diff options
| author | Taichi Haradaguchi <20001722@ymail.ne.jp> | 2022-12-24 16:34:15 +0900 |
|---|---|---|
| committer | Caolán McNamara <caolanm@redhat.com> | 2023-01-06 20:42:54 +0000 |
| commit | f41966222f05ab327550dc7a5cf9ad40052124b3 (patch) | |
| tree | 21e8e4c3a06abcb524e81f4ea3a8641e1a366c77 /external | |
| parent | ec98e7769048d44c6d274e3edcac19d5cbc74348 (diff) | |
openssl3: add patch for CVE-2022-3996
Severity: Low
backport <https://github.com/openssl/openssl/commit/7725e7bfe6f2ce8146b6552b44e0d226be7638e7>.
OpenSSL 1.1.1 series are not affected by this vulnerability.
Security Advisary: https://www.openssl.org/news/secadv/20221213.txt
Change-Id: I42caba9c51291445fa96fc6f2280c681d6d6e582
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/144791
Tested-by: Jenkins
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
Diffstat (limited to 'external')
| -rw-r--r-- | external/openssl/0001-x509-fix-double-locking-problem.patch.1 | 39 | ||||
| -rw-r--r-- | external/openssl/UnpackedTarball_openssl.mk | 1 |
2 files changed, 40 insertions, 0 deletions
diff --git a/external/openssl/0001-x509-fix-double-locking-problem.patch.1 b/external/openssl/0001-x509-fix-double-locking-problem.patch.1 new file mode 100644 index 000000000000..ec289215e1a5 --- /dev/null +++ b/external/openssl/0001-x509-fix-double-locking-problem.patch.1 @@ -0,0 +1,39 @@ +From 7725e7bfe6f2ce8146b6552b44e0d226be7638e7 Mon Sep 17 00:00:00 2001 +From: Pauli <pauli@openssl.org> +Date: Fri, 11 Nov 2022 09:40:19 +1100 +Subject: [PATCH] x509: fix double locking problem + +This reverts commit 9aa4be691f5c73eb3c68606d824c104550c053f7 and removed the +redundant flag setting. + +Fixes #19643 + +Fixes LOW CVE-2022-3996 + +Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> +Reviewed-by: Tomas Mraz <tomas@openssl.org> +(Merged from https://github.com/openssl/openssl/pull/19652) + +(cherry picked from commit 4d0340a6d2f327700a059f0b8f954d6160f8eef5) +--- + crypto/x509/pcy_map.c | 4 ---- + 1 file changed, 4 deletions(-) + +diff --git a/crypto/x509/pcy_map.c b/crypto/x509/pcy_map.c +index 05406c6493..60dfd1e320 100644 +--- a/crypto/x509/pcy_map.c ++++ b/crypto/x509/pcy_map.c +@@ -73,10 +73,6 @@ int ossl_policy_cache_set_mapping(X509 *x, POLICY_MAPPINGS *maps) + + ret = 1; + bad_mapping: +- if (ret == -1 && CRYPTO_THREAD_write_lock(x->lock)) { +- x->ex_flags |= EXFLAG_INVALID_POLICY; +- CRYPTO_THREAD_unlock(x->lock); +- } + sk_POLICY_MAPPING_pop_free(maps, POLICY_MAPPING_free); + return ret; + +-- +2.39.0 + diff --git a/external/openssl/UnpackedTarball_openssl.mk b/external/openssl/UnpackedTarball_openssl.mk index 2a8f3bb3f905..7ee91bb43425 100644 --- a/external/openssl/UnpackedTarball_openssl.mk +++ b/external/openssl/UnpackedTarball_openssl.mk @@ -12,6 +12,7 @@ $(eval $(call gb_UnpackedTarball_UnpackedTarball,openssl)) $(eval $(call gb_UnpackedTarball_set_tarball,openssl,$(OPENSSL_TARBALL),,openssl)) $(eval $(call gb_UnpackedTarball_add_patches,openssl,\ + external/openssl/0001-x509-fix-double-locking-problem.patch.1 \ external/openssl/openssl-no-multilib.patch.0 \ external/openssl/configurable-z-option.patch.0 \ external/openssl/openssl-no-ipc-cmd.patch.0 \ |