mirror/openssl
2
0
Fork 0
mirror of https://github.com/openssl/openssl.git synced 2025-01-18 13:44:20 +08:00
Code Issues Packages Projects Releases Wiki Activity

rsa: add implicit rejection CHANGES entry

Browse Source 
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/13817)
This commit is contained in:
Hubert Kario 2022-12-09 20:43:22 +01:00 committed by Tomas Mraz
parent 056dade341
commit c3aed7e4e6
1 changed files with 12 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
CHANGES.md
View File

@ -192,6 +192,18 @@ OpenSSL 3.2
*Maxim Mikityanskiy* *Maxim Mikityanskiy*
* Added and enabled by default implicit rejection in RSA PKCS#1 v1.5
decryption as a protection against Bleichenbacher-like attacks.
The RSA decryption API will now return a randomly generated deterministic
message instead of an error in case it detects an error when checking
padding during PKCS#1 v1.5 decryption. This is a general protection against
issues like CVE-2020-25659 and CVE-2020-25657. This protection can be
disabled by calling
`EVP_PKEY_CTX_ctrl_str(ctx, "rsa_pkcs1_implicit_rejection". "0")`
on the RSA decryption context.
*Hubert Kario*
OpenSSL 3.1 OpenSSL 3.1
----------- -----------