|
 |
c4366c |
Skip signature validation on selfsigned certificates and
|
|
|
c4366c |
drop MD2 algorithm from the list of algorithms added to
|
|
|
c4366c |
EVP tables by default. (CVE-2009-2409)
|
|
|
c4366c |
diff -up openssl-fips-0.9.8e/crypto/evp/c_alld.c.nomd2 openssl-fips-0.9.8e/crypto/evp/c_alld.c
|
|
|
c4366c |
--- openssl-fips-0.9.8e/crypto/evp/c_alld.c.nomd2 2009-04-15 13:48:51.000000000 +0200
|
|
|
c4366c |
+++ openssl-fips-0.9.8e/crypto/evp/c_alld.c 2010-01-14 09:24:00.000000000 +0100
|
|
|
c4366c |
@@ -69,9 +69,6 @@ void OpenSSL_add_all_digests(void)
|
|
|
c4366c |
if (!FIPS_mode())
|
|
|
c4366c |
{
|
|
|
c4366c |
#endif
|
|
|
c4366c |
-#ifndef OPENSSL_NO_MD2
|
|
|
c4366c |
- EVP_add_digest(EVP_md2());
|
|
|
c4366c |
-#endif
|
|
|
c4366c |
#ifndef OPENSSL_NO_MD4
|
|
|
c4366c |
EVP_add_digest(EVP_md4());
|
|
|
c4366c |
#endif
|
|
|
c4366c |
diff -up openssl-fips-0.9.8e/crypto/x509/x509_vfy.c.nomd2 openssl-fips-0.9.8e/crypto/x509/x509_vfy.c
|
|
|
c4366c |
--- openssl-fips-0.9.8e/crypto/x509/x509_vfy.c.nomd2 2009-04-15 13:48:51.000000000 +0200
|
|
|
c4366c |
+++ openssl-fips-0.9.8e/crypto/x509/x509_vfy.c 2010-01-14 09:22:49.000000000 +0100
|
|
|
c4366c |
@@ -1013,7 +1013,11 @@ static int internal_verify(X509_STORE_CT
|
|
|
c4366c |
while (n >= 0)
|
|
|
c4366c |
{
|
|
|
c4366c |
ctx->error_depth=n;
|
|
|
c4366c |
- if (!xs->valid)
|
|
|
c4366c |
+
|
|
|
c4366c |
+ /* Skip signature check for self signed certificates. It
|
|
|
c4366c |
+ * doesn't add any security and just wastes time.
|
|
|
c4366c |
+ */
|
|
|
c4366c |
+ if (!xs->valid && xs != xi)
|
|
|
c4366c |
{
|
|
|
c4366c |
if ((pkey=X509_get_pubkey(xi)) == NULL)
|
|
|
c4366c |
{
|
|
|
c4366c |
@@ -1023,13 +1027,6 @@ static int internal_verify(X509_STORE_CT
|
|
|
c4366c |
if (!ok) goto end;
|
|
|
c4366c |
}
|
|
|
c4366c |
else if (X509_verify(xs,pkey) <= 0)
|
|
|
c4366c |
- /* XXX For the final trusted self-signed cert,
|
|
|
c4366c |
- * this is a waste of time. That check should
|
|
|
c4366c |
- * optional so that e.g. 'openssl x509' can be
|
|
|
c4366c |
- * used to detect invalid self-signatures, but
|
|
|
c4366c |
- * we don't verify again and again in SSL
|
|
|
c4366c |
- * handshakes and the like once the cert has
|
|
|
c4366c |
- * been declared trusted. */
|
|
|
c4366c |
{
|
|
|
c4366c |
ctx->error=X509_V_ERR_CERT_SIGNATURE_FAILURE;
|
|
|
c4366c |
ctx->current_cert=xs;
|
|
|
c4366c |
diff -up openssl-fips-0.9.8e/ssl/ssl_algs.c.nomd2 openssl-fips-0.9.8e/ssl/ssl_algs.c
|
|
|
c4366c |
--- openssl-fips-0.9.8e/ssl/ssl_algs.c.nomd2 2009-04-15 14:09:42.000000000 +0200
|
|
|
c4366c |
+++ openssl-fips-0.9.8e/ssl/ssl_algs.c 2010-01-14 09:23:10.000000000 +0100
|
|
|
c4366c |
@@ -94,9 +94,6 @@ int SSL_library_init(void)
|
|
|
c4366c |
EVP_add_cipher(EVP_seed_cbc());
|
|
|
c4366c |
#endif
|
|
|
c4366c |
|
|
|
c4366c |
-#ifndef OPENSSL_NO_MD2
|
|
|
c4366c |
- EVP_add_digest(EVP_md2());
|
|
|
c4366c |
-#endif
|
|
|
c4366c |
#ifndef OPENSSL_NO_MD5
|
|
|
c4366c |
EVP_add_digest(EVP_md5());
|
|
|
c4366c |
EVP_add_digest_alias(SN_md5,"ssl2-md5");
|