external/openssl/0001-x509-fix-double-locking-problem.patch.1 | 39 ++++++++++ external/openssl/UnpackedTarball_openssl.mk | 1 2 files changed, 40 insertions(+)
New commits: commit f41966222f05ab327550dc7a5cf9ad40052124b3 Author: Taichi Haradaguchi <[email protected]> AuthorDate: Sat Dec 24 16:34:15 2022 +0900 Commit: Caolán McNamara <[email protected]> CommitDate: Fri Jan 6 20:42:54 2023 +0000 openssl3: add patch for CVE-2022-3996 Severity: Low backport <https://github.com/openssl/openssl/commit/7725e7bfe6f2ce8146b6552b44e0d226be7638e7>. OpenSSL 1.1.1 series are not affected by this vulnerability. Security Advisary: https://www.openssl.org/news/secadv/20221213.txt Change-Id: I42caba9c51291445fa96fc6f2280c681d6d6e582 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/144791 Tested-by: Jenkins Reviewed-by: Caolán McNamara <[email protected]> diff --git a/external/openssl/0001-x509-fix-double-locking-problem.patch.1 b/external/openssl/0001-x509-fix-double-locking-problem.patch.1 new file mode 100644 index 000000000000..ec289215e1a5 --- /dev/null +++ b/external/openssl/0001-x509-fix-double-locking-problem.patch.1 @@ -0,0 +1,39 @@ +From 7725e7bfe6f2ce8146b6552b44e0d226be7638e7 Mon Sep 17 00:00:00 2001 +From: Pauli <[email protected]> +Date: Fri, 11 Nov 2022 09:40:19 +1100 +Subject: [PATCH] x509: fix double locking problem + +This reverts commit 9aa4be691f5c73eb3c68606d824c104550c053f7 and removed the +redundant flag setting. + +Fixes #19643 + +Fixes LOW CVE-2022-3996 + +Reviewed-by: Dmitry Belyavskiy <[email protected]> +Reviewed-by: Tomas Mraz <[email protected]> +(Merged from https://github.com/openssl/openssl/pull/19652) + +(cherry picked from commit 4d0340a6d2f327700a059f0b8f954d6160f8eef5) +--- + crypto/x509/pcy_map.c | 4 ---- + 1 file changed, 4 deletions(-) + +diff --git a/crypto/x509/pcy_map.c b/crypto/x509/pcy_map.c +index 05406c6493..60dfd1e320 100644 +--- a/crypto/x509/pcy_map.c ++++ b/crypto/x509/pcy_map.c +@@ -73,10 +73,6 @@ int ossl_policy_cache_set_mapping(X509 *x, POLICY_MAPPINGS *maps) + + ret = 1; + bad_mapping: +- if (ret == -1 && CRYPTO_THREAD_write_lock(x->lock)) { +- x->ex_flags |= EXFLAG_INVALID_POLICY; +- CRYPTO_THREAD_unlock(x->lock); +- } + sk_POLICY_MAPPING_pop_free(maps, POLICY_MAPPING_free); + return ret; + +-- +2.39.0 + diff --git a/external/openssl/UnpackedTarball_openssl.mk b/external/openssl/UnpackedTarball_openssl.mk index 2a8f3bb3f905..7ee91bb43425 100644 --- a/external/openssl/UnpackedTarball_openssl.mk +++ b/external/openssl/UnpackedTarball_openssl.mk @@ -12,6 +12,7 @@ $(eval $(call gb_UnpackedTarball_UnpackedTarball,openssl)) $(eval $(call gb_UnpackedTarball_set_tarball,openssl,$(OPENSSL_TARBALL),,openssl)) $(eval $(call gb_UnpackedTarball_add_patches,openssl,\ + external/openssl/0001-x509-fix-double-locking-problem.patch.1 \ external/openssl/openssl-no-multilib.patch.0 \ external/openssl/configurable-z-option.patch.0 \ external/openssl/openssl-no-ipc-cmd.patch.0 \
