From nobody Wed Sep 04 23:37:24 2024 X-Original-To: freebsd-security@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4Wzf6Y0Kdqz5VrjH for ; Wed, 04 Sep 2024 23:37:25 +0000 (UTC) (envelope-from security-advisories@freebsd.org) Received: from freefall.freebsd.org (freefall.freebsd.org [IPv6:2610:1c1:1:6074::16:84]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "freefall.freebsd.org", Issuer "R11" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4Wzf6X5X5Bz43hx; Wed, 4 Sep 2024 23:37:24 +0000 (UTC) (envelope-from security-advisories@freebsd.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1725493044; h=from:from:reply-to:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc; bh=WBP+DwqDy2+AM/34xnxVjlSHebu3ry1kv9fzTmE6S6g=; b=Gy7Abu2Rhpkb2E0D7BuiUAhNdW0Gc6/DEZnSG8NDEJA9xvzvY1ec7T6IaaGnIkZZ1D8L3K mEt3jkeZ5nMDdGQAjGhHIa1vfIanJFKgisPTHvHXLHL2P0/U5/30wzwnUeTSvB7QSOzHL5 7fErzSfJarxTf/jdGHFE6YlYshPA/RVkA9g8r0ult0qXhmKLw0iplkNVqBfydoI0jgV2in tOUftq9izXt6AYlg4rliD29YfNUFbN4vG4bnZGIavRHgZkeBEM+nI6LGiqh5p3Da+N5dtb JVhVYTwW0VYzEZyy+x7qBMF87qQ3Uv/SPMH+M3LIDuNP2NsQNS0VwfwjOAeq4w== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1725493044; a=rsa-sha256; cv=none; b=f5LrauEoyKJ4ybyKnausKfx0LbLBQDyNEo0DgItybP2boluJmmfomogNYNnUABUH0iPfgS 6CMT1/PNsMMPV5oIGxdUvSrJ0sffQ0wINP1ed4k/wR/Uw9Hq3+D080pr9Ivk5ZVvRKsgaZ uFTUhLDpxYwpR3b9aZIcBzLuXds538i89agRnxjK3lBvm/JHyyXejQX9K43Dau4sI7nCd9 757T09OvyPzeHF9PTImBUuodSzQh63r6FXAW1fezwa0cX/1M9WypXWC2BGiNVIiro74YY3 rr9JfZsC1QV2OvfvpG6Rnbiog2vd46Ne2j8bxdQdWfv8466sZt8+9ecOtzn8+A== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1725493044; h=from:from:reply-to:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc; bh=WBP+DwqDy2+AM/34xnxVjlSHebu3ry1kv9fzTmE6S6g=; b=wVxHCUcujf7WkhEdTTS9+GqN2T86YCQ91HNbbp4aOA7/jaNAttn9ieEomOqWD9KvdqjmC2 YMuPI6CbMgouvPbnw4K41Wn7ytIIqjAcqZlc1fBMzwt1wGF2bDugTEN7M0gunBtfaIuSz6 YX6hjw0OGnau521TIwaqu7xmZdt1lLGYmXJmK8jSBwXp0pjOBeGX7pygMTMuesklVKVPAy fHbgf8lSdYR++Xk6ZZgUQwcIzJU3e6iRHcucCwER70wNvjPclzFf920jyAwnDgNBJLBWGB v+eBaIB2T1HAlrtLXG9b9Wp/HB4u2Qq21EFyVTug0NAExG0eibbKmHiXQBbsdg== Received: by freefall.freebsd.org (Postfix, from userid 945) id B62BF2724C; Wed, 04 Sep 2024 23:37:24 +0000 (UTC) From: FreeBSD Security Advisories To: FreeBSD Security Advisories Subject: FreeBSD Security Advisory FreeBSD-SA-24:13.openssl Reply-To: freebsd-security@freebsd.org Precedence: bulk Message-Id: <20240904233724.B62BF2724C@freefall.freebsd.org> Date: Wed, 04 Sep 2024 23:37:24 +0000 (UTC) List-Id: Security issues List-Archive: https://lists.freebsd.org/archives/freebsd-security List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: freebsd-security@freebsd.org Sender: owner-freebsd-security@FreeBSD.org -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-24:13.openssl Security Advisory The FreeBSD Project Topic: Possible DoS in X.509 name checks in OpenSSL Category: contrib Module: openssl Announced: 2024-09-03 Credits: David Benjamin (Google) Affects: FreeBSD 14.x Corrected: 2024-09-03 17:09:21 UTC (stable/14, 14.1-STABLE) 2024-09-04 21:07:35 UTC (releng/14.1, 14.1-RELEASE-p4) 2024-09-04 20:54:20 UTC (releng/14.0, 14.0-RELEASE-p10) CVE Name: CVE-2024-6119 For general information regarding FreeBSD Security Advisories, including descriptions of the fields above, security branches, and the following sections, please visit . I. Background FreeBSD includes software from the OpenSSL Project. The OpenSSL Project is a collaborative effort to develop a robust, commercial-grade, full-featured Open Source toolkit for the Transport Layer Security (TLS) protocol. It is also a general-purpose cryptography library. II. Problem Description Applications performing certificate name checks (e.g., TLS clients checking server certificates) may attempt to read an invalid memory address when comparing the expected name with an otherName subject alternative name of an X.509 certificate. Basic certificate chain validation is not affected. The issue only occurs when an application also specifies an expected DNS name, Email address or IP address. III. Impact Applications affected by the problem may result in a termination, leading to a denial of service. IV. Workaround No workaround is available. V. Solution Upgrade your vulnerable system to a supported FreeBSD stable or release / security branch (releng) dated after the correction date. Perform one of the following: 1) To update your vulnerable system via a binary patch: Systems running a RELEASE version of FreeBSD on the amd64 or arm64 platforms, or the i386 platform on FreeBSD 13, can be updated via the freebsd-update(8) utility: # freebsd-update fetch # freebsd-update install 2) To update your vulnerable system via a source code patch: The following patches have been verified to apply to the applicable FreeBSD release branches. a) Download the relevant patch from the location below, and verify the detached PGP signature using your PGP utility. # fetch https://security.FreeBSD.org/patches/SA-24:13/openssl.patch # fetch https://security.FreeBSD.org/patches/SA-24:13/openssl.patch.asc # gpg --verify openssl.patch.asc b) Apply the patch. Execute the following commands as root: # cd /usr/src # patch < /path/to/patch c) Recompile the operating system using buildworld and installworld as described in . Restart all daemons that use the library, or reboot the system. VI. Correction details This issue is corrected as of the corresponding Git commit hash in the following stable and release branches: Branch/path Hash Revision - ------------------------------------------------------------------------- stable/14/ 5946b0c6cbc7 stable/14-n268645 releng/14.1/ 9a5a7c90d5e5 releng/14.1-n267703 releng/14.0/ abd3a7939117 releng/14.0-n265440 - ------------------------------------------------------------------------- Run the following command to see which files were modified by a particular commit: # git show --stat Or visit the following URL, replacing NNNNNN with the hash: To determine the commit count in a working tree (for comparison against nNNNNNN in the table above), run: # git rev-list --count --first-parent HEAD VII. References The latest revision of this advisory is available at -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEthUnfoEIffdcgYM7bljekB8AGu8FAmbY55AACgkQbljekB8A Gu/qxQ/9H4Iaao+a5X4aXiV1iU+fT2KSli8fMZKeRw/OOIAztSOHZp7go0noAX65 SVwsb0fShwqAfDpeZhSjzMjpMmfkwQUkRbMK1SD+zLznSmC1McKF/EIAWrMwr78z zDLv497wh26tY+3CUZJQPwkodTvkHnwU0jeUSTjHqC+lOQeOcQ9HwL0T4FsHw4HF BJEX/k6uabpXsQe4H9U8C3MbUlOxiKfwFZAxDBhei2zZN/kfAY63iQhVH6/Ls5BG ei7TcEF2e6ylhdaLcCxpArRrdql1VQ4SanAGVW4MQ/2s3YpxQYweKGMg4VSZvqXt 07mBlNHcLepsHK1/qXhDqO/UMO5QsSsH1trwiohmZRQZJp4wXFsGhc102dezDbun TEJutKpNsojvWQ01IFcykCkvH2AAGXHJTB8H3jVXhBIU6DuqcmjVc8WXbrdN0vX8 KcZgI7S5PyQ0WF+ESqR5MHGXx7Qr9uZPKSMvPq0/g2d+6G52/Yw4oZ3rZtqU34iO uLq+FApa0Ema3jzxhq89c9oybfADpBDmYsAfqfMqexS+nIuPjeUpcv9gCukr2Of3 rJDxx2hF/1c/hd83Pp7MKBT/x/4E3vombPjeNeP/sBLhXFSKiVxUDYGYgm6yw3GA E7rv33ZJ09RaDGp9jbYaV5rOuEWAZpy42X/LsHjI9W3v0sGCJvU= =JDHd -----END PGP SIGNATURE-----