{"id":99182,"date":"2021-02-17T22:22:46","date_gmt":"2021-02-17T20:22:46","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/obnovlenie-openssl-1-1-1j-wolfssl-4-7-0-i-libressl-3-2-4"},"modified":"2021-02-17T22:22:46","modified_gmt":"2021-02-17T20:22:46","slug":"obnovlenie-openssl-1-1-1j-wolfssl-4-7-0-i-libressl-3-2-4","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/obnovlenie-openssl-1-1-1j-wolfssl-4-7-0-i-libressl-3-2-4","title":{"rendered":"Update OpenSSL 1.1.1j, wolfSSL 4.7.0, and LibreSSL 3.2.4","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
A corrective release of the OpenSSL 1.1.1j cryptographic library is available, which addresses two vulnerabilities: <\/p>\n
\n
CVE-2021-23841 \u2014 dereferencing a null pointer in the function X509_issuer_and_serial_hash(), which can lead to application crashes when this function is called to handle X509 certificates with an incorrect value in the issuer field.\n
CVE-2021-23840 \u2014 an integer overflow in the functions EVP_CipherUpdate, EVP_EncryptUpdate, and EVP_DecryptUpdate, resulting in a return value of 1, indicating successful execution of the operation, and setting a negative value for size, which can lead to application crashes or unexpected behavior.\n
CVE-2021-23839 \u2014 a shortcoming in the implementation of protection against rollback to the SSLv2 protocol. This issue only manifests in the old 1.0.2 branch. <\/ul>\n
A release of LibreSSL 3.2.4 has also been published; this project, developed as a fork of OpenSSL by OpenBSD, aims to provide a higher level of security. This release is notable for reverting to the old certificate verification code used in LibreSSL 3.1.x, due to some applications malfunctioning with workarounds for bugs in the old code. Highlights include the addition of exporter and autochain components in TLSv1.3. <\/p>\n
Additionally, a new release of the compact cryptographic library wolfSSL 4.7.0 has been made, optimized for use on embedded devices with limited CPU and memory resources, such as Internet of Things devices, smart home systems, automotive infotainment systems, routers, and mobile phones. The code is written in C and is distributed under the GPLv2 license. <\/p>\n
The new version implements support for RFC 5705 (Keying Material Exporters for TLS) and S\/MIME (Secure\/Multipurpose Internet Mail Extensions). A flag '\u2014enable-reproducible-build' has been added to ensure reproducible builds. APIs SSL_get_verify_mode, X509_VERIFY_PARAM API, and X509_STORE_CTX have been added for compatibility with OpenSSL. The macro WOLFSSL_PSK_IDENTITY_ALERT has been implemented. A new function _CTX_NoTicketTLSv12 has been added to disable TLS 1.2 session tickets while retaining them for TLS 1.3. \n Source: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"