From nobody Tue Dec 14 19:11:55 2021 X-Original-To: dev-commits-ports-main@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id AEE4D18E361B; Tue, 14 Dec 2021 19:11:55 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4JD7KR3GZVz4qbx; Tue, 14 Dec 2021 19:11:55 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4FDC15E95; Tue, 14 Dec 2021 19:11:55 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.16.1/8.16.1) with ESMTP id 1BEJBtFW092009; Tue, 14 Dec 2021 19:11:55 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.16.1/8.16.1/Submit) id 1BEJBt77092008; Tue, 14 Dec 2021 19:11:55 GMT (envelope-from git) Date: Tue, 14 Dec 2021 19:11:55 GMT Message-Id: <202112141911.1BEJBt77092008@gitrepo.freebsd.org> To: ports-committers@FreeBSD.org, dev-commits-ports-all@FreeBSD.org, dev-commits-ports-main@FreeBSD.org From: Bernard Spil Subject: git: 6b9cf2b05cbc - main - security/vuxml: Document OpenSSL 3.0 vulnerability List-Id: Commits to the main branch of the FreeBSD ports repository List-Archive: https://lists.freebsd.org/archives/dev-commits-ports-main List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-dev-commits-ports-main@freebsd.org X-BeenThere: dev-commits-ports-main@freebsd.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: brnrd X-Git-Repository: ports X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 6b9cf2b05cbc4f00ed949e877beee3ec6c5ca592 Auto-Submitted: auto-generated ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1639509115; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=P1QdiEyd9kGOjbmg9LgScqBnIvxH79uA4CN74jfD6zo=; b=cKyyE17jL9vh8L/mGOUNS4kzc4bTelk/IS4GsMXUPc6sixZNsWoFmjPNl1ao7v3N5GTrh7 QmrfbJLnJNZrydSV/mcSgmtaegNf/rbkgZnM855FZ2RIXHGq7F2mFspCdWK0GF9xyICLVL tV7ysY4jUbiH3cP4nE4QmDvMeaYhkht5t1uFbqW5tT9qSqtqPDL2Fb4yJ7R9q2tWae9fCV F6DILC5vTm5tK6FODp+tdl+i5+RS5/rhunNbfi9ObIoZ7n1kGNrquaS0KlWGAVlVF6qc3w uE7DuVq7k9t7gFy+NYKmZoVXBiWqg3Ors5WgzCUd9bZbZZMYdhCIStkV6ckLug== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1639509115; a=rsa-sha256; cv=none; b=C5JNn5s0Jthz1711YadubLr/ERcLDJvd/HnabcEkJ427cCcEPPYeUPGLbDES0H0UlE0QcG ypJpPI5Kd9VnHLQCAsoyvU/ykhNbaPDAO22OzBCOMOs3EXbkiOuictPwPDvfCHoqpC5dx7 JVW6ORr2kw8USsSzWit/npJ0t/UbxGPbSORBGZ/FjkT1NQB+cfkzU6tsz1QIm/8KJwpcOe qGH4JV5C/QB0L8OE+MObVIb0WyrNxlWmcV+xvdDqi3h5zEuBPbO/opNU/ZXTs3Kq5PazTV vQgDMebAR/w0r3Zbhlaad0bBJuVRC85t+PHl3HpCO9odEmE7L4ReKtdHtfzngQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none X-ThisMailContainsUnwantedMimeParts: N The branch main has been updated by brnrd: URL: https://cgit.FreeBSD.org/ports/commit/?id=6b9cf2b05cbc4f00ed949e877beee3ec6c5ca592 commit 6b9cf2b05cbc4f00ed949e877beee3ec6c5ca592 Author: Bernard Spil AuthorDate: 2021-12-14 19:11:53 +0000 Commit: Bernard Spil CommitDate: 2021-12-14 19:11:53 +0000 security/vuxml: Document OpenSSL 3.0 vulnerability --- security/vuxml/vuln-2021.xml | 42 ++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 42 insertions(+) diff --git a/security/vuxml/vuln-2021.xml b/security/vuxml/vuln-2021.xml index 370da9897545..fc0c1bc5cdfe 100644 --- a/security/vuxml/vuln-2021.xml +++ b/security/vuxml/vuln-2021.xml @@ -1,3 +1,45 @@ + + OpenSSL -- Certificate validation issue + + + openssl-devel + 3.0.1 + + + + +

The OpenSSL project reports:

+
+

Invalid handling of X509_verify_cert() internal errors in libssl + (Moderate)

+

Internally libssl in OpenSSL calls X509_verify_cert() on the client + side to verify a certificate supplied by a server. That function may + return a negative return value to indicate an internal error (for + example out of memory). Such a negative return value is mishandled by + OpenSSL and will cause an IO function (such as SSL_connect() or + SSL_do_handshake()) to not indicate success and a subsequent call to + SSL_get_error() to return the value SSL_ERROR_WANT_RETRY_VERIFY. + This return value is only supposed to be returned by OpenSSL if the + application has previously called SSL_CTX_set_cert_verify_callback(). + Since most applications do not do this the + SSL_ERROR_WANT_RETRY_VERIFY return value from SSL_get_error() will be + totally unexpected and applications may not behave correctly as a + result. The exact behaviour will depend on the application but it + could result in crashes, infinite loops or other similar incorrect + responses.

+
+ + + + CVE-2021-4044 + https://www.openssl.org/news/secadv/20211214.txt + + + 2021-12-14 + 2021-12-14 + + + bastillion -- log4j vulnerability