporting the issues.
108+
109+
*Tomáš Mráz and Paul Dale*
110+
79111
* Fixed an issue where some non-default TLS server configurations can cause
80112
unbounded memory growth when processing TLSv1.3 sessions. An attacker may
81113
exploit certain server configurations to trigger unbounded memory growth that
@@ -19896,6 +19928,8 @@ ndif
1989619928

1989719929
<!-- Links -->
1989819930

19931+
[CVE-2024-6119]: https://www.openssl.org/news/vulnerabilities.html#CVE-2024-6119
19932+
[CVE-2024-5535]: https://www.openssl.org/news/vulnerabilities.html#CVE-2024-5535
1989919933
[CVE-2024-4741]: https://www.openssl.org/news/vulnerabilities.html#CVE-2024-4741
1990019934
[CVE-2024-4603]: https://www.openssl.org/news/vulnerabilities.html#CVE-2024-4603
1990119935
[CVE-2024-2511]: https://www.openssl.org/news/vulnerabilities.html#CVE-2024-2511

‎deps/openssl/openssl/CONTRIBUTING.md

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ HOW TO CONTRIBUTE TO OpenSSL
33

44
Please visit our [Getting Started] page for other ideas about how to contribute.
55

6-
[Getting Started]: <https://www.openssl.org/community/getting-started.html>
6+
[Getting Started]: <https://openssl-library.org/community/getting-started>
77

88
Development is done on GitHub in the [openssl/openssl] repository.
99

@@ -77,8 +77,8 @@ guidelines:
7777
Clean builds via GitHub Actions are required. They are started automatically
7878
whenever a PR is created or updated by committers.
7979
80-
[coding style]: https://www.openssl.org/policies/technical/coding-style.html
81-
[documentation policy]: https://openssl.org/policies/technical/documentation-policy.html
80+
[coding style]: https://openssl-library.org/policies/technical/coding-style/
81+
[documentation policy]: https://openssl-library.org/policies/technical/documentation-policy/
8282
8383
5. When at all possible, code contributions should include tests. These can
8484
either be added to an existing test, or completely new. Please see

‎deps/openssl/openssl/Configurations/10-main.conf

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1264,6 +1264,25 @@ my %targets = (
12641264
AR => add("-X32"),
12651265
RANLIB => add("-X32"),
12661266
},
1267+
# To enable openxl compiler for aix
1268+
# If 17.1 openxl runtime is available, -latomic can be used
1269+
# instead of -DBROKEN_CLANG_ATOMICS
1270+
"aix-clang" => {
1271+
inherit_from => [ "aix-common" ],
1272+
CC => "ibm-clang",
1273+
CFLAGS => picker(debug => "-O0 -g",
1274+
release => "-O"),
1275+
cflags => combine("-Wno-implicit-function-declaration -mcmodel=large -DBROKEN_CLANG_ATOMICS",
1276+
threads("-pthread")),
1277+
ex_libs => add(threads("-pthread")),
1278+
bn_ops => "BN_LLONG RC4_CHAR",
1279+
asm_arch => 'ppc32',
1280+
perlasm_scheme => "aix32",
1281+
shared_cflag => "-fpic",
1282+
shared_ldflag => add("-shared"),
1283+
AR => add("-X32"),
1284+
RANLIB => add("-X32"),
1285+
},
12671286
"aix64-cc" => {
12681287
inherit_from => [ "aix-common" ],
12691288
CC => "cc",
@@ -1282,6 +1301,23 @@ my %targets = (
12821301
AR => add("-X64"),
12831302
RANLIB => add("-X64"),
12841303
},
1304+
"aix64-clang" => {
1305+
inherit_from => [ "aix-common" ],
1306+
CC => "ibm-clang",
1307+
CFLAGS => picker(debug => "-O0 -g",
1308+
release => "-O"),
1309+
cflags => combine("-maix64 -Wno-implicit-function-declaration -mcmodel=large",
1310+
threads("-pthread")),
1311+
ex_libs => add(threads("-pthread")),
1312+
bn_ops => "SIXTY_FOUR_BIT_LONG RC4_CHAR",
1313+
asm_arch => 'ppc64',
1314+
perlasm_scheme => "aix64",
1315+
shared_cflag => "-fpic",
1316+
shared_ldflag => add("-shared"),
1317+
shared_extension => "64.so.\$(SHLIB_VERSION_NUMBER)",
1318+
AR => add("-X64"),
1319+
RANLIB => add("-X64"),
1320+
},
12851321

12861322
# SIEMENS BS2000/OSD: an EBCDIC-based mainframe
12871323
"BS2000-OSD" => {

‎deps/openssl/openssl/Configurations/15-ios.conf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ my %targets = (
1010
template => 1,
1111
inherit_from => [ "darwin-common" ],
1212
sys_id => "iOS",
13-
disable => [ "shared", "async" ],
13+
disable => [ "async" ],
1414
},
1515
"ios-xcrun" => {
1616
inherit_from => [ "ios-common" ],

‎deps/openssl/openssl/Configure

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -178,7 +178,6 @@ my @gcc_devteam_warn = qw(
178178
# -Wextended-offsetof -- no, needed in CMS ASN1 code
179179
my @clang_devteam_warn = qw(
180180
-Wno-unknown-warning-option
181-
-Wswitch-default
182181
-Wno-parentheses-equality
183182
-Wno-language-extension-token
184183
-Wno-extended-offsetof
@@ -1586,7 +1585,7 @@ if (!$disabled{makedepend}) {
15861585
disable('unavailable', 'makedepend') unless $config{makedep_scheme};
15871586
}
15881587

1589-
if (!$disabled{asm} && !$predefined_C{__MACH__} && $^O ne 'VMS') {
1588+
if (!$disabled{asm} && !$predefined_C{__MACH__} && $^O ne 'VMS' && !$predefined_C{_AIX}) {
15901589
# probe for -Wa,--noexecstack option...
15911590
if ($predefined_C{__clang__}) {
15921591
# clang has builtin assembler, which doesn't recognize --help,
@@ -3410,6 +3409,13 @@ sub absolutedir {
34103409
return rel2abs($dir);
34113410
}
34123411

3412+
# realpath() on Windows seems to check if the directory actually exists,
3413+
# which isn't what is wanted here. All we want to know is if a directory
3414+
# spec is absolute, not if it exists.
3415+
if ($^O eq "MSWin32") {
3416+
return rel2abs($dir);
3417+
}
3418+
34133419
# We use realpath() on Unix, since no other will properly clean out
34143420
# a directory spec.
34153421
use Cwd qw/realpath/;

‎deps/openssl/openssl/INSTALL.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1168,7 +1168,7 @@ Configure OpenSSL
11681168
### Automatic Configuration
11691169

11701170
In previous version, the `config` script determined the platform type and
1171-
compiler and then called `Configure`. Starting with this release, they are
1171+
compiler and then called `Configure`. Starting with version 3.0, they are
11721172
the same.
11731173

11741174
#### Unix / Linux / macOS
@@ -1622,7 +1622,7 @@ More about our support resources can be found in the [SUPPORT] file.
16221622

16231623
### Configuration Errors
16241624

1625-
If the `./Configure` or `./Configure` command fails with an error message,
1625+
If the `./config` or `./Configure` command fails with an error message,
16261626
read the error message carefully and try to figure out whether you made
16271627
a mistake (e.g., by providing a wrong option), or whether the script is
16281628
working incorrectly. If you think you encountered a bug, please

‎deps/openssl/openssl/NEWS.md

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,19 @@ OpenSSL Releases
1818
OpenSSL 3.0
1919
-----------
2020

21+
### Major changes between OpenSSL 3.0.14 and OpenSSL 3.0.15 [3 Sep 2024]
22+
23+
OpenSSL 3.0.15 is a security patch release. The most severe CVE fixed in this
24+
release is Moderate.
25+
26+
This release incorporates the following bug fixes and mitigations:
27+
28+
* Fixed possible denial of service in X.509 name checks
29+
([CVE-2024-6119])
30+
31+
* Fixed possible buffer overread in SSL_select_next_proto()
32+
([CVE-2024-5535])
33+
2134
### Major changes between OpenSSL 3.0.13 and OpenSSL 3.0.14 [4 Jun 2024]
2235

2336
* Fixed potential use after free after SSL_free_buffers() is called
@@ -1482,6 +1495,8 @@ OpenSSL 0.9.x
14821495

14831496
<!-- Links -->
14841497

1498+
[CVE-2024-6119]: https://www.openssl.org/news/vulnerabilities.html#CVE-2024-6119
1499+
[CVE-2024-5535]: https://www.openssl.org/news/vulnerabilities.html#CVE-2024-5535
14851500
[CVE-2024-4741]: https://www.openssl.org/news/vulnerabilities.html#CVE-2024-4741
14861501
[CVE-2024-4603]: https://www.openssl.org/news/vulnerabilities.html#CVE-2024-4603
14871502
[CVE-2024-2511]: https://www.openssl.org/news/vulnerabilities.html#CVE-2024-2511

‎deps/openssl/openssl/README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ What This Is
44
This is a fork of [OpenSSL](https://www.openssl.org) to enable QUIC. In addition
55
to the website, the official source distribution is at
66
<https://github.com/openssl/openssl>. The OpenSSL `README` can be found at
7-
[README-OpenSSL.md](https://github.com/quictls/openssl/blob/openssl-3.0.13%2Bquic/README-OpenSSL.md)
7+
[README-OpenSSL.md](https://github.com/quictls/openssl/blob/openssl-3.0.15%2Bquic/README-OpenSSL.md)
88

99
This fork adds APIs that can be used by QUIC implementations for connection
1010
handshakes. Quoting the IETF Working group

‎deps/openssl/openssl/VERSION.dat

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
MAJOR=3
22
MINOR=0
3-
PATCH=14
3+
PATCH=15
44
PRE_RELEASE_TAG=
55
BUILD_METADATA=quic
6-
RELEASE_DATE="4 Jun 2024"
6+
RELEASE_DATE="3 Sep 2024"
77
SHLIB_VERSION=81.3

‎deps/openssl/openssl/apps/cms.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2008-2023 The OpenSSL Project Authors. All Rights Reserved.
2+
* Copyright 2008-2024 The OpenSSL Project Authors. All Rights Reserved.
33
*
44
* Licensed under the Apache License 2.0 (the "License"). You may not use
55
* this file except in compliance with the License. You can obtain a copy
@@ -132,7 +132,7 @@ const OPTIONS cms_options[] = {
132132
{"binary", OPT_BINARY, '-',
133133
"Treat input as binary: do not translate to canonical form"},
134134
{"crlfeol", OPT_CRLFEOL, '-',
135-
"Use CRLF as EOL termination instead of CR only" },
135+
"Use CRLF as EOL termination instead of LF only" },
136136
{"asciicrlf", OPT_ASCIICRLF, '-',
137137
"Perform CRLF canonicalisation when signing"},
138138

0 commit comments

Comments
 (0)
pFad - Phonifier reborn

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


Alternative Proxies:

Alternative Proxy

pFad Proxy

pFad v3 Proxy

pFad v4 Proxy