From 200688f74a741c00a9fa2aceaacc74c176ee1e0b Mon Sep 17 00:00:00 2001 From: Tomas Mraz Date: Tue, 7 Nov 2023 15:22:00 +0100 Subject: [PATCH] Add CHANGES.md and NEWS.md entry for CVE-2023-5678 Reviewed-by: Richard Levitte Reviewed-by: Matt Caswell (Merged from https://github.com/openssl/openssl/pull/22647) (cherry picked from commit 4ee71b4c302a06c24b46a5def1cff2096bd57f0b) --- CHANGES.md | 15 ++++++++++++++- NEWS.md | 4 +++- 2 files changed, 17 insertions(+), 2 deletions(-) diff --git a/CHANGES.md b/CHANGES.md index fad0e559aae..b5bea316f6c 100644 --- a/CHANGES.md +++ b/CHANGES.md @@ -30,7 +30,19 @@ breaking changes, and mappings for the large list of deprecated functions. ### Changes between 3.0.12 and 3.0.13 [xx XXX xxxx] - * none yet + * Fix excessive time spent in DH check / generation with large Q parameter + value. + + Applications that use the functions DH_generate_key() to generate an + X9.42 DH key may experience long delays. Likewise, applications that use + DH_check_pub_key(), DH_check_pub_key_ex() or EVP_PKEY_public_check() + to check an X9.42 DH key or X9.42 DH parameters may experience long delays. + Where the key or parameters that are being checked have been obtained from + an untrusted source this may lead to a Denial of Service. + + ([CVE-2023-5678]) + + *Richard Levitte* ### Changes between 3.0.11 and 3.0.12 [24 Oct 2023] @@ -19744,6 +19756,7 @@ ndif +[CVE-2023-5678]: https://www.openssl.org/news/vulnerabilities.html#CVE-2023-5678 [CVE-2023-5363]: https://www.openssl.org/news/vulnerabilities.html#CVE-2023-5363 [CVE-2023-4807]: https://www.openssl.org/news/vulnerabilities.html#CVE-2023-4807 [CVE-2023-3817]: https://www.openssl.org/news/vulnerabilities.html#CVE-2023-3817 diff --git a/NEWS.md b/NEWS.md index 1d1bda963c5..9162f3ce4e9 100644 --- a/NEWS.md +++ b/NEWS.md @@ -20,7 +20,8 @@ OpenSSL 3.0 ### Major changes between OpenSSL 3.0.12 and OpenSSL 3.0.13 [under development] - * none + * Fix excessive time spent in DH check / generation with large Q parameter + value ([CVE-2023-5678]) ### Major changes between OpenSSL 3.0.11 and OpenSSL 3.0.12 [24 Oct 2023] @@ -1462,6 +1463,7 @@ OpenSSL 0.9.x +[CVE-2023-5678]: https://www.openssl.org/news/vulnerabilities.html#CVE-2023-5678 [CVE-2023-5363]: https://www.openssl.org/news/vulnerabilities.html#CVE-2023-5363 [CVE-2023-4807]: https://www.openssl.org/news/vulnerabilities.html#CVE-2023-4807 [CVE-2023-3817]: https://www.openssl.org/news/vulnerabilities.html#CVE-2023-3817 -- 2.47.2