Download OpenSSL 0.9.8l

OpenSSL is a well-known security program that offers encryption functions. It contains an implementation of the tls and ssl protocols, with which data can be sent and received encrypted to prevent eavesdropping, for example. For more information, we refer you to this page. The developers have released a new version with 0.9.8l as the version designation. The list of changes since the previous entry in the Meuktracker looks like this:

Changes between 0.9.8k and 0.9.8l:

• Fixes to stateless session resumption handling. Use initial_ctx when issuing and attempting to decrypt tickets in case it has changed during servername handling. Use a non-zero length session ID when attempting stateless session resumption: this makes it possible to determine if a resumption has occurred immediately after receiving server hello (several places in OpenSSL subtly assume this) instead of later in the handshake. [Steve Henson]
• The functions ENGINE_ctrl(), OPENSSL_isservice(), CMS_get1_RecipientRequest() and RAND_bytes() can return <=0 on error fixes for a few places where the return code is not checked correctly. [Julia Lawall]
• Add –strict-warnings option to Configure script to include devteam warnings in other configurations. [Steve Henson]
• Add support for –libdir option and LIBDIR variable in makefiles. This makes it possible to install openssl libraries in locations which have names other than “lib”, for example “/usr/lib64” which some systems need. [Steve Henson, based on patch from Jeremy Utley]
• Don’t allow the use of leading 0x80 in OIDs. This is a violation of X690 8.9.12 and can produce some misleading textual output of OIDs. [Steve Henson, reported by Dan Kaminsky]
• Add compression id to {d2i,i2d}_SSL_SESSION so it is correctly saved and restored. [Steve Henson]
• Fix the server certificate chain building code to use X509_verify_cert(), it used to have an ad-hoc builder which was unable to cope with anything other than a simple chain. [David Woodhouse, Steve Henson]
• Don’t check self signed certificate signatures in X509_verify_cert() by default (a flag can override this): it just wastes time without adding any security. As a useful side effect self signed root CAs with non-FIPS digests are now usable in FIPS mode. [Steve Henson]
• In dtls1_process_out_of_seq_message() the check if the current message is already buffered was missing. For every new message was memory allocated, allowing an attacker to perform an denial of service attack with sending out of seq handshake messages until there is no memory left. Additionally every future messege was buffered, even if the sequence number made no sense and would be part of another handshake. So only messages with sequence numbers less than 10 in advance will be buffered. [Robin Seggelmann, discovered by Daniel Mentz]
• Records are buffered if they arrive with a future epoch to be processed after finishing the corresponding handshake. There is currently no limitation to this buffer allowing an attacker to perform a DOS attack with sending records with future epochs until there is no memory left. This patch adds the pqueue_size() function to detemine the size of a buffer and limits the record buffer to 100 entries. [Robin Seggelmann, discovered by Daniel Mentz]
• Keep a copy of frag->msg_header.frag_len so it can be used after the parent structure is freed. [Daniel Mentz]
• Handle non-blocking I/O properly in SSL_shutdown() call. [Darryl Miles]
• Add 2.5.4.* OIDs [Ilya O.]

Changes between 0.9.8j and 0.9.8k:

• Don’t set val to NULL when freeing up structures, it is freed up by underlying code. If sizeof(void *) > sizeof(long) this can result in zeroing past the valid field. (CVE-2009-0789) [Paolo Ganci]
• Fix bug where return value of CMS_SignerInfo_verify_content() was not checked correctly. This would allow some invalid signed attributes to appear to verify correctly. (CVE-2009-0591) [Ivan Nestlerode]
• Reject UniversalString and BMPString types with invalid lengths. This prevents a crash in ASN1_STRING_print_ex() which assumes the strings have a legal length. (CVE-2009-0590) [Steve Henson]
• Set S/MIME signing as the default purpose rather than setting it unconditionally. This allows applications to override it at the store level. [Steve Henson]
• Permit restricted recursion or ASN1 strings. This is needed in practice to handle some structures. [Steve Henson]
• Improve efficiency of mem_gets: don’t search whole buffer each time for a ‘\n’ [Jeremy Shapiro]
• New -hex option for openssl rand. [Matthieu Herrb]
• Print out UTF8String and NumericString when parsing ASN1. [Steve Henson]
• Support NumericString type for name components. [Steve Henson]
• Allow CC in the environment to override the automatically chosen compiler. Note that nothing is done to ensure flags work with the chosen compiler. [Ben Laurie]