From: Tomas Mraz Date: Fri, 21 Apr 2023 08:14:13 +0000 (+0200) Subject: Correct the CHANGES entry for CVE-2023-1255 X-Git-Tag: openssl-3.2.0-alpha1~968 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=e6990079c2413625d2039ebed49ea17a5b8cf935;p=thirdparty%2Fopenssl.git Correct the CHANGES entry for CVE-2023-1255 Reviewed-by: Hugo Landau Reviewed-by: Tom Cosgrove (Merged from https://github.com/openssl/openssl/pull/20798) --- diff --git a/CHANGES.md b/CHANGES.md index 9d4ace14055..60ef9febd79 100644 --- a/CHANGES.md +++ b/CHANGES.md @@ -271,9 +271,9 @@ OpenSSL 3.1 ### Changes between 3.1.0 and 3.1.1 [xx XXX xxxx] * Fixed buffer overread in AES-XTS decryption on ARM 64 bit platforms which - happens if the buffer size is 4 mod 5. This can trigger a crash of an - application using AES-XTS decryption if the memory just after the buffer - being decrypted is not mapped. + happens if the buffer size is 4 mod 5 in 16 byte AES blocks. This can + trigger a crash of an application using AES-XTS decryption if the memory + just after the buffer being decrypted is not mapped. Thanks to Anton Romanov (Amazon) for discovering the issue. ([CVE-2023-1255])