From e47fa4a300da26e16a56de99c2ab4c8f96b5fc23 Mon Sep 17 00:00:00 2001 From: Tomas Mraz Date: Tue, 21 Mar 2023 16:15:47 +0100 Subject: [PATCH] Fix documentation of X509_VERIFY_PARAM_add0_policy() The function was incorrectly documented as enabling policy checking. Fixes: CVE-2023-0466 Reviewed-by: Matt Caswell Reviewed-by: Paul Dale (Merged from https://github.com/openssl/openssl/pull/20564) Signed-off-by: code4lala --- CHANGES | 5 +++++ NEWS | 1 + doc/man3/X509_VERIFY_PARAM_set_flags.pod | 9 +++++++-- 3 files changed, 13 insertions(+), 2 deletions(-) diff --git a/CHANGES b/CHANGES index f0cfcdc508..c0a3367237 100644 --- a/CHANGES +++ b/CHANGES @@ -9,6 +9,11 @@ Changes between 1.1.1s and 1.1.1t [xx XXX xxxx] + *) Corrected documentation of X509_VERIFY_PARAM_add0_policy() to mention + that it does not enable policy checking. Thanks to + David Benjamin for discovering this issue. (CVE-2023-0466) + [Tomas Mraz] + *) Fixed a type confusion vulnerability relating to X.400 address processing inside an X.509 GeneralName. X.400 addresses were parsed as an ASN1_STRING but subsequently interpreted by GENERAL_NAME_cmp as an ASN1_TYPE. This diff --git a/NEWS b/NEWS index 05991a0c21..0fa0178f8a 100644 --- a/NEWS +++ b/NEWS @@ -4,6 +4,7 @@ This file gives a brief overview of the major changes between each OpenSSL release. For more details please read the CHANGES file. + o Fixed documentation of X509_VERIFY_PARAM_add0_policy() (CVE-2023-0466) Major changes between OpenSSL 1.1.1j and OpenSSL 1.1.1k [25 Mar 2021] diff --git a/doc/man3/X509_VERIFY_PARAM_set_flags.pod b/doc/man3/X509_VERIFY_PARAM_set_flags.pod index f6f304bf7b..aa292f9336 100644 --- a/doc/man3/X509_VERIFY_PARAM_set_flags.pod +++ b/doc/man3/X509_VERIFY_PARAM_set_flags.pod @@ -92,8 +92,9 @@ B. X509_VERIFY_PARAM_set_time() sets the verification time in B to B. Normally the current time is used. -X509_VERIFY_PARAM_add0_policy() enables policy checking (it is disabled -by default) and adds B to the acceptable policy set. +X509_VERIFY_PARAM_add0_policy() adds B to the acceptable policy set. +Contrary to preexisting documentation of this function it does not enable +policy checking. X509_VERIFY_PARAM_set1_policies() enables policy checking (it is disabled by default) and sets the acceptable policy set to B. Any existing @@ -377,6 +378,10 @@ and has no effect. The X509_VERIFY_PARAM_get_hostflags() function was added in OpenSSL 1.1.0i. +The function X509_VERIFY_PARAM_add0_policy() was historically documented as +enabling policy checking however the implementation has never done this. +The documentation was changed to align with the implementation. + =head1 COPYRIGHT Copyright 2009-2020 The OpenSSL Project Authors. All Rights Reserved. -- GitLab