Skip to content

Commit

Permalink
update to openssl 1.1.1w
Browse files Browse the repository at this point in the history
Changes between 1.1.1v and 1.1.1w [11 Sep 2023]

 *) Fix POLY1305 MAC implementation corrupting XMM registers on Windows.

    The POLY1305 MAC (message authentication code) implementation in OpenSSL
    does not save the contents of non-volatile XMM registers on Windows 64
    platform when calculating the MAC of data larger than 64 bytes. Before
    returning to the caller all the XMM registers are set to zero rather than
    restoring their previous content. The vulnerable code is used only on newer
    x86_64 processors supporting the AVX512-IFMA instructions.

    The consequences of this kind of internal application state corruption can
    be various - from no consequences, if the calling application does not
    depend on the contents of non-volatile XMM registers at all, to the worst
    consequences, where the attacker could get complete control of the
    application process. However given the contents of the registers are just
    zeroized so the attacker cannot put arbitrary values inside, the most likely
    consequence, if any, would be an incorrect result of some application
    dependent calculations or a crash leading to a denial of service.

    (CVE-2023-4807)
    [Bernd Edlinger]
  • Loading branch information
chcg committed Sep 12, 2023
1 parent 0437f32 commit d64c552
Showing 1 changed file with 2 additions and 2 deletions.
4 changes: 2 additions & 2 deletions build_3rdparty.py
Original file line number Diff line number Diff line change
Expand Up @@ -5,8 +5,8 @@
DEPENDENT_LIBS = {
'openssl': {
'order' : 1,
'url' : 'https://www.openssl.org/source/openssl-1.1.1v.tar.gz',
'sha1' : '3ec7b37aefcbcd8d4bd9b2f3687dd77948d46382',
'url' : 'https://www.openssl.org/source/openssl-1.1.1w.tar.gz',
'sha1' : '76fbf3ca4370e12894a408ef75718f32cdab9671',
'target': {
'mingw-w64': {
'result': ['include/openssl/ssl.h', 'lib/libssl.a', 'lib/libcrypto.a'],
Expand Down

0 comments on commit d64c552

Please sign in to comment.