From 4b6f33a5c284168ef3aa49d1a37cbcc6565bc0e5 Mon Sep 17 00:00:00 2001 From: Matt Caswell Date: Thu, 4 Jun 2015 11:16:16 +0100 Subject: [PATCH] Clean premaster_secret for GOST Ensure OPENSSL_cleanse() is called on the premaster secret value calculated for GOST. With thanks to the Open Crypto Audit Project for reporting this issue. Reviewed-by: Rich Salz (cherry picked from commit b7ee4815f2452c854cc859e8dda88f2673cdddea) Conflicts: ssl/s3_srvr.c --- ssl/s3_srvr.c | 1 + 1 file changed, 1 insertion(+) diff --git a/ssl/s3_srvr.c b/ssl/s3_srvr.c index d07f76887d..9aa329260a 100644 --- a/ssl/s3_srvr.c +++ b/ssl/s3_srvr.c @@ -2914,6 +2914,7 @@ int ssl3_get_client_key_exchange(SSL *s) s-> session->master_key, premaster_secret, 32); + OPENSSL_cleanse(premaster_secret, sizeof(premaster_secret)); /* Check if pubkey from client certificate was used */ if (EVP_PKEY_CTX_ctrl (pkey_ctx, -1, -1, EVP_PKEY_CTRL_PEER_KEY, 2, NULL) > 0) -- 2.25.1