From: Tomas Mraz <tomas@openssl.org>
Date: Fri, 18 Oct 2024 11:51:37 +0000 (+0200)
Subject: Add CHANGES.md and NEWS.md entries for CVE-2024-9143
X-Git-Tag: openssl-3.0.16~89
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=8d5ef8d66cb30aedfe1d1a2ba5a2b3a207810b4a;p=thirdparty%2Fopenssl.git

Add CHANGES.md and NEWS.md entries for CVE-2024-9143

Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de>
(Merged from https://github.com/openssl/openssl/pull/25734)

(cherry picked from commit 233034bc5a294b26d37186dc68d7d6d8357d889a)
---

diff --git a/CHANGES.md b/CHANGES.md
index 12ff8f64eaf..78cc38fbc1c 100644
--- a/CHANGES.md
+++ b/CHANGES.md
@@ -30,7 +30,21 @@ breaking changes, and mappings for the large list of deprecated functions.
 
 ### Changes between 3.0.15 and 3.0.16 [xx XXX xxxx]
 
- * none yet
+ * Fixed possible OOB memory access with invalid low-level GF(2^m) elliptic
+   curve parameters.
+
+   Use of the low-level GF(2^m) elliptic curve APIs with untrusted
+   explicit values for the field polynomial can lead to out-of-bounds memory
+   reads or writes.
+   Applications working with "exotic" explicit binary (GF(2^m)) curve
+   parameters, that make it possible to represent invalid field polynomials
+   with a zero constant term, via the above or similar APIs, may terminate
+   abruptly as a result of reading or writing outside of array bounds. Remote
+   code execution cannot easily be ruled out.
+
+   ([CVE-2024-9143])
+
+   *Viktor Dukhovni*
 
 ### Changes between 3.0.14 and 3.0.15 [3 Sep 2024]
 
@@ -19926,6 +19940,7 @@ ndif
 
 <!-- Links -->
 
+[CVE-2024-9143]: https://www.openssl.org/news/vulnerabilities.html#CVE-2024-9143
 [CVE-2024-6119]: https://www.openssl.org/news/vulnerabilities.html#CVE-2024-6119
 [CVE-2024-5535]: https://www.openssl.org/news/vulnerabilities.html#CVE-2024-5535
 [CVE-2024-4741]: https://www.openssl.org/news/vulnerabilities.html#CVE-2024-4741
diff --git a/NEWS.md b/NEWS.md
index 6bef743c924..e917fbd7da1 100644
--- a/NEWS.md
+++ b/NEWS.md
@@ -20,7 +20,14 @@ OpenSSL 3.0
 
 ### Major changes between OpenSSL 3.0.15 and OpenSSL 3.0.16 [under development]
 
-  * none
+OpenSSL 3.3.3 is a security patch release. The most severe CVE fixed in this
+release is Low.
+
+This release incorporates the following bug fixes and mitigations:
+
+  * Fixed possible OOB memory access with invalid low-level GF(2^m) elliptic
+    curve parameters.
+    ([CVE-2024-9143])
 
 ### Major changes between OpenSSL 3.0.14 and OpenSSL 3.0.15 [3 Sep 2024]
 
@@ -1499,6 +1506,7 @@ OpenSSL 0.9.x
 
 <!-- Links -->
 
+[CVE-2024-9143]: https://www.openssl.org/news/vulnerabilities.html#CVE-2024-9143
 [CVE-2024-6119]: https://www.openssl.org/news/vulnerabilities.html#CVE-2024-6119
 [CVE-2024-5535]: https://www.openssl.org/news/vulnerabilities.html#CVE-2024-5535
 [CVE-2024-4741]: https://www.openssl.org/news/vulnerabilities.html#CVE-2024-4741