zzy/openssl
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Add CHANGES.md and NEWS.md entry for CVE-2023-5678

Browse Source 
Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/22647)

(cherry picked from commit 4ee71b4c302a06c24b46a5def1cff2096bd57f0b)
This commit is contained in:
Tomas Mraz 2023-11-07 15:22:00 +01:00
parent 96ee2c38ad
commit 4d4657cb6b
2 changed files with 17 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
CHANGES.md
View File

@ -488,7 +488,19 @@ OpenSSL 3.1
### Changes between 3.1.4 and 3.1.5 [xx XXX xxxx] ### Changes between 3.1.4 and 3.1.5 [xx XXX xxxx]
* none yet * Fix excessive time spent in DH check / generation with large Q parameter
value.
Applications that use the functions DH_generate_key() to generate an
X9.42 DH key may experience long delays. Likewise, applications that use
DH_check_pub_key(), DH_check_pub_key_ex() or EVP_PKEY_public_check()
to check an X9.42 DH key or X9.42 DH parameters may experience long delays.
Where the key or parameters that are being checked have been obtained from
an untrusted source this may lead to a Denial of Service.
([CVE-2023-5678])
*Richard Levitte*
### Changes between 3.1.3 and 3.1.4 [24 Oct 2023] ### Changes between 3.1.3 and 3.1.4 [24 Oct 2023]
@ -20316,6 +20328,7 @@ ndif
<!-- Links --> <!-- Links -->
[CVE-2023-5678]: https://www.openssl.org/news/vulnerabilities.html#CVE-2023-5678
[CVE-2023-5363]: https://www.openssl.org/news/vulnerabilities.html#CVE-2023-5363 [CVE-2023-5363]: https://www.openssl.org/news/vulnerabilities.html#CVE-2023-5363
[CVE-2023-4807]: https://www.openssl.org/news/vulnerabilities.html#CVE-2023-4807 [CVE-2023-4807]: https://www.openssl.org/news/vulnerabilities.html#CVE-2023-4807
[CVE-2023-3817]: https://www.openssl.org/news/vulnerabilities.html#CVE-2023-3817 [CVE-2023-3817]: https://www.openssl.org/news/vulnerabilities.html#CVE-2023-3817

4
NEWS.md
View File

@ -62,7 +62,8 @@ OpenSSL 3.1
### Major changes between OpenSSL 3.1.4 and OpenSSL 3.1.5 [under development] ### Major changes between OpenSSL 3.1.4 and OpenSSL 3.1.5 [under development]
* none * Fix excessive time spent in DH check / generation with large Q parameter
value ([CVE-2023-5678])
### Major changes between OpenSSL 3.1.3 and OpenSSL 3.1.4 [24 Oct 2023] ### Major changes between OpenSSL 3.1.3 and OpenSSL 3.1.4 [24 Oct 2023]
@ -1519,6 +1520,7 @@ OpenSSL 0.9.x
<!-- Links --> <!-- Links -->
[CVE-2023-5678]: https://www.openssl.org/news/vulnerabilities.html#CVE-2023-5678
[CVE-2023-5363]: https://www.openssl.org/news/vulnerabilities.html#CVE-2023-5363 [CVE-2023-5363]: https://www.openssl.org/news/vulnerabilities.html#CVE-2023-5363
[CVE-2023-4807]: https://www.openssl.org/news/vulnerabilities.html#CVE-2023-4807 [CVE-2023-4807]: https://www.openssl.org/news/vulnerabilities.html#CVE-2023-4807
[CVE-2023-3817]: https://www.openssl.org/news/vulnerabilities.html#CVE-2023-3817 [CVE-2023-3817]: https://www.openssl.org/news/vulnerabilities.html#CVE-2023-3817