Matt Caswell d9461cbe87 Fix the RSA_SSLV23_PADDING padding type ... This also fixes the public function RSA_padding_check_SSLv23. Commit 6555a89 changed the padding check logic in RSA_padding_check_SSLv23 so that padding is rejected if the nul delimiter byte is not immediately preceded by at least 8 bytes containing 0x03. Prior to that commit the padding is rejected if it *is* preceded by at least 8 bytes containing 0x03. Presumably this change was made to be consistent with what it says in appendix E.3 of RFC 5246. Unfortunately that RFC is in error, and the original behaviour was correct. This is fixed in later errata issued for that RFC. This has no impact on libssl for modern versions of OpenSSL because there is no protocol support for SSLv2 in these versions. However applications that call RSA_paddin_check_SSLv23 directly, or use the RSA_SSLV23_PADDING mode may still be impacted. The effect of the original error is that an RSA message encrypted by an SSLv2 only client will fail to be decrypted properly by a TLS capable server, or a message encrypted by a TLS capable client will fail to decrypt on an SSLv2 only server. Most significantly an RSA message encrypted by a TLS capable client will be successfully decrypted by a TLS capable server. This last case should fail due to a rollback being detected. Thanks to D. Katz and Joel Luellwitz (both from Trustwave) for reporting this issue. CVE-2021-23839 Reviewed-by: Paul Dale <pauli@openssl.org>		2021-02-16 11:36:18 +00:00
..
build.info	bn: Deprecate the X9.31 RSA key generation related functions	2021-01-25 10:20:48 +01:00
rsa_acvp_test_params.c
rsa_ameth.c	Remove dead code in rsa_pkey_ctrl.	2021-02-14 16:48:48 +10:00
rsa_asn1.c
rsa_backend.c	RSA: properly generate algorithm identifier for RSA-PSS signatures	2021-02-05 14:04:59 +01:00
rsa_chk.c
rsa_crpt.c
rsa_depr.c
rsa_err.c
rsa_gen.c	Use ERR_R_*_LIB instead of ERR_LIB_* as reason code for sub-libraries	2021-02-12 14:02:06 +01:00
rsa_lib.c	EVP: fix keygen for EVP_PKEY_RSA_PSS	2021-01-28 16:25:16 +01:00
rsa_local.h
rsa_meth.c
rsa_mp_names.c
rsa_mp.c
rsa_none.c
rsa_oaep.c	Update copyright year	2021-01-28 13:54:57 +01:00
rsa_ossl.c
rsa_pk1.c
rsa_pmeth.c
rsa_prn.c
rsa_pss.c	RSA: properly generate algorithm identifier for RSA-PSS signatures	2021-02-05 14:04:59 +01:00
rsa_saos.c
rsa_schemes.c
rsa_sign.c
rsa_sp800_56b_check.c
rsa_sp800_56b_gen.c
rsa_ssl.c	Fix the RSA_SSLV23_PADDING padding type	2021-02-16 11:36:18 +00:00
rsa_x931.c
rsa_x931g.c	Update copyright year	2021-01-28 13:54:57 +01:00