Add CHANGES.md and NEWS.md entry for CVE-2023-5678

Reviewed-by: Richard Levitte <levitte@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/22647)

(cherry picked from commit 4ee71b4c302a06c24b46a5def1cff2096bd57f0b)

diff --git a/CHANGES.md b/CHANGES.md
index fad0e559aaed87504daf4c8439097570c4e7bf92..b5bea316f6c05a4358faf0d9174ccf132d2b9042 100644 (file)
--- a/CHANGES.md
+++ b/CHANGES.md
@@ -30,7 +30,19 @@ breaking changes, and mappings for the large list of deprecated functions.
 
 ### Changes between 3.0.12 and 3.0.13 [xx XXX xxxx]
 
- * none yet
+ * Fix excessive time spent in DH check / generation with large Q parameter
+   value.
+
+   Applications that use the functions DH_generate_key() to generate an
+   X9.42 DH key may experience long delays. Likewise, applications that use
+   DH_check_pub_key(), DH_check_pub_key_ex() or EVP_PKEY_public_check()
+   to check an X9.42 DH key or X9.42 DH parameters may experience long delays.
+   Where the key or parameters that are being checked have been obtained from
+   an untrusted source this may lead to a Denial of Service.
+
+   ([CVE-2023-5678])
+
+   *Richard Levitte*
 
 ### Changes between 3.0.11 and 3.0.12 [24 Oct 2023]
 
@@ -19744,6 +19756,7 @@ ndif
 
 <!-- Links -->
 
+[CVE-2023-5678]: https://www.openssl.org/news/vulnerabilities.html#CVE-2023-5678
 [CVE-2023-5363]: https://www.openssl.org/news/vulnerabilities.html#CVE-2023-5363
 [CVE-2023-4807]: https://www.openssl.org/news/vulnerabilities.html#CVE-2023-4807
 [CVE-2023-3817]: https://www.openssl.org/news/vulnerabilities.html#CVE-2023-3817

diff --git a/NEWS.md b/NEWS.md
index 1d1bda963c5aee66bc3a67f3802e5005fd661970..9162f3ce4e9bbdc856b2b0b7caba270556a1390a 100644 (file)
--- a/NEWS.md
+++ b/NEWS.md
@@ -20,7 +20,8 @@ OpenSSL 3.0
 
 ### Major changes between OpenSSL 3.0.12 and OpenSSL 3.0.13 [under development]
 
-  * none
+  * Fix excessive time spent in DH check / generation with large Q parameter
+    value ([CVE-2023-5678])
 
 ### Major changes between OpenSSL 3.0.11 and OpenSSL 3.0.12 [24 Oct 2023]
 
@@ -1462,6 +1463,7 @@ OpenSSL 0.9.x
 
 <!-- Links -->
 
+[CVE-2023-5678]: https://www.openssl.org/news/vulnerabilities.html#CVE-2023-5678
 [CVE-2023-5363]: https://www.openssl.org/news/vulnerabilities.html#CVE-2023-5363
 [CVE-2023-4807]: https://www.openssl.org/news/vulnerabilities.html#CVE-2023-4807
 [CVE-2023-3817]: https://www.openssl.org/news/vulnerabilities.html#CVE-2023-3817