Skip to content

Commit a8e0d5d

Browse files
DanRod1999DanRod1999
authored
Merge branch 'release/4.11.x' into mergify/bp/release/4.11.x/pr-1031
2 parents 850f3f5 + 46934dd commit a8e0d5d

100 files changed

Lines changed: 840 additions & 586 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎iModelCore/libsrc/openssl/.gitignore‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,3 +3,8 @@ vendor/doc
33
vendor/fuzz
44
vendor/test
55
vendor/VMS
6+
vendor/oqs-provider
7+
vendor/python-ecdsa
8+
vendor/tlsfuzzer
9+
vendor/tlslite-ng
10+
vendor/wycheproof

‎iModelCore/libsrc/openssl/BentleyVersionString.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,6 @@
1111
// This supposedly originated in a 'VersionSegment.h' file, but I don't see it...
1212
#pragma const_seg("BSIVer")
1313
#pragma const_seg()
14-
static __declspec (allocate("BSIVer")) char szSourceFileVersionString[] = "#@!~BeOpenSSL 3.1.7; OpenSSL 3.1.7, 3.1.7~!@#";
14+
static __declspec (allocate("BSIVer")) char szSourceFileVersionString[] = "#@!~BeOpenSSL 3.1.8; OpenSSL 3.1.8, 3.1.8~!@#";
1515

1616
#endif

‎iModelCore/libsrc/openssl/vendor/CHANGES.md‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,37 @@ OpenSSL Releases
2222
OpenSSL 3.1
2323
-----------
2424

25+
### Changes between 3.1.7 and 3.1.8 [11 Feb 2025]
26+
27+
* Fixed timing side-channel in ECDSA signature computation.
28+
29+
There is a timing signal of around 300 nanoseconds when the top word of
30+
the inverted ECDSA nonce value is zero. This can happen with significant
31+
probability only for some of the supported elliptic curves. In particular
32+
the NIST P-521 curve is affected. To be able to measure this leak, the
33+
attacker process must either be located in the same physical computer or
34+
must have a very fast network connection with low latency.
35+
36+
([CVE-2024-13176])
37+
38+
*Tomáš Mráz*
39+
40+
* Fixed possible OOB memory access with invalid low-level GF(2^m) elliptic
41+
curve parameters.
42+
43+
Use of the low-level GF(2^m) elliptic curve APIs with untrusted
44+
explicit values for the field polynomial can lead to out-of-bounds memory
45+
reads or writes.
46+
Applications working with "exotic" explicit binary (GF(2^m)) curve
47+
parameters, that make it possible to represent invalid field polynomials
48+
with a zero constant term, via the above or similar APIs, may terminate
49+
abruptly as a result of reading or writing outside of array bounds. Remote
50+
code execution cannot easily be ruled out.
51+
52+
([CVE-2024-9143])
53+
54+
*Viktor Dukhovni*
55+
2556
### Changes between 3.1.6 and 3.1.7 [3 Sep 2024]
2657

2758
* Fixed possible denial of service in X.509 name checks.
@@ -20046,6 +20077,8 @@ ndif
2004620077

2004720078
<!-- Links -->
2004820079

20080+
[CVE-2024-13176]: https://www.openssl.org/news/vulnerabilities.html#CVE-2024-13176
20081+
[CVE-2024-9143]: https://www.openssl.org/news/vulnerabilities.html#CVE-2024-9143
2004920082
[CVE-2024-6119]: https://www.openssl.org/news/vulnerabilities.html#CVE-2024-6119
2005020083
[CVE-2024-5535]: https://www.openssl.org/news/vulnerabilities.html#CVE-2024-5535
2005120084
[CVE-2024-4741]: https://www.openssl.org/news/vulnerabilities.html#CVE-2024-4741

‎iModelCore/libsrc/openssl/vendor/Configurations/50-win-clang-cl.conf‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ my %targets = (
1111
multilib => "-arm64",
1212
asm_arch => "aarch64",
1313
AS => "clang-cl.exe",
14-
ASFLAGS => "/nologo /Zi",
14+
ASFLAGS => "/nologo /Zi --target=arm64-pc-windows-msvc",
1515
asflags => "/c",
1616
asoutflag => "/Fo",
1717
perlasm_scheme => "win64",
@@ -25,8 +25,9 @@ my %targets = (
2525
bn_ops => "SIXTY_FOUR_BIT RC4_CHAR",
2626
multilib => "-arm64",
2727
asm_arch => "aarch64",
28+
CFLAGS => add("--target=arm64-pc-windows-msvc"),
2829
AS => "clang-cl.exe",
29-
ASFLAGS => "/nologo /Zi",
30+
ASFLAGS => "/nologo /Zi --target=arm64-pc-windows-msvc",
3031
asflags => "/c",
3132
asoutflag => "/Fo",
3233
perlasm_scheme => "win64",

‎iModelCore/libsrc/openssl/vendor/Configurations/unix-Makefile.tmpl‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1688,7 +1688,7 @@ EOF
16881688
} elsif ($makedep_scheme eq 'gcc' && !grep /\.rc$/, @srcs) {
16891689
$recipe .= <<"EOF";
16901690
$obj: $deps
1691-
$cmd $incs $defs $cmdflags -MMD -MF $dep.tmp -MT \$\@ -c -o \$\@ $srcs
1691+
$cmd $incs $defs $cmdflags -MMD -MF $dep.tmp -c -o \$\@ $srcs
16921692
\@touch $dep.tmp
16931693
\@if cmp $dep.tmp $dep > /dev/null 2> /dev/null; then \\
16941694
rm -f $dep.tmp; \\

‎iModelCore/libsrc/openssl/vendor/NEWS.md‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,20 @@ OpenSSL Releases
1919
OpenSSL 3.1
2020
-----------
2121

22+
### Major changes between OpenSSL 3.1.7 and OpenSSL 3.1.8 [11 Feb 2025]
23+
24+
OpenSSL 3.1.8 is a security patch release. The most severe CVE fixed in this
25+
release is Low.
26+
27+
This release incorporates the following bug fixes and mitigations:
28+
29+
* Fixed timing side-channel in ECDSA signature computation.
30+
([CVE-2024-13176])
31+
32+
* Fixed possible OOB memory access with invalid low-level GF(2^m) elliptic
33+
curve parameters.
34+
([CVE-2024-9143])
35+
2236
### Major changes between OpenSSL 3.1.6 and OpenSSL 3.1.7 [3 Sep 2024]
2337

2438
OpenSSL 3.1.7 is a security patch release. The most severe CVE fixed in this
@@ -1511,6 +1525,8 @@ OpenSSL 0.9.x
15111525

15121526
<!-- Links -->
15131527

1528+
[CVE-2024-13176]: https://www.openssl.org/news/vulnerabilities.html#CVE-2024-13176
1529+
[CVE-2024-9143]: https://www.openssl.org/news/vulnerabilities.html#CVE-2024-9143
15141530
[CVE-2024-6119]: https://www.openssl.org/news/vulnerabilities.html#CVE-2024-6119
15151531
[CVE-2024-5535]: https://www.openssl.org/news/vulnerabilities.html#CVE-2024-5535
15161532
[CVE-2024-4741]: https://www.openssl.org/news/vulnerabilities.html#CVE-2024-4741

‎iModelCore/libsrc/openssl/vendor/NOTES-NONSTOP.md‎

Lines changed: 2 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -119,12 +119,9 @@ correctly, you also need the `COMP_ROOT` set, as in:
119119

120120
`COMP_ROOT` needs to be in Windows form.
121121

122-
`Configure` must specify the `no-makedepend` option otherwise errors will
123-
result when running the build because the c99 cross-compiler does not support
124-
the `gcc -MT` option. An example of a `Configure` command to be run from the
125-
OpenSSL directory is:
122+
An example of a `Configure` command to be run from the OpenSSL directory is:
126123

127-
./Configure nonstop-nsx_64 no-makedepend --with-rand-seed=rdcpu
124+
./Configure nonstop-nsx_64 --with-rand-seed=rdcpu
128125

129126
Do not forget to include any OpenSSL cross-compiling prefix and certificate
130127
options when creating your libraries.

‎iModelCore/libsrc/openssl/vendor/README.md‎

Lines changed: 8 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -59,7 +59,7 @@ For Production Use
5959
------------------
6060

6161
Source code tarballs of the official releases can be downloaded from
62-
[www.openssl.org/source](https://www.openssl.org/source).
62+
[openssl-library.org/source/](https://openssl-library.org/source/).
6363
The OpenSSL project does not distribute the toolkit in binary form.
6464

6565
However, for a large variety of operating systems precompiled versions
@@ -75,22 +75,18 @@ the source tarballs, having a local copy of the git repository with
7575
the entire project history gives you much more insight into the
7676
code base.
7777

78-
The official OpenSSL Git Repository is located at [git.openssl.org].
79-
There is a GitHub mirror of the repository at [github.com/openssl/openssl],
78+
The main OpenSSL Git repository is private.
79+
There is a public GitHub mirror of it at [github.com/openssl/openssl],
8080
which is updated automatically from the former on every commit.
8181

82-
A local copy of the Git Repository can be obtained by cloning it from
83-
the original OpenSSL repository using
84-
85-
git clone git://git.openssl.org/openssl.git
86-
87-
or from the GitHub mirror using
82+
A local copy of the Git repository can be obtained by cloning it from
83+
the GitHub mirror using
8884

8985
git clone https://github.com/openssl/openssl.git
9086

9187
If you intend to contribute to OpenSSL, either to fix bugs or contribute
92-
new features, you need to fork the OpenSSL repository openssl/openssl on
93-
GitHub and clone your public fork instead.
88+
new features, you need to fork the GitHub mirror and clone your public fork
89+
instead.
9490

9591
git clone https://github.com/yourname/openssl.git
9692

@@ -166,7 +162,7 @@ attempting to develop or distribute cryptographic code.
166162
Copyright
167163
=========
168164

169-
Copyright (c) 1998-2024 The OpenSSL Project
165+
Copyright (c) 1998-2025 The OpenSSL Project
170166

171167
Copyright (c) 1995-1998 Eric A. Young, Tim J. Hudson
172168

@@ -178,14 +174,6 @@ All rights reserved.
178174
<https://www.openssl.org>
179175
"OpenSSL Homepage"
180176

181-
[git.openssl.org]:
182-
<https://git.openssl.org>
183-
"OpenSSL Git Repository"
184-
185-
[git.openssl.org]:
186-
<https://git.openssl.org>
187-
"OpenSSL Git Repository"
188-
189177
[github.com/openssl/openssl]:
190178
<https://github.com/openssl/openssl>
191179
"OpenSSL GitHub Mirror"

‎iModelCore/libsrc/openssl/vendor/VERSION.dat‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
MAJOR=3
22
MINOR=1
3-
PATCH=7
3+
PATCH=8
44
PRE_RELEASE_TAG=
55
BUILD_METADATA=
6-
RELEASE_DATE="3 Sep 2024"
6+
RELEASE_DATE="11 Feb 2025"
77
SHLIB_VERSION=3

‎iModelCore/libsrc/openssl/vendor/configdata.pm.in‎

Lines changed: 2 additions & 2 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)