From 6ecbd3d6800f1c273a5ab84088eb0d46504fd10d Mon Sep 17 00:00:00 2001 From: Enji Cooper Date: Tue, 9 Jun 2026 12:06:49 -0700 Subject: openssl: import 3.0.21 This change adds OpenSSL 3.0.21 from upstream [1]. The 3.0.21 artifact was been verified via PGP key [2] and by SHA256 checksum [3]. This change is a security release which resolves several issues with OpenSSL 3.0, the highest severity issue being ranked "High". Users are strongly encouraged to update to this release. More information about the release (from a high level) can be found in the release notes [4]. Updated via [5] with `update_openssl.sh 3.0.21`. 1. https://github.com/openssl/openssl/releases/download/openssl-3.0.21/openssl-3.0.21.tar.gz 2. https://github.com/openssl/openssl/releases/download/openssl-3.0.21/openssl-3.0.21.tar.gz.asc 3. https://github.com/openssl/openssl/releases/download/openssl-3.0.21/openssl-3.0.21.tar.gz.sha256 4. https://github.com/openssl/openssl/blob/openssl-3.0.21/NEWS.md 5. https://codeberg.org/ngie/freebsd-powertools/src/branch/main/shell/update_openssl.sh (facdfe954) --- crypto/cms/cms_enc.c | 20 +++++++++++++------- 1 file changed, 13 insertions(+), 7 deletions(-) (limited to 'crypto/cms/cms_enc.c') diff --git a/crypto/cms/cms_enc.c b/crypto/cms/cms_enc.c index 8c1a15aeda71..450d8df43f66 100644 --- a/crypto/cms/cms_enc.c +++ b/crypto/cms/cms_enc.c @@ -1,5 +1,5 @@ /* - * Copyright 2008-2023 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2008-2026 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -23,7 +23,7 @@ /* Return BIO based on EncryptedContentInfo and key */ BIO *ossl_cms_EncryptedContent_init_bio(CMS_EncryptedContentInfo *ec, - const CMS_CTX *cms_ctx) + const CMS_CTX *cms_ctx, int auth) { BIO *b; EVP_CIPHER_CTX *ctx; @@ -104,14 +104,20 @@ BIO *ossl_cms_EncryptedContent_init_bio(CMS_EncryptedContentInfo *ec, goto err; } if ((EVP_CIPHER_get_flags(cipher) & EVP_CIPH_FLAG_AEAD_CIPHER)) { + if (!auth) { + ERR_raise(ERR_LIB_CMS, CMS_R_CIPHER_AEAD_IN_ENVELOPED_DATA); + goto err; + } piv = aparams.iv; - if (ec->taglen > 0 - && EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_SET_TAG, - ec->taglen, ec->tag) - <= 0) { + + if (ec->taglen < 4 || ec->taglen > 16 + || EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_SET_TAG, (int)ec->taglen, ec->tag) <= 0) { ERR_raise(ERR_LIB_CMS, CMS_R_CIPHER_AEAD_SET_TAG_ERROR); goto err; } + } else if (auth) { + ERR_raise(ERR_LIB_CMS, CMS_R_UNSUPPORTED_CONTENT_ENCRYPTION_ALGORITHM); + goto err; } } len = EVP_CIPHER_CTX_get_key_length(ctx); @@ -263,5 +269,5 @@ BIO *ossl_cms_EncryptedData_init_bio(const CMS_ContentInfo *cms) if (enc->encryptedContentInfo->cipher && enc->unprotectedAttrs) enc->version = 2; return ossl_cms_EncryptedContent_init_bio(enc->encryptedContentInfo, - ossl_cms_get0_cmsctx(cms)); + ossl_cms_get0_cmsctx(cms), 0); } -- cgit v1.3