Add CHANGES.md and NEWS.md entries for CVE-2023-3817

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Todd Short <todd.short@me.com>
(Merged from https://github.com/openssl/openssl/pull/21550)

(cherry picked from commit 4b29762802c05fa871f0e1efcf804e86db0ddaa2)

diff --git a/CHANGES.md b/CHANGES.md
index 3a716ee8e287e77043979317cdf47c04ef9db575..fb3959f177719014edc0b5ad333c8adba46444e6 100644 (file)
--- a/CHANGES.md
+++ b/CHANGES.md
@@ -24,7 +24,24 @@ OpenSSL 3.1
 
 ### Changes between 3.1.1 and 3.1.2 [xx XXX xxxx]
 
- * Fix DH_check() excessive time with over sized modulus
+ * Fix excessive time spent checking DH q parameter value.
+
+   The function DH_check() performs various checks on DH parameters. After
+   fixing CVE-2023-3446 it was discovered that a large q parameter value can
+   also trigger an overly long computation during some of these checks.
+   A correct q value, if present, cannot be larger than the modulus p
+   parameter, thus it is unnecessary to perform these checks if q is larger
+   than p.
+
+   If DH_check() is called with such q parameter value,
+   DH_CHECK_INVALID_Q_VALUE return flag is set and the computationally
+   intensive checks are skipped.
+
+   ([CVE-2023-3817])
+
+   *Tomáš Mráz*
+
+ * Fix DH_check() excessive time with over sized modulus.
 
    The function DH_check() performs various checks on DH parameters. One of
    those checks confirms that the modulus ("p" parameter) is not too large.
@@ -61,7 +78,7 @@ OpenSSL 3.1
    has to skip calls to `EVP_DecryptUpdate()` for empty associated data
    entries.
 
-   *Tomas Mraz*
+   *Tomáš Mráz*
 
  * When building with the `enable-fips` option and using the resulting
    FIPS provider, TLS 1.2 will, by default, mandate the use of an extended
@@ -19815,6 +19832,7 @@ ndif
 
 <!-- Links -->
 
+[CVE-2023-3817]: https://www.openssl.org/news/vulnerabilities.html#CVE-2023-3817
 [CVE-2023-3446]: https://www.openssl.org/news/vulnerabilities.html#CVE-2023-3446
 [CVE-2023-2975]: https://www.openssl.org/news/vulnerabilities.html#CVE-2023-2975
 [RFC 2578 (STD 58), section 3.5]: https://datatracker.ietf.org/doc/html/rfc2578#section-3.5

diff --git a/NEWS.md b/NEWS.md
index 7d3596a0867a87ff604dc705c0067931c6fd16c8..fa9ad018518317da8b82c2330f3c3831d47286ad 100644 (file)
--- a/NEWS.md
+++ b/NEWS.md
@@ -21,6 +21,7 @@ OpenSSL 3.1
 
 ### Major changes between OpenSSL 3.1.1 and OpenSSL 3.1.2 [under development]
 
+  * Fix excessive time spent checking DH q parameter value ([CVE-2023-3817])
   * Fix DH_check() excessive time with over sized modulus ([CVE-2023-3446])
   * Do not ignore empty associated data entries with AES-SIV ([CVE-2023-2975])
   * When building with the `enable-fips` option and using the resulting
@@ -1463,6 +1464,7 @@ OpenSSL 0.9.x
 
 <!-- Links -->
 
+[CVE-2023-3817]: https://www.openssl.org/news/vulnerabilities.html#CVE-2023-3817
 [CVE-2023-3446]: https://www.openssl.org/news/vulnerabilities.html#CVE-2023-3446
 [CVE-2023-2975]: https://www.openssl.org/news/vulnerabilities.html#CVE-2023-2975
 [CVE-2023-2650]: https://www.openssl.org/news/vulnerabilities.html#CVE-2023-2650