From 87518c9f4f3be85725bca69ba097567ff99ac55d Mon Sep 17 00:00:00 2001 From: Tomas Mraz Date: Fri, 7 Jul 2023 09:54:18 +0200 Subject: [PATCH] Add CHANGES.md and NEWS.md entries for CVE-2023-2975 Reviewed-by: Matt Caswell Reviewed-by: Paul Dale (Merged from https://github.com/openssl/openssl/pull/21384) (cherry picked from commit 1e398bec538978b9957e69bf9e12b3c626290bea) Signed-off-by: code4lala --- CHANGES.md | 21 +++++++++++++++++++++ NEWS.md | 2 ++ 2 files changed, 23 insertions(+) diff --git a/CHANGES.md b/CHANGES.md index a8ff486acd..b3ee913c8a 100644 --- a/CHANGES.md +++ b/CHANGES.md @@ -28,6 +28,26 @@ breaking changes, and mappings for the large list of deprecated functions. [Migration guide]: https://github.com/openssl/openssl/tree/master/doc/man7/migration_guide.pod + * Do not ignore empty associated data entries with AES-SIV. + + The AES-SIV algorithm allows for authentication of multiple associated + data entries along with the encryption. To authenticate empty data the + application has to call `EVP_EncryptUpdate()` (or `EVP_CipherUpdate()`) + with NULL pointer as the output buffer and 0 as the input buffer length. + The AES-SIV implementation in OpenSSL just returns success for such call + instead of performing the associated data authentication operation. + The empty data thus will not be authenticated. ([CVE-2023-2975]) + + Thanks to Juerg Wullschleger (Google) for discovering the issue. + + The fix changes the authentication tag value and the ciphertext for + applications that use empty associated data entries with AES-SIV. + To decrypt data encrypted with previous versions of OpenSSL the application + has to skip calls to `EVP_DecryptUpdate()` for empty associated data + entries. + + *Tomas Mraz* + * Mitigate for the time it takes for `OBJ_obj2txt` to translate gigantic OBJECT IDENTIFIER sub-identifiers to canonical numeric text form. @@ -19475,6 +19495,7 @@ ndif +[CVE-2023-2975]: https://www.openssl.org/news/vulnerabilities.html#CVE-2023-2975 [CVE-2023-2650]: https://www.openssl.org/news/vulnerabilities.html#CVE-2023-2650 [CVE-2023-0466]: https://www.openssl.org/news/vulnerabilities.html#CVE-2023-0466 [CVE-2023-1255]: https://www.openssl.org/news/vulnerabilities.html#CVE-2023-1255 diff --git a/NEWS.md b/NEWS.md index ea27e52a76..d69402562c 100644 --- a/NEWS.md +++ b/NEWS.md @@ -17,6 +17,7 @@ OpenSSL Releases OpenSSL 3.0 ----------- + * Do not ignore empty associated data entries with AES-SIV ([CVE-2023-2975]) * Mitigate for very slow `OBJ_obj2txt()` performance with gigantic OBJECT IDENTIFIER sub-identities. ([CVE-2023-2650]) * Fixed documentation of X509_VERIFY_PARAM_add0_policy() ([CVE-2023-0466]) @@ -1424,6 +1425,7 @@ OpenSSL 0.9.x +[CVE-2023-2975]: https://www.openssl.org/news/vulnerabilities.html#CVE-2023-2975 [CVE-2023-2650]: https://www.openssl.org/news/vulnerabilities.html#CVE-2023-2650 [CVE-2023-0466]: https://www.openssl.org/news/vulnerabilities.html#CVE-2023-0466 [CVE-2023-1255]: https://www.openssl.org/news/vulnerabilities.html#CVE-2023-1255 -- GitLab