Make RSA decryption API safe to use with PKCS#1 v1.5 padding #13817

tomato42 · 2021-01-08T18:39:54Z

fixes #13421

The code is functional (behaves the same as the implementation in NSS and tlslite-ng).

We need to decide if we want to cache the d_hash value or not.

Checklist

documentation is added or updated
tests are added or updated
- the test vectors are verified in tlslite-ng
decide if the the hash of the private exponent should live in the RSA structure or not
make sure we still handle the mismatch between buffer size and key size the same way

crypto/rsa/rsa_ossl.c

crypto/rsa/rsa_pk1.c

tomato42 · 2021-01-08T20:01:43Z

@beldmit thanks, updated

beldmit · 2021-01-08T20:20:46Z

Build failures seems relevant

crypto/rsa/rsa_ossl.c

crypto/rsa/rsa_pk1.c

tomato42 · 2021-01-11T17:19:50Z

@beldmit updated

beldmit · 2021-01-11T17:22:40Z

@tomato42 build failures still persist :(

crypto/rsa/rsa_ossl.c

crypto/rsa/rsa_pk1.c

crypto/rsa/rsa_ossl.c

crypto/rsa/rsa_pk1.c

tomato42 · 2021-01-13T14:49:36Z

@beldmit @t8m PR updated

crypto/rsa/rsa_pk1.c

t8m · 2021-01-13T15:38:37Z

This looks good to me now, however given this is an API break we should discuss it within OTC at least.

junaruga · 2024-03-06T19:24:00Z

@t8m do you plan to merge it to 3.1.0 later?

There is currently no plan to merge it to 3.1 branch.

@t8m I am not sure if you remember this old pull-request. But may I ask you why there is currently no plan to merge it to 3.1 branch? What prevented you from backporting this PR to the OpenSSL 3.1/3.0?

There is already a patch for this pull-request included in the downstream OpenSSL 3.1 RPM package on Fedora Linux 39.
https://src.fedoraproject.org/rpms/openssl/blob/f39/f/0079-RSA-PKCS15-implicit-rejection.patch

And there is also already a patch for this pull-request included in the downstrem OpenSSL 3.0 RPM package on Feodra Linux 38.
https://src.fedoraproject.org/rpms/openssl/blob/f38/f/0100-RSA-PKCS15-implicit-rejection.patch

So, I assume preparing the patches for the OpenSSL 3.1/3.0 is relatively easy. For example, if @tomato42 will send the pull-requests into both the openssl-3.1 and openssl-3.0 branches, could you help to review the pull-requests?

t8m · 2024-03-13T17:47:09Z

This is clearly a feature and thus it is not eligible to be merged to stable branches.

junaruga · 2024-03-14T12:24:05Z

This is clearly a feature and thus it is not eligible to be merged to stable branches.

@t8m Thanks for your reply. If you think this PR is about a feature, not backporting to the stable branches makes sense to me.

While this PR adds the rsa_pkcs1_implicit_rejection, I was thinking this PR is about a security fix. If a change is about a security fix, you would generally backport it to the stable branches, right?

While I can see the CVE-2020-25659 for python-cryptography and CVE-2020-25657 for m2crypto in CHANGES.md of this PR, does not OpenSSL project have the own CVE ID?

t8m · 2024-03-14T14:19:10Z

No, we do not regard this issue as a security issue and we did not assign a CVE to it.

neverpanic · 2024-03-16T16:18:21Z

FYI, Ubuntu has backported this change.

junaruga · 2024-04-16T08:11:31Z

No, we do not regard this issue as a security issue and we did not assign a CVE to it.

@t8m OK. Why do you think you don't regard this issue as a security issue?

Perhaps, do you think that in OpenSSL 3.1 or older versions, using the RSA decryption API safely is a responsibility of users or applications using OpenSSL C APIs? If you think so, could you create a document in this repository or somewhere to guide users about how to use the RSA decryption API safely in OpenSSL 3.1 or earlier versions? Or Is there already such a document?

tomato42 · 2024-04-16T11:54:17Z

https://www.openssl.org/docs/man3.0/man3/RSA_private_decrypt.html

WARNINGS

Decryption failures in the RSA_PKCS1_PADDING mode leak information
which can potentially be used to mount a Bleichenbacher padding oracle
attack. This is an inherent weakness in the PKCS #1 v1.5 padding design.
Prefer RSA_PKCS1_OAEP_PADDING.

The newer man page is much more explicit:
https://www.openssl.org/docs/man3.2/man3/EVP_PKEY_decrypt.html

In OpenSSL versions before 3.2.0, when used in PKCS#1 v1.5 padding,
both the return value from the EVP_PKEY_decrypt() and the outlen
provided information useful in mounting a Bleichenbacher attack
against the used private key. They had to processed in a side-channel
free way.

junaruga · 2024-04-16T12:06:21Z

@tomato42 Thanks for providing the info. OK. OpenSSL project already has such a document.

tomato42 · 2024-04-16T13:05:18Z

@junaruga I've proposed a PR to make the documentation even more explicit: #24159, feel free to comment on that.

pkgsrc change: Instead of patch configure, patch m4 files and use autoconf to generate configure. PHP 8.1.29 (2024-06-06) - CGI: . Fixed bug GHSA-3qgc-jrrr-25jv (Bypass of CVE-2012-1823, Argument Injection in PHP-CGI). (CVE-2024-4577) (nielsdos) - Filter: . Fixed bug GHSA-w8qr-v226-r27w (Filter bypass in filter_var FILTER_VALIDATE_URL). (CVE-2024-5458) (nielsdos) - OpenSSL: . The openssl_private_decrypt function in PHP, when using PKCS1 padding (OPENSSL_PKCS1_PADDING, which is the default), is vulnerable to the Marvin Attack unless it is used with an OpenSSL version that includes the changes from this pull request: openssl/openssl#13817 (rsa_pkcs1_implicit_rejection). These changes are part of OpenSSL 3.2 and have also been backported to stable versions of various Linux distributions, as well as to the PHP builds provided for Windows since the previous release. All distributors and builders should ensure that this version is used to prevent PHP from being vulnerable. (CVE-2024-2408) - Standard: . Fixed bug GHSA-9fcc-425m-g385 (Bypass of CVE-2024-1874). (CVE-2024-5585) (nielsdos)

pkgsrc change: Instead of patch configure, patch m4 files and use autoconf to generate configure. PHP 8.3.8 (2024-06-06) - CGI: . Fixed buffer limit on Windows, replacing read call usage by _read. (David Carlier) . Fixed bug GHSA-3qgc-jrrr-25jv (Bypass of CVE-2012-1823, Argument Injection in PHP-CGI). (CVE-2024-4577) (nielsdos) - CLI: . Fixed bug GH-14189 (PHP Interactive shell input state incorrectly handles quoted heredoc literals.). (nielsdos) - Core: . Fixed bug GH-13970 (Incorrect validation of #[Attribute] flags type for non-compile-time expressions). (ilutov) - DOM: . Fix crashes when entity declaration is removed while still having entity references. (nielsdos) . Fix references not handled correctly in C14N. (nielsdos) . Fix crash when calling childNodes next() when iterator is exhausted. (nielsdos) . Fix crash in ParentNode::append() when dealing with a fragment containing text nodes. (nielsdos) - Filter: . Fixed bug GHSA-w8qr-v226-r27w (Filter bypass in filter_var FILTER_VALIDATE_URL). (CVE-2024-5458) (nielsdos) - FPM: . Fix bug GH-14175 (Show decimal number instead of scientific notation in systemd status). (Benjamin Cremer) - Hash: . ext/hash: Swap the checking order of `__has_builtin` and `__GNUC__` (Saki Takamachi) - Intl: . Fixed build regression on systems without C++17 compilers. (Calvin Buckley, Peter Kokot) - MySQLnd: . Fix bug GH-14255 (mysqli_fetch_assoc reports error from nested query). (Kamil Tekiela) - Opcache: . Fixed bug GH-14109 (Fix accidental persisting of internal class constant in shm). (ilutov) - OpenSSL: . The openssl_private_decrypt function in PHP, when using PKCS1 padding (OPENSSL_PKCS1_PADDING, which is the default), is vulnerable to the Marvin Attack unless it is used with an OpenSSL version that includes the changes from this pull request: openssl/openssl#13817 (rsa_pkcs1_implicit_rejection). These changes are part of OpenSSL 3.2 and have also been backported to stable versions of various Linux distributions, as well as to the PHP builds provided for Windows since the previous release. All distributors and builders should ensure that this version is used to prevent PHP from being vulnerable. (CVE-2024-2408) - Standard: . Fixed bug GHSA-9fcc-425m-g385 (Bypass of CVE-2024-1874). (CVE-2024-5585) (nielsdos) - XML: . Fixed bug GH-14124 (Segmentation fault with XML extension under certain memory limit). (nielsdos) - XMLReader: . Fixed bug GH-14183 (XMLReader::open() can't be overridden). (nielsdos)

pkgsrc change: Instead of patch configure, patch m4 files and use autoconf to generate configure. PHP 8.2.20 (2024-06-06) - CGI: . Fixed buffer limit on Windows, replacing read call usage by _read. (David Carlier) . Fixed bug GHSA-3qgc-jrrr-25jv (Bypass of CVE-2012-1823, Argument Injection in PHP-CGI). (CVE-2024-4577) (nielsdos) - CLI: . Fixed bug GH-14189 (PHP Interactive shell input state incorrectly handles quoted heredoc literals.). (nielsdos) - Core: . Fixed bug GH-13970 (Incorrect validation of #[Attribute] flags type for non-compile-time expressions). (ilutov) . Fixed bug GH-14140 (Floating point bug in range operation on Apple Silicon hardware). (Derick, Saki) - DOM: . Fix crashes when entity declaration is removed while still having entity references. (nielsdos) . Fix references not handled correctly in C14N. (nielsdos) . Fix crash when calling childNodes next() when iterator is exhausted. (nielsdos) . Fix crash in ParentNode::append() when dealing with a fragment containing text nodes. (nielsdos) - FFI: . Fixed bug GH-14215 (Cannot use FFI::load on CRLF header file with apache2handler). (nielsdos) - Filter: . Fixed bug GHSA-w8qr-v226-r27w (Filter bypass in filter_var FILTER_VALIDATE_URL). (CVE-2024-5458) (nielsdos) - FPM: . Fix bug GH-14175 (Show decimal number instead of scientific notation in systemd status). (Benjamin Cremer) - Hash: . ext/hash: Swap the checking order of `__has_builtin` and `__GNUC__` (Saki Takamachi) - Intl: . Fixed build regression on systems without C++17 compilers. (Calvin Buckley, Peter Kokot) - Ini: . Fixed bug GH-14100 (Corrected spelling mistake in php.ini files). (Marcus Xavier) - MySQLnd: . Fix bug GH-14255 (mysqli_fetch_assoc reports error from nested query). (Kamil Tekiela) - Opcache: . Fixed bug GH-14109 (Fix accidental persisting of internal class constant in shm). (ilutov) - OpenSSL: . The openssl_private_decrypt function in PHP, when using PKCS1 padding (OPENSSL_PKCS1_PADDING, which is the default), is vulnerable to the Marvin Attack unless it is used with an OpenSSL version that includes the changes from this pull request: openssl/openssl#13817 (rsa_pkcs1_implicit_rejection). These changes are part of OpenSSL 3.2 and have also been backported to stable versions of various Linux distributions, as well as to the PHP builds provided for Windows since the previous release. All distributors and builders should ensure that this version is used to prevent PHP from being vulnerable. (CVE-2024-2408) - Standard: . Fixed bug GHSA-9fcc-425m-g385 (Bypass of CVE-2024-1874). (CVE-2024-5585) (nielsdos) - XML: . Fixed bug GH-14124 (Segmentation fault with XML extension under certain memory limit). (nielsdos) - XMLReader: . Fixed bug GH-14183 (XMLReader::open() can't be overridden). (nielsdos)

lang/php83: security fix Revisions pulled up: - lang/php/phpversion.mk 1.434 - lang/php83/Makefile 1.3 - lang/php83/distinfo 1.8 - lang/php83/patches/patch-build_php.m4 1.1 - lang/php83/patches/patch-configure deleted - lang/php83/patches/patch-sapi_apache2handler_config.m4 1.1 --- Module Name: pkgsrc Committed By: taca Date: Fri Jun 7 13:57:24 UTC 2024 Modified Files: pkgsrc/lang/php: phpversion.mk pkgsrc/lang/php83: Makefile distinfo Added Files: pkgsrc/lang/php83/patches: patch-build_php.m4 patch-sapi_apache2handler_config.m4 Removed Files: pkgsrc/lang/php83/patches: patch-configure Log Message: lang/php83: update to 8.3.8 pkgsrc change: Instead of patch configure, patch m4 files and use autoconf to generate configure. PHP 8.3.8 (2024-06-06) - CGI: . Fixed buffer limit on Windows, replacing read call usage by _read. (David Carlier) . Fixed bug GHSA-3qgc-jrrr-25jv (Bypass of CVE-2012-1823, Argument Injection in PHP-CGI). (CVE-2024-4577) (nielsdos) - CLI: . Fixed bug GH-14189 (PHP Interactive shell input state incorrectly handles quoted heredoc literals.). (nielsdos) - Core: . Fixed bug GH-13970 (Incorrect validation of #[Attribute] flags type for non-compile-time expressions). (ilutov) - DOM: . Fix crashes when entity declaration is removed while still having entity references. (nielsdos) . Fix references not handled correctly in C14N. (nielsdos) . Fix crash when calling childNodes next() when iterator is exhausted. (nielsdos) . Fix crash in ParentNode::append() when dealing with a fragment containing text nodes. (nielsdos) - Filter: . Fixed bug GHSA-w8qr-v226-r27w (Filter bypass in filter_var FILTER_VALIDATE_URL). (CVE-2024-5458) (nielsdos) - FPM: . Fix bug GH-14175 (Show decimal number instead of scientific notation in systemd status). (Benjamin Cremer) - Hash: . ext/hash: Swap the checking order of `__has_builtin` and `__GNUC__` (Saki Takamachi) - Intl: . Fixed build regression on systems without C++17 compilers. (Calvin Buckley, Peter Kokot) - MySQLnd: . Fix bug GH-14255 (mysqli_fetch_assoc reports error from nested query). (Kamil Tekiela) - Opcache: . Fixed bug GH-14109 (Fix accidental persisting of internal class constant in shm). (ilutov) - OpenSSL: . The openssl_private_decrypt function in PHP, when using PKCS1 padding (OPENSSL_PKCS1_PADDING, which is the default), is vulnerable to the Marvin Attack unless it is used with an OpenSSL version that includes the changes from this pull request: openssl/openssl#13817 (rsa_pkcs1_implicit_rejection). These changes are part of OpenSSL 3.2 and have also been backported to stable versions of various Linux distributions, as well as to the PHP builds provided for Windows since the previous release. All distributors and builders should ensure that this version is used to prevent PHP from being vulnerable. (CVE-2024-2408) - Standard: . Fixed bug GHSA-9fcc-425m-g385 (Bypass of CVE-2024-1874). (CVE-2024-5585) (nielsdos) - XML: . Fixed bug GH-14124 (Segmentation fault with XML extension under certain memory limit). (nielsdos) - XMLReader: . Fixed bug GH-14183 (XMLReader::open() can't be overridden). (nielsdos) --- Module Name: pkgsrc Committed By: taca Date: Fri Jun 7 23:11:41 UTC 2024 Modified Files: pkgsrc/lang/php81: Makefile Makefile.php pkgsrc/lang/php82: Makefile Makefile.php pkgsrc/lang/php83: Makefile Makefile.php pkgsrc/www/ap-php: Makefile pkgsrc/www/php-fpm: Makefile Log Message: Fix build problem of www/ap-php and www/php-fpm. Switch these packages to use autoconf, too.

lang/php81: security fix Revisions pulled up: - lang/php/phpversion.mk 1.433 - lang/php81/Makefile 1.22-1.23 - lang/php81/Makefile.php 1.2 - lang/php81/distinfo 1.33 - lang/php81/patches/patch-build_php.m4 1.1 - lang/php81/patches/patch-configure deleted - lang/php81/patches/patch-sapi_apache2handler_config.m4 1.1 --- Module Name: pkgsrc Committed By: taca Date: Fri Jun 7 13:54:25 UTC 2024 Modified Files: pkgsrc/lang/php: phpversion.mk pkgsrc/lang/php81: Makefile distinfo Added Files: pkgsrc/lang/php81/patches: patch-build_php.m4 patch-sapi_apache2handler_config.m4 Removed Files: pkgsrc/lang/php81/patches: patch-configure Log Message: lang/php81: update to 8.1.29 pkgsrc change: Instead of patch configure, patch m4 files and use autoconf to generate configure. PHP 8.1.29 (2024-06-06) - CGI: . Fixed bug GHSA-3qgc-jrrr-25jv (Bypass of CVE-2012-1823, Argument Injection in PHP-CGI). (CVE-2024-4577) (nielsdos) - Filter: . Fixed bug GHSA-w8qr-v226-r27w (Filter bypass in filter_var FILTER_VALIDATE_URL). (CVE-2024-5458) (nielsdos) - OpenSSL: . The openssl_private_decrypt function in PHP, when using PKCS1 padding (OPENSSL_PKCS1_PADDING, which is the default), is vulnerable to the Marvin Attack unless it is used with an OpenSSL version that includes the changes from this pull request: openssl/openssl#13817 (rsa_pkcs1_implicit_rejection). These changes are part of OpenSSL 3.2 and have also been backported to stable versions of various Linux distributions, as well as to the PHP builds provided for Windows since the previous release. All distributors and builders should ensure that this version is used to prevent PHP from being vulnerable. (CVE-2024-2408) - Standard: . Fixed bug GHSA-9fcc-425m-g385 (Bypass of CVE-2024-1874). (CVE-2024-5585) (nielsdos) --- Module Name: pkgsrc Committed By: taca Date: Fri Jun 7 23:11:41 UTC 2024 Modified Files: pkgsrc/lang/php81: Makefile Makefile.php pkgsrc/lang/php82: Makefile Makefile.php pkgsrc/lang/php83: Makefile Makefile.php pkgsrc/www/ap-php: Makefile pkgsrc/www/php-fpm: Makefile Log Message: Fix build problem of www/ap-php and www/php-fpm. Switch these packages to use autoconf, too.

lang/php82: security fix Revisions pulled up: - lang/php/phpversion.mk 1.430,1.435 - lang/php82/Makefile 1.9 - lang/php82/distinfo 1.21-1.22 - lang/php82/patches/patch-build_php.m4 1.1 - lang/php82/patches/patch-configure deleted - lang/php82/patches/patch-sapi_apache2handler_config.m4 1.1 --- Module Name: pkgsrc Committed By: taca Date: Fri Jun 7 13:58:44 UTC 2024 Modified Files: pkgsrc/lang/php: phpversion.mk pkgsrc/lang/php82: Makefile distinfo Added Files: pkgsrc/lang/php82/patches: patch-build_php.m4 patch-sapi_apache2handler_config.m4 Removed Files: pkgsrc/lang/php82/patches: patch-configure Log Message: lang/php82: update to 8.2.20 pkgsrc change: Instead of patch configure, patch m4 files and use autoconf to generate configure. PHP 8.2.20 (2024-06-06) - CGI: . Fixed buffer limit on Windows, replacing read call usage by _read. (David Carlier) . Fixed bug GHSA-3qgc-jrrr-25jv (Bypass of CVE-2012-1823, Argument Injection in PHP-CGI). (CVE-2024-4577) (nielsdos) - CLI: . Fixed bug GH-14189 (PHP Interactive shell input state incorrectly handles quoted heredoc literals.). (nielsdos) - Core: . Fixed bug GH-13970 (Incorrect validation of #[Attribute] flags type for non-compile-time expressions). (ilutov) . Fixed bug GH-14140 (Floating point bug in range operation on Apple Silicon hardware). (Derick, Saki) - DOM: . Fix crashes when entity declaration is removed while still having entity references. (nielsdos) . Fix references not handled correctly in C14N. (nielsdos) . Fix crash when calling childNodes next() when iterator is exhausted. (nielsdos) . Fix crash in ParentNode::append() when dealing with a fragment containing text nodes. (nielsdos) - FFI: . Fixed bug GH-14215 (Cannot use FFI::load on CRLF header file with apache2handler). (nielsdos) - Filter: . Fixed bug GHSA-w8qr-v226-r27w (Filter bypass in filter_var FILTER_VALIDATE_URL). (CVE-2024-5458) (nielsdos) - FPM: . Fix bug GH-14175 (Show decimal number instead of scientific notation in systemd status). (Benjamin Cremer) - Hash: . ext/hash: Swap the checking order of `__has_builtin` and `__GNUC__` (Saki Takamachi) - Intl: . Fixed build regression on systems without C++17 compilers. (Calvin Buckley, Peter Kokot) - Ini: . Fixed bug GH-14100 (Corrected spelling mistake in php.ini files). (Marcus Xavier) - MySQLnd: . Fix bug GH-14255 (mysqli_fetch_assoc reports error from nested query). (Kamil Tekiela) - Opcache: . Fixed bug GH-14109 (Fix accidental persisting of internal class constant in shm). (ilutov) - OpenSSL: . The openssl_private_decrypt function in PHP, when using PKCS1 padding (OPENSSL_PKCS1_PADDING, which is the default), is vulnerable to the Marvin Attack unless it is used with an OpenSSL version that includes the changes from this pull request: openssl/openssl#13817 (rsa_pkcs1_implicit_rejection). These changes are part of OpenSSL 3.2 and have also been backported to stable versions of various Linux distributions, as well as to the PHP builds provided for Windows since the previous release. All distributors and builders should ensure that this version is used to prevent PHP from being vulnerable. (CVE-2024-2408) - Standard: . Fixed bug GHSA-9fcc-425m-g385 (Bypass of CVE-2024-1874). (CVE-2024-5585) (nielsdos) - XML: . Fixed bug GH-14124 (Segmentation fault with XML extension under certain memory limit). (nielsdos) - XMLReader: . Fixed bug GH-14183 (XMLReader::open() can't be overridden). (nielsdos) --- Module Name: pkgsrc Committed By: taca Date: Fri Jun 7 23:11:41 UTC 2024 Modified Files: pkgsrc/lang/php81: Makefile Makefile.php pkgsrc/lang/php82: Makefile Makefile.php pkgsrc/lang/php83: Makefile Makefile.php pkgsrc/www/ap-php: Makefile pkgsrc/www/php-fpm: Makefile Log Message: Fix build problem of www/ap-php and www/php-fpm. Switch these packages to use autoconf, too. --- Module Name: pkgsrc Committed By: taca Date: Fri May 10 15:07:21 UTC 2024 Modified Files: pkgsrc/lang/php: phpversion.mk pkgsrc/lang/php82: distinfo pkgsrc/lang/php82/patches: patch-configure Log Message: lang/php82: update to PHP 8.2.19 (2024-05-09) - Core: . Fixed bug GH-13772 (Invalid execute_data->opline pointers in observ= er fcall handlers when JIT is enabled). (Bob) . Fixed bug GH-13931 (Applying zero offset to null pointer in Zend/zend_opcode.c). (nielsdos) . Fixed bug GH-13942 (Align the behavior of zend-max-execution-timers= with other timeout implementations). (K=E9vin Dunglas) . Fixed bug GH-14003 (Broken cleanup of unfinished calls with callabl= e convert parameters). (ilutov) . Fixed bug GH-14013 (Erroneous dnl appended in configure). (Peter Ko= kot) . Fixed bug GH-10232 (If autoloading occurs during constant resolutio= n filename and lineno are identified incorrectly). (ranvis) . Fixed bug GH-13727 (Missing void keyword). (Peter Kokot) - Fibers: . Fixed bug GH-13903 (ASAN false positive underflow when executing co= py()). (nielsdos) - FPM: . Fixed bug GH-13563 (Setting bool values via env in FPM config fails= ). (Jakub Zelenka) - Intl: . Fixed build for icu 74 and onwards. (dunglas) - MySQLnd: . Fix shift out of bounds on 32-bit non-fast-path platforms. (nielsdo= s) - Opcache: . Fixed incorrect assumptions across compilation units for static cal= ls. (ilutov) - OpenSSL: . Fixed bug GH-10495 (feof on OpenSSL stream hangs indefinitely). (Jakub Zelenka) - PDO SQLite: . Fix GH-13984 (Buffer size is now checked before memcmp). (Saki Taka= machi) . Fix GH-13998 (Manage refcount of agg_context->val correctly). (Saki Takamachi) - Phar: . Fixed bug GH-13836 (Renaming a file in a Phar to an already existin= g filename causes a NULL pointer dereference). (nielsdos) . Fixed bug GH-13833 (Applying zero offset to null pointer in zend_ha= sh.c). (nielsdos) . Fix potential NULL pointer dereference before calling EVP_SignInit.= (icy17) - PHPDBG: . Fixed bug GH-13827 (Null pointer access of type 'zval' in phpdbg_fr= ame). (nielsdos) - Posix: . Fix usage of reentrant functions in ext/posix. (Arnaud) - Session: . Fixed bug GH-13856 (Member access within null pointer of type 'ps_f= iles' in ext/session/mod_files.c). (nielsdos) . Fixed bug GH-13891 (memleak and segfault when using ini_set with session.trans_sid_hosts). (nielsdos, kamil-tekiela) . Fixed buffer _read/_write size limit on windows for the file mode. = (David Carlier) - Streams: . Fixed file_get_contents() on Windows fails with "errno=3D22 Invalid= argument". (Damian W=F3jcik) . Fixed bug GH-13264 (Part 1 - Memory leak on stream filter failure).= (Jakub Zelenka) . Fixed bug GH-13860 (Incorrect PHP_STREAM_OPTION_CHECK_LIVENESS case= in ext/openssl/xp_ssl.c - causing use of dead socket). (nielsdos) . Fixed bug GH-11678 (Build fails on musl 1.2.4 - lfs64). (Arnaud) - Treewide: . Fix gcc-14 Wcalloc-transposed-args warnings. (Cristian Rodr=EDguez)= --- Module Name: pkgsrc Committed By: taca Date: Fri Jun 7 23:11:41 UTC 2024 Modified Files: pkgsrc/lang/php81: Makefile Makefile.php pkgsrc/lang/php82: Makefile Makefile.php pkgsrc/lang/php83: Makefile Makefile.php pkgsrc/www/ap-php: Makefile pkgsrc/www/php-fpm: Makefile Log Message: Fix build problem of www/ap-php and www/php-fpm. Switch these packages to use autoconf, too.

mbartosch · 2024-08-07T17:12:53Z

I am currently in the process of debugging a problem that seems to happen in conjunction with this patch.

This came to my attention due to a problem that occurred after upgrading OpenSSL to openssl-1:1.1.1k-12.el8_9.x86_64 on a Rocky Linux 8 system. The same happens on a RedHat RHEL 8 system. According to the RedHat changelogs, this patch has been backported into RedHat's OpenSSL.

Problem description:
When performing an openssl cms -decrypt using an RSA key in a PKCS#11 token, the decryption fails with a hard error:

openssl cms -decrypt -in rocky-ciphertext-softhsm.cms -inform pem -recip softhsm-cert.pem -engine pkcs11 -keyform engine -inkey "pkcs11:model=SoftHSM%20v2;manufacturer=SoftHSM%20project;serial=064c221662be4c79;token=Testtoken;id=%D8%A8%DB%E0%D6%37%1F%BE%DE%C2%B2%08%FF%6F%A2%E3%8C%61%62%D0;object=rsatest1"
engine "pkcs11" set.
Enter PKCS#11 token PIN for Testtoken:
Error decrypting CMS structure
140457840785216:error:06065064:digital envelope routines:EVP_DecryptFinal_ex:bad decrypt:crypto/evp/evp_enc.c:643:

I have verified that the same happens with a Nitrokey HSM2 and an nCipher Edge HSM, so I am pretty sure that the problem is not related to a particular HSM type or PKCS#11 library.

After downgrading RedHat openssl to a previous version that does not include this patch, the above command works without problem.

tomato42 · 2024-08-07T19:50:55Z

@mbartosch this should be filed as a separate issue, preferably with a complete stand-alone reproducer

that being said, use of -recip should be unaffected if the ciphertext matches the key...

PHP 8.1.30 (2024-09-26) - CGI: . Fixed bug GHSA-p99j-rfp4-xqvq (Bypass of CVE-2024-4577, Parameter Injection Vulnerability). (CVE-2024-8926) (nielsdos) . Fixed bug GHSA-94p6-54jq-9mwp (cgi.force_redirect configuration is bypassable due to the environment variable collision). (CVE-2024-8927) (nielsdos) - FPM: . Fixed bug GHSA-865w-9rf3-2wh5 (Logs from childrens may be altered). (CVE-2024-9026) (Jakub Zelenka) - SAPI: . Fixed bug GHSA-9pqp-7h25-4f32 (Erroneous parsing of multipart form data). (CVE-2024-8925) (Arnaud) 06 Jun 2024, PHP 8.1.29 - CGI: . Fixed bug GHSA-3qgc-jrrr-25jv (Bypass of CVE-2012-1823, Argument Injection in PHP-CGI). (CVE-2024-4577) (nielsdos) - Filter: . Fixed bug GHSA-w8qr-v226-r27w (Filter bypass in filter_var FILTER_VALIDATE_URL). (CVE-2024-5458) (nielsdos) - OpenSSL: . The openssl_private_decrypt function in PHP, when using PKCS1 padding (OPENSSL_PKCS1_PADDING, which is the default), is vulnerable to the Marvin Attack unless it is used with an OpenSSL version that includes the changes from this pull request: openssl/openssl#13817 (rsa_pkcs1_implicit_rejection). These changes are part of OpenSSL 3.2 and have also been backported to stable versions of various Linux distributions, as well as to the PHP builds provided for Windows since the previous release. All distributors and builders should ensure that this version is used to prevent PHP from being vulnerable. (CVE-2024-2408) - Standard: . Fixed bug GHSA-9fcc-425m-g385 (Bypass of CVE-2024-1874). (CVE-2024-5585) (nielsdos)

beldmit reviewed Jan 8, 2021

View reviewed changes

crypto/rsa/rsa_ossl.c Outdated Show resolved Hide resolved

crypto/rsa/rsa_ossl.c Outdated Show resolved Hide resolved

crypto/rsa/rsa_pk1.c Outdated Show resolved Hide resolved

tomato42 force-pushed the bleichenbacher-workaround branch from dfc4db8 to fe1cb2c Compare January 8, 2021 20:00

beldmit reviewed Jan 8, 2021

View reviewed changes

crypto/rsa/rsa_ossl.c Show resolved Hide resolved

beldmit reviewed Jan 8, 2021

View reviewed changes

crypto/rsa/rsa_pk1.c Outdated Show resolved Hide resolved

tomato42 force-pushed the bleichenbacher-workaround branch from fe1cb2c to 87dcfa0 Compare January 11, 2021 17:16

beldmit reviewed Jan 11, 2021

View reviewed changes

crypto/rsa/rsa_ossl.c Show resolved Hide resolved

tomato42 force-pushed the bleichenbacher-workaround branch 2 times, most recently from 25f9b41 to 565fc7e Compare January 11, 2021 17:42

beldmit reviewed Jan 11, 2021

View reviewed changes

crypto/rsa/rsa_ossl.c Outdated Show resolved Hide resolved

crypto/rsa/rsa_ossl.c Outdated Show resolved Hide resolved

crypto/rsa/rsa_ossl.c Outdated Show resolved Hide resolved

tomato42 force-pushed the bleichenbacher-workaround branch 2 times, most recently from b04e04f to 5e8c1e7 Compare January 12, 2021 14:46

tomato42 marked this pull request as ready for review January 12, 2021 16:22

tomato42 mentioned this pull request Jan 12, 2021

RSA decryption API is very hard to use safely #13421

Closed

t8m added approval: otc review pending branch: master Merge to master branch labels Jan 12, 2021

t8m reviewed Jan 12, 2021

View reviewed changes

crypto/rsa/rsa_pk1.c Outdated Show resolved Hide resolved

beldmit requested changes Jan 12, 2021

View reviewed changes

crypto/rsa/rsa_ossl.c Outdated Show resolved Hide resolved

crypto/rsa/rsa_pk1.c Show resolved Hide resolved

crypto/rsa/rsa_pk1.c Outdated Show resolved Hide resolved

crypto/rsa/rsa_pk1.c Outdated Show resolved Hide resolved

crypto/rsa/rsa_pk1.c Outdated Show resolved Hide resolved

tomato42 force-pushed the bleichenbacher-workaround branch from 5e8c1e7 to 71a2484 Compare January 13, 2021 14:46

tomato42 force-pushed the bleichenbacher-workaround branch from 71a2484 to 04dc864 Compare January 13, 2021 15:00

t8m reviewed Jan 13, 2021

View reviewed changes

crypto/rsa/rsa_pk1.c Outdated Show resolved Hide resolved

crypto/rsa/rsa_pk1.c Outdated Show resolved Hide resolved

crypto/rsa/rsa_pk1.c Outdated Show resolved Hide resolved

tomato42 force-pushed the bleichenbacher-workaround branch from 04dc864 to 5d1b481 Compare January 13, 2021 15:14

t8m reviewed Jan 13, 2021

View reviewed changes

crypto/rsa/rsa_pk1.c Outdated Show resolved Hide resolved

tomato42 force-pushed the bleichenbacher-workaround branch from 5d1b481 to 843b27b Compare January 13, 2021 15:23

t8m added this to the 3.0.0 beta1 milestone Jan 13, 2021

tomato42 mentioned this pull request Oct 26, 2023

CVE-2020-25659 "fix" confirmed as insufficient pyca/cryptography#9785

Closed

This was referenced Nov 22, 2023

System.Security.Cryptography.Pkcs test Decrypt_512_CekDoesNotDecrypt_FixedValue fails on Fedora 38 dotnet/runtime#95115

Closed

Disable implicit rejection for RSA PKCS#1 v1.5 dotnet/runtime#95157

Merged

beldmit mentioned this pull request Dec 15, 2023

intermittent cms test failure openssl/project#380

Closed

tomato42 mentioned this pull request Jan 29, 2024

@peculiar/webcrypto is vulnerable to the Marvin Attack PeculiarVentures/webcrypto#66

Open

tomato42 mentioned this pull request Apr 5, 2024

rust-openssl is vulnerable to the Marvin Attack sfackler/rust-openssl#2171

Open

qmuntal mentioned this pull request Apr 9, 2024

Set implicit rejection of invalid RSA PKCS#1 v1.5 padding golang-fips/openssl#142

Closed

tomato42 mentioned this pull request Apr 16, 2024

Be more explicit about RSAES-PKCS#1v1.5 error handling #24159

Closed

1 task

TheNorthMemory mentioned this pull request May 10, 2024

不恰当的使用Rsa::decrypt函数(使用OPENSSL_PKCS1_PADDING填充方案)，可能引起应用层存在被攻击的风险 wechatpay-apiv3/wechatpay-php#133

Closed

PawelWMS mentioned this pull request May 24, 2024

openssl: Fix CVE-2023-50782 affecting python-cryptography microsoft/azurelinux#9209

Merged

13 tasks

GrahamCampbell mentioned this pull request Jun 5, 2024

Upgrade PHP to 8.1.29, 8.2.20, 8.3.8 brefphp/aws-lambda-layers#180

Merged

aldok10 mentioned this pull request Jun 10, 2024

update php to 8.1.29 jingjingxyk/swoole-cli#154

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Make RSA decryption API safe to use with PKCS#1 v1.5 padding #13817

Make RSA decryption API safe to use with PKCS#1 v1.5 padding #13817

tomato42 commented Jan 8, 2021 •

edited

Loading

tomato42 commented Jan 8, 2021

beldmit commented Jan 8, 2021

tomato42 commented Jan 11, 2021

beldmit commented Jan 11, 2021

tomato42 commented Jan 13, 2021

t8m commented Jan 13, 2021

junaruga commented Mar 6, 2024 •

edited

Loading

t8m commented Mar 13, 2024

junaruga commented Mar 14, 2024 •

edited

Loading

t8m commented Mar 14, 2024

neverpanic commented Mar 16, 2024

junaruga commented Apr 16, 2024 •

edited

Loading

tomato42 commented Apr 16, 2024 •

edited

Loading

junaruga commented Apr 16, 2024

tomato42 commented Apr 16, 2024

mbartosch commented Aug 7, 2024

tomato42 commented Aug 7, 2024

Make RSA decryption API safe to use with PKCS#1 v1.5 padding #13817

Make RSA decryption API safe to use with PKCS#1 v1.5 padding #13817

Conversation

tomato42 commented Jan 8, 2021 • edited Loading

Checklist

tomato42 commented Jan 8, 2021

beldmit commented Jan 8, 2021

tomato42 commented Jan 11, 2021

beldmit commented Jan 11, 2021

tomato42 commented Jan 13, 2021

t8m commented Jan 13, 2021

junaruga commented Mar 6, 2024 • edited Loading

t8m commented Mar 13, 2024

junaruga commented Mar 14, 2024 • edited Loading

t8m commented Mar 14, 2024

neverpanic commented Mar 16, 2024

junaruga commented Apr 16, 2024 • edited Loading

tomato42 commented Apr 16, 2024 • edited Loading

junaruga commented Apr 16, 2024

tomato42 commented Apr 16, 2024

mbartosch commented Aug 7, 2024

tomato42 commented Aug 7, 2024

tomato42 commented Jan 8, 2021 •

edited

Loading

junaruga commented Mar 6, 2024 •

edited

Loading

junaruga commented Mar 14, 2024 •

edited

Loading

junaruga commented Apr 16, 2024 •

edited

Loading

tomato42 commented Apr 16, 2024 •

edited

Loading