Script 'mail_helper' called by obssrc
Hello community,
here is the log from the commit of package openssl-3 for openSUSE:Factory
checked in at 2022-12-16 17:50:53
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Comparing /work/SRC/openSUSE:Factory/openssl-3 (Old)
and /work/SRC/openSUSE:Factory/.openssl-3.new.1835 (New)
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "openssl-3"
Fri Dec 16 17:50:53 2022 rev:7 rq:1042989 version:3.0.7
Changes:
--------
--- /work/SRC/openSUSE:Factory/openssl-3/openssl-3.changes 2022-11-03
19:13:03.851612254 +0100
+++ /work/SRC/openSUSE:Factory/.openssl-3.new.1835/openssl-3.changes
2022-12-16 17:50:55.459777450 +0100
@@ -1,0 +2,6 @@
+Wed Dec 14 16:38:05 UTC 2022 - Otto Hollmann <otto.hollm...@suse.com>
+
+- Fix X.509 Policy Constraints Double Locking [bsc#1206374, CVE-2022-3996]
+ * Add patch: openssl-3-Fix-double-locking-problem.patch
+
+-------------------------------------------------------------------
New:
----
openssl-3-Fix-double-locking-problem.patch
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Other differences:
------------------
++++++ openssl-3.spec ++++++
--- /var/tmp/diff_new_pack.t6evqL/_old 2022-12-16 17:50:56.027780576 +0100
+++ /var/tmp/diff_new_pack.t6evqL/_new 2022-12-16 17:50:56.035780620 +0100
@@ -48,6 +48,8 @@
# use openssl3.cnf
Patch9: openssl-use-versioned-config.patch
Patch10: fix-config-in-tests.patch
+# PATCH-FIX-UPSTREAM bsc#1206374 CVE-2022-3996 X.509 Policy Constraints Double
Locking
+Patch11: openssl-3-Fix-double-locking-problem.patch
BuildRequires: pkgconfig
BuildRequires: pkgconfig(zlib)
# Add requires for ct_log_list.cnf{,.dist}
++++++ openssl-3-Fix-double-locking-problem.patch ++++++
>From 4d0340a6d2f327700a059f0b8f954d6160f8eef5 Mon Sep 17 00:00:00 2001
From: Pauli <pa...@openssl.org>
Date: Fri, 11 Nov 2022 09:40:19 +1100
Subject: [PATCH] x509: fix double locking problem
This reverts commit 9aa4be691f5c73eb3c68606d824c104550c053f7 and removed the
redundant flag setting.
Fixes #19643
Fixes LOW CVE-2022-3996
Reviewed-by: Dmitry Belyavskiy <beld...@gmail.com>
Reviewed-by: Tomas Mraz <to...@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/19652)
---
crypto/x509/pcy_map.c | 4 ----
1 file changed, 4 deletions(-)
diff --git a/crypto/x509/pcy_map.c b/crypto/x509/pcy_map.c
index 05406c6493f..60dfd1e3203 100644
--- a/crypto/x509/pcy_map.c
+++ b/crypto/x509/pcy_map.c
@@ -73,10 +73,6 @@ int ossl_policy_cache_set_mapping(X509 *x, POLICY_MAPPINGS
*maps)
ret = 1;
bad_mapping:
- if (ret == -1 && CRYPTO_THREAD_write_lock(x->lock)) {
- x->ex_flags |= EXFLAG_INVALID_POLICY;
- CRYPTO_THREAD_unlock(x->lock);
- }
sk_POLICY_MAPPING_pop_free(maps, POLICY_MAPPING_free);
return ret;
