From nobody Wed Sep 04 23:37:24 2024 X-Original-To: freebsd-security-notifications@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4Wzf6Y0NVRz5Vrnq for ; Wed, 04 Sep 2024 23:37:25 +0000 (UTC) (envelope-from security-advisories@freebsd.org) Received: from freefall.freebsd.org (freefall.freebsd.org [IPv6:2610:1c1:1:6074::16:84]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "freefall.freebsd.org", Issuer "R11" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4Wzf6X5f0Pz43S4; Wed, 4 Sep 2024 23:37:24 +0000 (UTC) (envelope-from security-advisories@freebsd.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1725493044; h=from:from:reply-to:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc; bh=WBP+DwqDy2+AM/34xnxVjlSHebu3ry1kv9fzTmE6S6g=; b=Y/RKNu2irCPHAMLr3W3CKnswSB2Iqh6KhTwBSvfaYjUV8WVBQrxjUTdMM+8dWTwGFT3K37 CdQcY5n+/me2WBGah3LsTbbwwTYSEJwXi0GKeEk50eTnbWbl6Ca3kUH9JwKO4Qh4MfqJB1 a/sgusyypXu5zNuH5n7hf/gC31UYn7czyQnLmhXc7edBMZbJHjnXtPgAx/0HYIkCslY9eR P8BkjzZWnZ8sPC5Cv5kZ/1i6+1RGuvgSDcwfv0SXgotAu6uXOtN23A6sxXYq+P7piNi6UR 0XnXIIX+9+GJ9c6R5s2f2KTqZBADYE96OLng40yKQFb0cn5vS7z4V8q9NVeJWA== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1725493044; a=rsa-sha256; cv=none; b=w58soQiZYJqidA2hgJUEDeQG3xdaGc42aYijZodq2GnMQXIlpRAOW8Sr7/mL3o8MePEWco EBtfRETgJaPLqwSaryjguCt227l3bNVZaOSzWQnJnmzldE7v2+ZqeL4S3pFZMxeDsGfDve Dcf9MJH0kxMhW3hKfGQCpauDDK1kmYfGpRr5CAiu8ieU1f9+2a0rA2/rlVuPSz5ChmEwp8 CHZguhPtveO0OvnkJgAMTW/6h8hef6Lob4YtTGCqstVycP6I7R4pi3dPo9I9jspykyWeTs GRKK6/o582t7rKqByTuGZavqSbnvvOdJlFO+fDVbrjjf06NxhTRjIKktE7p2MQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1725493044; h=from:from:reply-to:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc; bh=WBP+DwqDy2+AM/34xnxVjlSHebu3ry1kv9fzTmE6S6g=; b=a7ymJxi5FBFC290KBCMF4Ca460jsXYwruqsKZe0DN5cA+6Xf7CzFnTh4Zy4DjktwVOGlwM 88OQ+1M28DhNbi1zMekvjxcWJ6zlqMqGwok4t5AmwmuJLjhmdeIUqF/zL92jTosy844HXR Nj1SJo0Q1bC3GCa3NWPAKGe8Dd5W+dXrS7uALiiu4/bFdaxj9YJ+UqpXhcBKc9wxfqqZtU 8z04vgdlw183Dn4v8ywaglgAseLwfI0v8hQr2whRwzGFczPb4QnP4GA9CD4vK0PtK6IQ7Q mMTp8EJkN7DcBnWdWgxadS/BxYDKjobTWiJUa1fwI9i4/O/ZJTGxqNkfb1zd0A== Received: by freefall.freebsd.org (Postfix, from userid 945) id BA2A7271F9; Wed, 04 Sep 2024 23:37:24 +0000 (UTC) From: FreeBSD Security Advisories To: FreeBSD Security Advisories Subject: FreeBSD Security Advisory FreeBSD-SA-24:13.openssl Reply-To: freebsd-security@freebsd.org Precedence: bulk Message-Id: <20240904233724.BA2A7271F9@freefall.freebsd.org> Date: Wed, 04 Sep 2024 23:37:24 +0000 (UTC) List-Id: Moderated Security Notifications [moderated, low volume] List-Archive: https://lists.freebsd.org/archives/freebsd-security-notifications List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: freebsd-security-notifications@freebsd.org Sender: owner-freebsd-security-notifications@FreeBSD.org -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-24:13.openssl Security Advisory The FreeBSD Project Topic: Possible DoS in X.509 name checks in OpenSSL Category: contrib Module: openssl Announced: 2024-09-03 Credits: David Benjamin (Google) Affects: FreeBSD 14.x Corrected: 2024-09-03 17:09:21 UTC (stable/14, 14.1-STABLE) 2024-09-04 21:07:35 UTC (releng/14.1, 14.1-RELEASE-p4) 2024-09-04 20:54:20 UTC (releng/14.0, 14.0-RELEASE-p10) CVE Name: CVE-2024-6119 For general information regarding FreeBSD Security Advisories, including descriptions of the fields above, security branches, and the following sections, please visit . I. Background FreeBSD includes software from the OpenSSL Project. The OpenSSL Project is a collaborative effort to develop a robust, commercial-grade, full-featured Open Source toolkit for the Transport Layer Security (TLS) protocol. It is also a general-purpose cryptography library. II. Problem Description Applications performing certificate name checks (e.g., TLS clients checking server certificates) may attempt to read an invalid memory address when comparing the expected name with an otherName subject alternative name of an X.509 certificate. Basic certificate chain validation is not affected. The issue only occurs when an application also specifies an expected DNS name, Email address or IP address. III. Impact Applications affected by the problem may result in a termination, leading to a denial of service. IV. Workaround No workaround is available. V. Solution Upgrade your vulnerable system to a supported FreeBSD stable or release / security branch (releng) dated after the correction date. Perform one of the following: 1) To update your vulnerable system via a binary patch: Systems running a RELEASE version of FreeBSD on the amd64 or arm64 platforms, or the i386 platform on FreeBSD 13, can be updated via the freebsd-update(8) utility: # freebsd-update fetch # freebsd-update install 2) To update your vulnerable system via a source code patch: The following patches have been verified to apply to the applicable FreeBSD release branches. a) Download the relevant patch from the location below, and verify the detached PGP signature using your PGP utility. # fetch https://security.FreeBSD.org/patches/SA-24:13/openssl.patch # fetch https://security.FreeBSD.org/patches/SA-24:13/openssl.patch.asc # gpg --verify openssl.patch.asc b) Apply the patch. Execute the following commands as root: # cd /usr/src # patch < /path/to/patch c) Recompile the operating system using buildworld and installworld as described in . Restart all daemons that use the library, or reboot the system. VI. Correction details This issue is corrected as of the corresponding Git commit hash in the following stable and release branches: Branch/path Hash Revision - ------------------------------------------------------------------------- stable/14/ 5946b0c6cbc7 stable/14-n268645 releng/14.1/ 9a5a7c90d5e5 releng/14.1-n267703 releng/14.0/ abd3a7939117 releng/14.0-n265440 - ------------------------------------------------------------------------- Run the following command to see which files were modified by a particular commit: # git show --stat Or visit the following URL, replacing NNNNNN with the hash: To determine the commit count in a working tree (for comparison against nNNNNNN in the table above), run: # git rev-list --count --first-parent HEAD VII. References The latest revision of this advisory is available at -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEthUnfoEIffdcgYM7bljekB8AGu8FAmbY55AACgkQbljekB8A Gu/qxQ/9H4Iaao+a5X4aXiV1iU+fT2KSli8fMZKeRw/OOIAztSOHZp7go0noAX65 SVwsb0fShwqAfDpeZhSjzMjpMmfkwQUkRbMK1SD+zLznSmC1McKF/EIAWrMwr78z zDLv497wh26tY+3CUZJQPwkodTvkHnwU0jeUSTjHqC+lOQeOcQ9HwL0T4FsHw4HF BJEX/k6uabpXsQe4H9U8C3MbUlOxiKfwFZAxDBhei2zZN/kfAY63iQhVH6/Ls5BG ei7TcEF2e6ylhdaLcCxpArRrdql1VQ4SanAGVW4MQ/2s3YpxQYweKGMg4VSZvqXt 07mBlNHcLepsHK1/qXhDqO/UMO5QsSsH1trwiohmZRQZJp4wXFsGhc102dezDbun TEJutKpNsojvWQ01IFcykCkvH2AAGXHJTB8H3jVXhBIU6DuqcmjVc8WXbrdN0vX8 KcZgI7S5PyQ0WF+ESqR5MHGXx7Qr9uZPKSMvPq0/g2d+6G52/Yw4oZ3rZtqU34iO uLq+FApa0Ema3jzxhq89c9oybfADpBDmYsAfqfMqexS+nIuPjeUpcv9gCukr2Of3 rJDxx2hF/1c/hd83Pp7MKBT/x/4E3vombPjeNeP/sBLhXFSKiVxUDYGYgm6yw3GA E7rv33ZJ09RaDGp9jbYaV5rOuEWAZpy42X/LsHjI9W3v0sGCJvU= =JDHd -----END PGP SIGNATURE-----