OpenSSL 1.1.1v + x64

Fix excessive time spent checking DH q parameter value: The function DH_check() performs various checks on DH parameters. After fixing CVE-2023-3446 it was discovered that a large q parameter value can also trigger an overly long computation during some of these checks. A correct q value, if present, cannot be larger than the modulus parameter, thus it is unnecessary to perform these checks if q is larger than p.
If DH_check() is called with such q parameter value, DH_CHECK_INVALID_Q_VALUE return flag is set and the computationally intensive checks are skipped.
Fix DH_check() excessive time with over sized modulus:
The function DH_check() performs various checks on DH parameters. One of those checks confirms that the modulus ("p" parameter) is not too large. Trying to use a very large modulus is slow and OpenSSL will not normally use a modulus which is over 10,000 bits in length. However the DH_check() function checks numerous aspects of the key or
parameters that have been supplied. Some of those checks use the supplied modulus value even if it has already been found to be too large.
A new limit has been added to DH_check of 32,768 bits. Supplying a key/parameters with a modulus over this size will simply cause DH_check() to fail.

*) DH small subgroups

Historically OpenSSL only ever generated DH parameters based on "safe"
primes. More recently (in version 1.0.2) support was provided for
generating X9.42 style parameter files such as those required for RFC 5114
support. The primes used in such files may not be "safe". Where an
application is using DH configured with parameters based on primes that are
not "safe" then an attacker could use this fact to find a peer's private
DH exponent. This attack requires that the attacker complete multiple
handshakes in which the peer uses the same private DH exponent. For example
this could be used to discover a TLS server's private DH exponent if it's
reusing the private DH exponent or it's using a static DH ciphersuite.

OpenSSL provides the option SSL_OP_SINGLE_DH_USE for ephemeral DH (DHE) in
TLS. It is not on by default. If the option is not set then the server
reuses the same private DH exponent for the life of the server process and
would be vulnerable to this attack. It is believed that many popular
applications do set this option and would therefore not be at risk.

The fix for this issue adds an additional check where a "q" parameter is
available (as is the case in X9.42 based parameters). This detects the
only known attack, and is the only possible defense for static DH
ciphersuites. This could have some performance impact.

Additionally the SSL_OP_SINGLE_DH_USE option has been switched on by
default and cannot be disabled. This could have some performance impact.

This issue was reported to OpenSSL by Antonio Sanso (Adobe).
(CVE-2016-0701)
[Matt Caswell]

*) SSLv2 doesn't block disabled ciphers

A malicious client can negotiate SSLv2 ciphers that have been disabled on
the server and complete SSLv2 handshakes even if all SSLv2 ciphers have
been disabled, provided that the SSLv2 protocol was not also disabled via
SSL_OP_NO_SSLv2.

This issue was reported to OpenSSL on 26th December 2015 by Nimrod Aviram
and Sebastian Schinzel.
(CVE-2015-3197)
[Viktor Dukhovni]

*) Reject DH handshakes with parameters shorter than 1024 bits.
[Kurt Roeckx]

OpenSSL 1.0.2 ClientHello sigalgs DoS fix (CVE-2015-0291)
Multiblock corrupted pointer fix (CVE-2015-0290)
Segmentation fault in DTLSv1_listen fix (CVE-2015-0207)
Segmentation fault in ASN1_TYPE_cmp fix (CVE-2015-0286)
Segmentation fault for invalid PSS parameters fix (CVE-2015-0208)
ASN.1 structure reuse memory corruption fix (CVE-2015-0287)
PKCS7 NULL pointer dereferences fix (CVE-2015-0289)
DoS via reachable assert in SSLv2 servers fix (CVE-2015-0293)
Empty CKE with client auth and DHE fix (CVE-2015-1787)
Handshake with unseeded PRNG fix (CVE-2015-0285)
Use After Free following d2i_ECPrivatekey error fix (CVE-2015-0209)
X509_to_X509_REQ NULL pointer deref fix (CVE-2015-0288)
Removed the export ciphers from the DEFAULT ciphers

Suite B support for TLS 1.2 and DTLS 1.2
Support for DTLS 1.2
TLS automatic EC curve selection.
API to set TLS supported signature algorithms and curves
SSL_CONF configuration API.
TLS Brainpool support.
ALPN support.
CMS support for RSA-PSS, RSA-OAEP, ECDH and X9.42 DH.

Build fixes for the Windows and OpenVMS platforms

Major changes between OpenSSL 1.0.1i and OpenSSL 1.0.1j [15 Oct 2014]
Fix for CVE-2014-3513
Fix for CVE-2014-3567
Mitigation for CVE-2014-3566 (SSL protocol vulnerability)
Fix for CVE-2014-3568

Чтобы видеть скрытый текст, вам надо зарегистрироваться, набрать 5 комментариев, подробности в разделе ЧАВО-РЕЙТИНГ