More OpenSSL security fixes

Thanks @1PW !
(when I was online not all the info was yet available)

OpenSSL Security Advisory [7th February 2023]
https://www.openssl.org/news/secadv/20230207.txt

Read there more!

Also here:
https://mta.openssl.org/pipermail/openssl-announce/2023-February/thread.html

 

Final version of OpenSSL 3.1.0 - 14 Mar 2023

https://www.openssl.org/news/newslog.html

OpenSSL 3.1 Series Release Notes
https://www.openssl.org/news/openssl-3.1-notes.html

See also:
OpenSSL version 3.1.0 published
https://mta.openssl.org/pipermail/openssl-announce/2023-March/000252.html

 

OpenSSL 1.1.1 End of Life - 11th September 2023
by Matt Caswell , Mar 28th, 2023
https://www.openssl.org/blog/blog/2023/03/28/1.1.1-EOL/

 

OpenSSL Security Advisory [20th April 2023]
Input buffer over-read in AES-XTS implementation on 64 bit ARM (CVE-2023-1255)
https://www.openssl.org/news/secadv/20230420.txt

Read there more.

See also https://mta.openssl.org/pipermail/openssl-announce/2023-April/thread.html

 

Forthcoming OpenSSL Releases - 30th May 2023

Two messages, for the timeline see also : https://mta.openssl.org/pipermail/openssl-announce/2023-May/thread.html

1.
Tomas Mraz
Wed May 24 04:06:12 UTC 2023
https://mta.openssl.org/pipermail/openssl-announce/2023-May/000258.html

2.
Matt Caswell
Wed May 24 09:49:13 UTC 2023
https://mta.openssl.org/pipermail/openssl-announce/2023-May/000259.html

 

OpenSSL Security Advisory [30th May 2023]
https://www.openssl.org/news/secadv/20230530.txt

= More quotes =
OpenSSL 3.0.x and 3.1.x are vulnerable to this issue.
OpenSSL 1.1.1 and 1.0.2 users may be affected by this issue when calling
OBJ_obj2txt() directly.

OpenSSL 3.0 users should upgrade to OpenSSL 3.0.9.
OpenSSL 3.1 users should upgrade to OpenSSL 3.1.1.
OpenSSL 1.1.1 users should upgrade to OpenSSL 1.1.1u.
OpenSSL 1.0.2 users should upgrade to OpenSSL 1.0.2zh (premium support
customers only).
= end of more quotes =

Read there more!

 

OpenSSL Security Advisory [14th July 2023]
AES-SIV implementation ignores empty associated data entries (CVE-2023-2975)
https://www.openssl.org/news/secadv/20230714.txt
https://mta.openssl.org/pipermail/openssl-announce/2023-July/000264.html

"Severity: Low

OpenSSL versions 3.0.0 to 3.0.9, and 3.1.0 to 3.1.1 are vulnerable to this
issue. The FIPS provider is not affected as the AES-SIV algorithm is not
FIPS approved and FIPS provider does not implement it.

OpenSSL versions 1.1.1 and 1.0.2 are not affected by this issue."

"Due to the low severity of this issue we are not issuing new releases of
OpenSSL at this time. The fix will be included in the next releases when they
become available. The fix is also available in commit 6a83f0c9 (for 3.1) and
commit 00e2f5ee (for 3.0) in the OpenSSL git repository."

 

Update 19th July 2023
https://mta.openssl.org/pipermail/openssl-announce/2023-July/000265.html

"OpenSSL Security Advisory [19th July 2023]
Excessive time spent checking DH keys and parameters (CVE-2023-3446)"

"Severity: Low
Issue summary: Checking excessively long DH keys or parameters may be very slow."

"Impact summary: Applications that use the functions DH_check(), DH_check_ex()
or EVP_PKEY_param_check() to check a DH key or DH parameters may experience long
delays. Where the key or parameters that are being checked have been obtained
from an untrusted source this may lead to a Denial of Service."

"The OpenSSL SSL/TLS implementation is not affected by this issue.

The OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue.

OpenSSL 3.1, 3.0, 1.1.1 and 1.0.2 are vulnerable to this issue.

Due to the low severity of this issue we are not issuing new releases of
OpenSSL at this time. The fix will be included in the next releases when they
become available. The fix is also available in commit fc9867c1 (for 3.1),
commit 1fa20cf2 (for 3.0) and commit 8780a896 (for 1.1.1) in the OpenSSL git
repository. It is available to premium support customer in commit 9a0a4d3c (for
1.0.2)."

 

Forthcoming OpenSSL Releases --> 1st August 2023

https://mta.openssl.org/pipermail/openssl-announce/2023-July/000266.html

 

As previously announced in the @FanJ post above, the following OpenSSL branches were updated on 01-August-2023:

1. 1.1.1v
2. 3.0.10
3. 3.1.2

https://www.openssl.org/news/newslog.html

https://www.openssl.org/news/changelog.html

 

Reminder : OpenSSL 1.1.1 End of Life on 11 September 2023

Carefully read again the article from 28 March 2023 (it was quoted here before):
OpenSSL 1.1.1 End of Life
https://www.openssl.org/blog/blog/2023/03/28/1.1.1-EOL/

In case you still need and/or want to use the 1.1.1. branch, you have to buy a premium support contract which offers extended support (i.e. ongoing access to security fixes) for 1.1.1 beyond its public EOL date.

For those interested: read that article!

 

Forthcoming OpenSSL Release - 11 Sep 2023

https://mta.openssl.org/pipermail/openssl-announce/2023-September/000271.html
Matt Caswell - Wed Sep 6 10:54:08 UTC 2023

 

OpenSSL version 1.1.1w released

https://mta.openssl.org/pipermail/openssl-announce/2023-September/000274.html
Mon Sep 11 15:06:43 UTC 2023

See also:
OpenSSL Security Advisory [8th September 2023]
POLY1305 MAC implementation corrupts XMM registers on Windows (CVE-2023-4807)
https://www.openssl.org/news/secadv/20230908.txt

Read there more.

 

Forthcoming OpenSSL Releases - 19 Sep 2023

https://mta.openssl.org/pipermail/openssl-announce/2023-September/000275.html
Tue Sep 12 16:34:47 UTC 2023

 

It was a bit difficult to find what is going to be fixed in versions 3.1.3 and 3.0.11. Or maybe I didn't look good enough.
But I think it is the same vulnerability that was fixed in version 1.1.1w last week.

Look here: https://www.openssl.org/news/vulnerabilities.html
Look there at:
CVE-2023-4807 POLY1305 MAC implementation corrupts XMM registers on Windows [Low severity] 08 September 2023

Now this quote from there:

 

OpenSSL version 3.0.11 published
https://mta.openssl.org/pipermail/openssl-announce/2023-September/000276.html
Tue Sep 19 13:55:22 UTC 2023

Release Notes:
https://www.openssl.org/news/openssl-3.0-notes.html

==========

OpenSSL version 3.1.3 published
https://mta.openssl.org/pipermail/openssl-announce/2023-September/000277.html
Tue Sep 19 13:55:29 UTC 2023

Release Notes:
https://www.openssl.org/news/openssl-3.1-notes.html