Add CHANGES.md and NEWS.md entries for CVE-2023-6237

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23243)

(cherry picked from commit 38b2508f638787842750aec9a75745e1d8786743)

diff --git a/CHANGES.md b/CHANGES.md
index 61d8963d1a749e8c41476d27a65562f9c66a5e9d..a0830483c7471b585a08776c27b60c88a3ef58c4 100644 (file)
--- a/CHANGES.md
+++ b/CHANGES.md
@@ -24,6 +24,28 @@ OpenSSL 3.1
 
 ### Changes between 3.1.4 and 3.1.5 [xx XXX xxxx]
 
+ * When function EVP_PKEY_public_check() is called on RSA public keys,
+   a computation is done to confirm that the RSA modulus, n, is composite.
+   For valid RSA keys, n is a product of two or more large primes and this
+   computation completes quickly. However, if n is an overly large prime,
+   then this computation would take a long time.
+
+   An application that calls EVP_PKEY_public_check() and supplies an RSA key
+   obtained from an untrusted source could be vulnerable to a Denial of Service
+   attack.
+
+   The function EVP_PKEY_public_check() is not called from other OpenSSL
+   functions however it is called from the OpenSSL pkey command line
+   application. For that reason that application is also vulnerable if used
+   with the "-pubin" and "-check" options on untrusted data.
+
+   To resolve this issue RSA keys larger than OPENSSL_RSA_MAX_MODULUS_BITS will
+   now fail the check immediately with an RSA_R_MODULUS_TOO_LARGE error reason.
+
+   ([CVE-2023-6237])
+
+   *Tomáš Mráz*
+
  * Restore the encoding of SM2 PrivateKeyInfo and SubjectPublicKeyInfo to
    have the contained AlgorithmIdentifier.algorithm set to id-ecPublicKey
    rather than SM2.
@@ -19906,6 +19928,7 @@ ndif
 
 <!-- Links -->
 
+[CVE-2023-6237]: https://www.openssl.org/news/vulnerabilities.html#CVE-2023-6237
 [CVE-2023-6129]: https://www.openssl.org/news/vulnerabilities.html#CVE-2023-6129
 [CVE-2023-5678]: https://www.openssl.org/news/vulnerabilities.html#CVE-2023-5678
 [CVE-2023-5363]: https://www.openssl.org/news/vulnerabilities.html#CVE-2023-5363

diff --git a/NEWS.md b/NEWS.md
index e27105d1b6ed151a8126d64ad40fb6c5e22dd8c6..64e1342ad1dbd5126881e0f0b1c150a651d07f29 100644 (file)
--- a/NEWS.md
+++ b/NEWS.md
@@ -21,7 +21,9 @@ OpenSSL 3.1
 
 ### Major changes between OpenSSL 3.1.4 and OpenSSL 3.1.5 [under development]
 
-  * Fix POLY1305 MAC implementation corrupting vector registers on PowerPC
+  * Fixed Excessive time spent checking invalid RSA public keys
+    ([CVE-2023-6237])
+  * Fixed POLY1305 MAC implementation corrupting vector registers on PowerPC
     CPUs which support PowerISA 2.07
     ([CVE-2023-6129])
   * Fix excessive time spent in DH check / generation with large Q parameter
@@ -1482,6 +1484,7 @@ OpenSSL 0.9.x
 
 <!-- Links -->
 
+[CVE-2023-6237]: https://www.openssl.org/news/vulnerabilities.html#CVE-2023-6237
 [CVE-2023-6129]: https://www.openssl.org/news/vulnerabilities.html#CVE-2023-6129
 [CVE-2023-5678]: https://www.openssl.org/news/vulnerabilities.html#CVE-2023-5678
 [CVE-2023-5363]: https://www.openssl.org/news/vulnerabilities.html#CVE-2023-5363