From bcbde69b87584ce5b21f3c959c90a7808ef0c13d Mon Sep 17 00:00:00 2001 From: Matt Caswell Date: Tue, 27 Mar 2018 10:58:34 +0100 Subject: [PATCH] Update CHANGES and NEWS for the new release Reviewed-by: Richard Levitte --- CHANGES | 27 +++++++++++++++++++++++++++ NEWS | 3 +++ 2 files changed, 30 insertions(+) diff --git a/CHANGES b/CHANGES index 3eb1cc3d19..d3051bc6fc 100644 --- a/CHANGES +++ b/CHANGES @@ -9,6 +9,33 @@ Changes between 1.1.0g and 1.1.0h [xx XXX xxxx] + *) Constructed ASN.1 types with a recursive definition could exceed the stack + + Constructed ASN.1 types with a recursive definition (such as can be found + in PKCS7) could eventually exceed the stack given malicious input with + excessive recursion. This could result in a Denial Of Service attack. There + are no such structures used within SSL/TLS that come from untrusted sources + so this is considered safe. + + This issue was reported to OpenSSL on 4th January 2018 by the OSS-fuzz + project. + (CVE-2018-0739) + [Matt Caswell] + + *) Incorrect CRYPTO_memcmp on HP-UX PA-RISC + + Because of an implementation bug the PA-RISC CRYPTO_memcmp function is + effectively reduced to only comparing the least significant bit of each + byte. This allows an attacker to forge messages that would be considered as + authenticated in an amount of tries lower than that guaranteed by the + security claims of the scheme. The module can only be compiled by the + HP-UX assembler, so that only HP-UX PA-RISC targets are affected. + + This issue was reported to OpenSSL on 2nd March 2018 by Peter Waltenberg + (IBM). + (CVE-2018-0733) + [Andy Polyakov] + *) Add a build target 'build_all_generated', to build all generated files and only that. This can be used to prepare everything that requires things like perl for a system that lacks perl and then move everything diff --git a/NEWS b/NEWS index 8b5b971ce4..b077b594db 100644 --- a/NEWS +++ b/NEWS @@ -7,6 +7,9 @@ Major changes between OpenSSL 1.1.0g and OpenSSL 1.1.0h [under development] + o Constructed ASN.1 types with a recursive definition could exceed the + stack (CVE-2018-0739) + o Incorrect CRYPTO_memcmp on HP-UX PA-RISC (CVE-2018-0733) o rsaz_1024_mul_avx2 overflow bug on x86_64 (CVE-2017-3738) Major changes between OpenSSL 1.1.0f and OpenSSL 1.1.0g [2 Nov 2017] -- 2.25.1