changes and news entries for CVE-2023-5363

Reviewed-by: Hugo Landau <hlandau@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>

diff --git a/CHANGES.md b/CHANGES.md
index edb2ce987dfb74ea3d634322052eeb67693c8bb9..6b1176b927b8051956d66a607e058d9b86886725 100644 (file)
--- a/CHANGES.md
+++ b/CHANGES.md
@@ -24,7 +24,11 @@ OpenSSL 3.1
 
 ### Changes between 3.1.3 and 3.1.4 [xx XXX xxxx]
 
- * none yet
+ * Fix incorrect key and IV resizing issues when calling EVP_EncryptInit_ex2(),
+   EVP_DecryptInit_ex2() or EVP_CipherInit_ex2() with OSSL_PARAM parameters
+   that alter the key or IV length ([CVE-2023-5363]).
+
+   *Paul Dale*
 
 ### Changes between 3.1.2 and 3.1.3 [19 Sep 2023]
 
@@ -19860,6 +19864,7 @@ ndif
 
 <!-- Links -->
 
+[CVE-2023-5363]: https://www.openssl.org/news/vulnerabilities.html#CVE-2023-5363
 [CVE-2023-4807]: https://www.openssl.org/news/vulnerabilities.html#CVE-2023-4807
 [CVE-2023-3817]: https://www.openssl.org/news/vulnerabilities.html#CVE-2023-3817
 [CVE-2023-3446]: https://www.openssl.org/news/vulnerabilities.html#CVE-2023-3446

diff --git a/NEWS.md b/NEWS.md
index 0e14aa88ea9c3fa5e75e3ec09f1231b670ce4678..d1c7bca5d04334601bdccb62a3a854c204b28c86 100644 (file)
--- a/NEWS.md
+++ b/NEWS.md
@@ -21,7 +21,8 @@ OpenSSL 3.1
 
 ### Major changes between OpenSSL 3.1.3 and OpenSSL 3.1.4 [under development]
 
-  * none
+  * Mitigate incorrect resize handling for symmetric cipher keys and IVs.
+    ([CVE-2023-5363])
 
 ### Major changes between OpenSSL 3.1.2 and OpenSSL 3.1.3 [19 Sep 2023]
 
@@ -1473,6 +1474,7 @@ OpenSSL 0.9.x
 
 <!-- Links -->
 
+[CVE-2023-5363]: https://www.openssl.org/news/vulnerabilities.html#CVE-2023-5363
 [CVE-2023-4807]: https://www.openssl.org/news/vulnerabilities.html#CVE-2023-4807
 [CVE-2023-3817]: https://www.openssl.org/news/vulnerabilities.html#CVE-2023-3817
 [CVE-2023-3446]: https://www.openssl.org/news/vulnerabilities.html#CVE-2023-3446