rpms/openssl
8
1
Fork 1
Code Issues Pull Requests Releases Activity

Prevent use of SHA1 with ECDSA

Browse Source 
providers/implementations/signature/{ec,}dsa_sig.c accept a NID_undef
digest, so to prevent SHA1 from working with ECDSA and DSA, we must
return a negative value in securitycheck.c.

Resolves: rhbz#2031742
This commit is contained in:
Clemens Lang 2022-02-25 14:36:41 +01:00
parent ea9f0a5726
commit ede38fcb54
2 changed files with 7 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
0049-Selectively-disallow-SHA1-signatures.patch
View File

@ -260,7 +260,7 @@ index fd7f7e3331..05464b0655 100644
+ int loadconfig); + int loadconfig);
#endif #endif
diff --git a/providers/common/securitycheck.c b/providers/common/securitycheck.c diff --git a/providers/common/securitycheck.c b/providers/common/securitycheck.c
index 699ada7c52..f3af62325d 100644 index 699ada7c52..e534ad0a5f 100644
--- a/providers/common/securitycheck.c --- a/providers/common/securitycheck.c
+++ b/providers/common/securitycheck.c +++ b/providers/common/securitycheck.c
@@ -19,6 +19,7 @@ @@ -19,6 +19,7 @@
@ -281,7 +281,7 @@ index 699ada7c52..f3af62325d 100644
+ /* SHA1 is globally disabled, check whether we want to locally allow + /* SHA1 is globally disabled, check whether we want to locally allow
+ * it. */ + * it. */
+ if (mdnid == NID_sha1 && !sha1_allowed) + if (mdnid == NID_sha1 && !sha1_allowed)
+ mdnid = NID_undef; + mdnid = -1;
+#endif +#endif
+ +
return mdnid; return mdnid;

6
openssl.spec
View File

@ -15,7 +15,7 @@
Summary: Utilities from the general purpose cryptography library with TLS implementation Summary: Utilities from the general purpose cryptography library with TLS implementation
Name: openssl Name: openssl
Version: 3.0.1 Version: 3.0.1
Release: 13%{?dist} Release: 14%{?dist}
Epoch: 1 Epoch: 1
# We have to remove certain patented algorithms from the openssl source # We have to remove certain patented algorithms from the openssl source
# tarball with the hobble-openssl script which is included below. # tarball with the hobble-openssl script which is included below.
@ -412,6 +412,10 @@ install -m644 %{SOURCE9} \
%ldconfig_scriptlets libs %ldconfig_scriptlets libs
%changelog %changelog
* Fri Feb 25 2022 Clemens Lang <cllang@redhat.com> - 1:3.0.1-14
- Prevent use of SHA1 with ECDSA
- Resolves: rhbz#2031742
* Fri Feb 25 2022 Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:3.0.1-13 * Fri Feb 25 2022 Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:3.0.1-13
- OpenSSL will generate keys with prime192v1 curve if it is provided using explicit parameters - OpenSSL will generate keys with prime192v1 curve if it is provided using explicit parameters
- Resolves: rhbz#1977867 - Resolves: rhbz#1977867