Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

CVE-2023-0464 fix exponential growth of policy tree for 111 #20569

Closed
wants to merge 3 commits into from
Closed

CVE-2023-0464 fix exponential growth of policy tree for 111 #20569

wants to merge 3 commits into from

Conversation

paulidale
Copy link
Contributor

  • documentation is added or updated
  • tests are added or updated

@paulidale
x509: excessive resource use verifying policy constraints
013018c 
A security vulnerability has been identified in all supported versions
of OpenSSL related to the verification of X.509 certificate chains
that include policy constraints.  Attackers may be able to exploit this
vulnerability by creating a malicious certificate chain that triggers
exponential use of computational resources, leading to a denial-of-service
(DoS) attack on affected systems.

Fixes CVE-2023-0464
@paulidale
test: add test cases for the policy resource overuse
4184398 
These trees have pathological properties with respect to building.  The small
tree stays within the imposed limit, the large tree doesn't.

The large tree would consume over 150Gb of RAM to process.
@paulidale
changes: note about policy tree size limits and circumvention
8daca01
@paulidale paulidale self-assigned this Mar 22, 2023
@paulidale paulidale added branch: 1.1.1 Merge to OpenSSL_1_1_1-stable branch approval: ready to merge The 24 hour grace period has passed, ready to merge labels Mar 22, 2023
@paulidale
Copy link
Contributor Author

Approved in security repo, merged.

@paulidale paulidale closed this Mar 22, 2023
openssl-machine pushed a commit that referenced this pull request Mar 22, 2023
@paulidale
x509: excessive resource use verifying policy constraints
879f708 
A security vulnerability has been identified in all supported versions
of OpenSSL related to the verification of X.509 certificate chains
that include policy constraints.  Attackers may be able to exploit this
vulnerability by creating a malicious certificate chain that triggers
exponential use of computational resources, leading to a denial-of-service
(DoS) attack on affected systems.

Fixes CVE-2023-0464

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from #20569)
openssl-machine pushed a commit that referenced this pull request Mar 22, 2023
@paulidale
test: add test cases for the policy resource overuse
b44a67c 
These trees have pathological properties with respect to building.  The small
tree stays within the imposed limit, the large tree doesn't.

The large tree would consume over 150Gb of RAM to process.

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from #20569)
openssl-machine pushed a commit that referenced this pull request Mar 22, 2023
@paulidale
changes: note about policy tree size limits and circumvention
fa425f2 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from #20569)
@paulidale paulidale deleted the policy-tree-111 branch March 22, 2023 00:48
@torben-hansen torben-hansen mentioned this pull request Mar 27, 2023
Merged
torben-hansen added a commit to aws/aws-lc that referenced this pull request Mar 27, 2023
@torben-hansen
Improve x509 policy tree building (#905)
763ee06 
AWS-LC main has a new policy tree data structure that avoids this, see dea64f2. For the current FIPS branch, limit the node count instead. This is an almost-port of openssl/openssl#20569 (see call outs).
andrewhop pushed a commit to andrewhop/aws-lc that referenced this pull request Mar 29, 2023
@torben-hansen @andrewhop
Improve x509 policy tree building (aws#905)
95b76b5 
AWS-LC main has a new policy tree data structure that avoids this, see dea64f2. For the current FIPS branch, limit the node count instead. This is an almost-port of openssl/openssl#20569 (see call outs).
andrewhop pushed a commit to aws/aws-lc that referenced this pull request Mar 29, 2023
@torben-hansen @andrewhop
Improve x509 policy tree building (#905)
68b5f99 
AWS-LC main has a new policy tree data structure that avoids this, see dea64f2. For the current FIPS branch, limit the node count instead. This is an almost-port of openssl/openssl#20569 (see call outs).
laiyoufafa pushed a commit to laiyoufafa/third_party_openssl that referenced this pull request Apr 14, 2023
@paulidale
x509: excessive resource use verifying policy constraints
26994d2 
A security vulnerability has been identified in all supported versions
of OpenSSL related to the verification of X.509 certificate chains
that include policy constraints.  Attackers may be able to exploit this
vulnerability by creating a malicious certificate chain that triggers
exponential use of computational resources, leading to a denial-of-service
(DoS) attack on affected systems.

Fixes CVE-2023-0464

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from openssl/openssl#20569)

Signed-off-by: code4lala <fengziteng2@huawei.com>
laiyoufafa pushed a commit to laiyoufafa/third_party_openssl that referenced this pull request Apr 14, 2023
@paulidale
x509: excessive resource use verifying policy constraints
d16e9c4 
A security vulnerability has been identified in all supported versions
of OpenSSL related to the verification of X.509 certificate chains
that include policy constraints.  Attackers may be able to exploit this
vulnerability by creating a malicious certificate chain that triggers
exponential use of computational resources, leading to a denial-of-service
(DoS) attack on affected systems.

Fixes CVE-2023-0464

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from openssl/openssl#20569)

Signed-off-by: code4lala <fengziteng2@huawei.com>
laiyoufafa pushed a commit to laiyoufafa/third_party_openssl that referenced this pull request Apr 14, 2023
@paulidale
x509: excessive resource use verifying policy constraints
1adfee5 
A security vulnerability has been identified in all supported versions
of OpenSSL related to the verification of X.509 certificate chains
that include policy constraints.  Attackers may be able to exploit this
vulnerability by creating a malicious certificate chain that triggers
exponential use of computational resources, leading to a denial-of-service
(DoS) attack on affected systems.

Fixes CVE-2023-0464

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from openssl/openssl#20569)

Signed-off-by: code4lala <fengziteng2@huawei.com>
@dongbeiouba dongbeiouba mentioned this pull request Apr 23, 2023
Merged
5 tasks
syphyr pushed a commit to syphyr/android_external_boringssl that referenced this pull request Apr 25, 2023
@paulidale @syphyr
x509: excessive resource use verifying policy constraints
071d3a5 
A security vulnerability has been identified in all supported versions
of OpenSSL related to the verification of X.509 certificate chains
that include policy constraints.  Attackers may be able to exploit this
vulnerability by creating a malicious certificate chain that triggers
exponential use of computational resources, leading to a denial-of-service
(DoS) attack on affected systems.

Fixes CVE-2023-0464

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from openssl/openssl#20569)
syphyr pushed a commit to syphyr/android_external_boringssl that referenced this pull request Apr 25, 2023
@paulidale @syphyr
x509: excessive resource use verifying policy constraints
b2b84a9 
A security vulnerability has been identified in all supported versions
of OpenSSL related to the verification of X.509 certificate chains
that include policy constraints.  Attackers may be able to exploit this
vulnerability by creating a malicious certificate chain that triggers
exponential use of computational resources, leading to a denial-of-service
(DoS) attack on affected systems.

Fixes CVE-2023-0464

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from openssl/openssl#20569)
syphyr pushed a commit to syphyr/android_external_boringssl that referenced this pull request Apr 25, 2023
@paulidale @syphyr
x509: excessive resource use verifying policy constraints
cbeb61a 
A security vulnerability has been identified in all supported versions
of OpenSSL related to the verification of X.509 certificate chains
that include policy constraints.  Attackers may be able to exploit this
vulnerability by creating a malicious certificate chain that triggers
exponential use of computational resources, leading to a denial-of-service
(DoS) attack on affected systems.

Fixes CVE-2023-0464

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from openssl/openssl#20569)
syphyr pushed a commit to syphyr/android_external_boringssl that referenced this pull request Apr 25, 2023
@paulidale @syphyr
x509: excessive resource use verifying policy constraints
686cfc2 
A security vulnerability has been identified in all supported versions
of OpenSSL related to the verification of X.509 certificate chains
that include policy constraints.  Attackers may be able to exploit this
vulnerability by creating a malicious certificate chain that triggers
exponential use of computational resources, leading to a denial-of-service
(DoS) attack on affected systems.

Fixes CVE-2023-0464

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from openssl/openssl#20569)
syphyr pushed a commit to syphyr/android_external_boringssl that referenced this pull request Apr 25, 2023
@paulidale @syphyr
x509: excessive resource use verifying policy constraints
f72a6c5 
A security vulnerability has been identified in all supported versions
of OpenSSL related to the verification of X.509 certificate chains
that include policy constraints.  Attackers may be able to exploit this
vulnerability by creating a malicious certificate chain that triggers
exponential use of computational resources, leading to a denial-of-service
(DoS) attack on affected systems.

Fixes CVE-2023-0464

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from openssl/openssl#20569)
bernd-edlinger pushed a commit to bernd-edlinger/openssl that referenced this pull request May 25, 2023
@paulidale @bernd-edlinger
x509: excessive resource use verifying policy constraints
2521933 
A security vulnerability has been identified in all supported versions
of OpenSSL related to the verification of X.509 certificate chains
that include policy constraints.  Attackers may be able to exploit this
vulnerability by creating a malicious certificate chain that triggers
exponential use of computational resources, leading to a denial-of-service
(DoS) attack on affected systems.

Fixes CVE-2023-0464

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from openssl#20569)

(cherry picked from commit 879f708)
bernd-edlinger pushed a commit to bernd-edlinger/openssl that referenced this pull request May 25, 2023
@paulidale @bernd-edlinger
test: add test cases for the policy resource overuse
b52b9d9 
These trees have pathological properties with respect to building.  The small
tree stays within the imposed limit, the large tree doesn't.

The large tree would consume over 150Gb of RAM to process.

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from openssl#20569)

(cherry picked from commit b44a67c)
bernd-edlinger pushed a commit to bernd-edlinger/openssl that referenced this pull request May 25, 2023
@paulidale @bernd-edlinger
x509: excessive resource use verifying policy constraints
5b9a3a4 
A security vulnerability has been identified in all supported versions
of OpenSSL related to the verification of X.509 certificate chains
that include policy constraints.  Attackers may be able to exploit this
vulnerability by creating a malicious certificate chain that triggers
exponential use of computational resources, leading to a denial-of-service
(DoS) attack on affected systems.

Fixes CVE-2023-0464

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from openssl#20569)

(cherry picked from commit 879f708)
bernd-edlinger pushed a commit to bernd-edlinger/openssl that referenced this pull request May 25, 2023
@paulidale @bernd-edlinger
changes: note about policy tree size limits and circumvention
e64032b 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from openssl#20569)

(cherry picked from commit fa425f2)
bernd-edlinger pushed a commit to bernd-edlinger/openssl that referenced this pull request May 25, 2023
@paulidale @bernd-edlinger
changes: note about policy tree size limits and circumvention
bab9ac6 
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from openssl#20569)

(cherry picked from commit fa425f2)
raspbian-autopush pushed a commit to raspbian-packages/openssl that referenced this pull request Jun 1, 2023
@paulidale @sebastianas
x509: excessive resource use verifying policy constraints
77afc5b 
A security vulnerability has been identified in all supported versions
of OpenSSL related to the verification of X.509 certificate chains
that include policy constraints.  Attackers may be able to exploit this
vulnerability by creating a malicious certificate chain that triggers
exponential use of computational resources, leading to a denial-of-service
(DoS) attack on affected systems.

Fixes CVE-2023-0464

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from openssl/openssl#20569)

Gbp-Pq: Name x509-excessive-resource-use-verifying-policy-constraints.patch
raspbian-autopush pushed a commit to raspbian-packages/openssl that referenced this pull request Jul 27, 2023
@paulidale
x509: excessive resource use verifying policy constraints
6bcb4f8 
A security vulnerability has been identified in all supported versions
of OpenSSL related to the verification of X.509 certificate chains
that include policy constraints.  Attackers may be able to exploit this
vulnerability by creating a malicious certificate chain that triggers
exponential use of computational resources, leading to a denial-of-service
(DoS) attack on affected systems.

Fixes CVE-2023-0464

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from openssl/openssl#20569)

Gbp-Pq: Name x509-excessive-resource-use-verifying-policy-constraints.patch
raspbian-autopush pushed a commit to raspbian-packages/openssl that referenced this pull request Sep 14, 2023
@paulidale @gladk
x509: excessive resource use verifying policy constraints
2cad4a7 
A security vulnerability has been identified in all supported versions
of OpenSSL related to the verification of X.509 certificate chains
that include policy constraints.  Attackers may be able to exploit this
vulnerability by creating a malicious certificate chain that triggers
exponential use of computational resources, leading to a denial-of-service
(DoS) attack on affected systems.

Fixes CVE-2023-0464

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from openssl/openssl#20569)

Gbp-Pq: Name x509-excessive-resource-use-verifying-policy-constraints.patch
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees

@paulidale paulidale

Labels
approval: ready to merge The 24 hour grace period has passed, ready to merge branch: 1.1.1 Merge to OpenSSL_1_1_1-stable branch
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
1 participant
@paulidale