|
|
@@ -75,93 +75,98 @@ single call hash function. Instead the name `WC_SHA`, `WC_SHA256`, `WC_SHA384` a
|
|
|
`WC_SHA512` should be used for the enum name.
|
|
|
|
|
|
|
|
|
-# wolfSSL Release 5.6.6 (Dec 19, 2023)
|
|
|
+# wolfSSL Release 5.7.0 (Mar 20, 2024)
|
|
|
|
|
|
-Release 5.6.6 has been developed according to wolfSSL's development and QA
|
|
|
+Release 5.7.0 has been developed according to wolfSSL's development and QA
|
|
|
process (see link below) and successfully passed the quality criteria.
|
|
|
https://www.wolfssl.com/about/wolfssl-software-development-process-quality-assurance
|
|
|
|
|
|
-NOTE: * --enable-heapmath is being deprecated and will be removed by 2024
|
|
|
+NOTE: * --enable-heapmath is being deprecated and will be removed by end of 2024
|
|
|
|
|
|
-REMINDER: When working with AES Block Cipher algorithms, `wc_AesInit()` should
|
|
|
-always be called first to initialize the `Aes` structure, before calling other
|
|
|
-Aes API functions. Recently we found several places in our documentation,
|
|
|
-comments, and codebase where this pattern was not observed. We have since
|
|
|
-fixed this omission in several PRs for this release.
|
|
|
+NOTE: In future releases, --enable-des3 (which is disabled by default) will be insufficient in itself to enable DES3 in TLS cipher suites. A new option, --enable-des3-tls-suites, will need to be supplied in addition. This option should only be used in backward compatibility scenarios, as it is inherently insecure.
|
|
|
+
|
|
|
+NOTE: This release switches the default ASN.1 parser to the new ASN template code. If the original ASN.1 code is preferred define `WOLFSSL_ASN_ORIGINAL` to use it. See PR #7199.
|
|
|
|
|
|
## Vulnerabilities
|
|
|
+* [High] CVE-2024-0901 Potential denial of service and out of bounds read. Affects TLS 1.3 on the server side when connecting to a malicious TLS 1.3 client. If using TLS 1.3 on the server side it is recommended to update the version of wolfSSL used. Fixed in this GitHub pull request https://github.com/wolfSSL/wolfssl/pull/7099
|
|
|
+
|
|
|
|
|
|
-* [Medium] CVE-2023-6935: After review of the previous RSA timing fix in wolfSSL 5.6.4, additional changes were found to be required. A complete resistant change is delivered in this release. This fix is for the Marvin attack, leading to being able to decrypt a saved TLS connection and potentially forge a signature after probing with a very large number of trial connections. This issue is around RSA decryption and affects the optional static RSA cipher suites on the server side, which are considered weak, not recommended to be used and are off by default in wolfSSL (even with `--enable-all`). Static RSA cipher suites were also removed from the TLS 1.3 protocol and are only present in TLS 1.2 and lower. All padding versions of RSA decrypt are affected since the code under review is outside of the padding processing. Information about the private keys is NOT compromised in affected code. It is recommended to disable static RSA cipher suites and update the version of wolfSSL used if using RSA private decryption alone outside of TLS. Thanks to Hubert Kario for the report. The fix for this issue is located in the following GitHub Pull Request: https://github.com/wolfSSL/wolfssl/pull/6955.
|
|
|
+* [Med] CVE-2024-1545 Fault Injection vulnerability in RsaPrivateDecryption function that potentially allows an attacker that has access to the same system with a victims process to perform a Rowhammer fault injection. Thanks to Junkai Liang, Zhi Zhang, Xin Zhang, Qingni Shen for the report (Peking University, The University of Western Australia)."
|
|
|
+Fixed in this GitHub pull request https://github.com/wolfSSL/wolfssl/pull/7167
|
|
|
|
|
|
-* [Low] CVE-2023-6936: A potential heap overflow read is possible in servers connecting over TLS 1.3 when the optional `WOLFSSL_CALLBACKS` has been defined. The out of bounds read can occur when a server receives a malicious malformed ClientHello. Users should either discontinue use of `WOLFSSL_CALLBACKS` on the server side or update versions of wolfSSL to 5.6.6. Thanks to the tlspuffin fuzzer team for the report which was designed and developed by; Lucca Hirschi (Inria, LORIA), Steve Kremer (Inria, LORIA), and Max Ammann (Trail of Bits). The fix for this issue is located in the following GitHub Pull Request: https://github.com/wolfSSL/wolfssl/pull/6949.
|
|
|
|
|
|
-* [Low] A side channel vulnerability with AES T-Tables is possible in a very controlled environment where precision sub-cache-line inspection can happen, such as inside an Intel SGX enclave. This can lead to recovery of the AES key. To prevent this type of attack, wolfSSL added an AES bitsliced implementation which can be enabled with the “`--enable-aes-bitsliced`” configure option. Thanks to Florian Sieck, Zhiyuan Zhang, Sebastian Berndt, Chitchanok Chuengsatiansup, Thomas Eisenbarth, and Yuval Yarom for the report (Universities of Lübeck, Melbourne, Adelaide and Bochum). The fix for this issue is located in the following GitHub Pull Request: https://github.com/wolfSSL/wolfssl/pull/6854.
|
|
|
+* [Med] Fault injection attack with EdDSA signature operations. This affects ed25519 sign operations where the system could be susceptible to Rowhammer attacks. Thanks to Junkai Liang, Zhi Zhang, Xin Zhang, Qingni Shen for the report (Peking University, The University of Western Australia).
|
|
|
+Fixed in this GitHub pull request https://github.com/wolfSSL/wolfssl/pull/7212
|
|
|
|
|
|
-* [Low] CVE-2023-6937: wolfSSL prior to 5.6.6 did not check that messages in a single (D)TLS record do not span key boundaries. As a result, it was possible to combine (D)TLS messages using different keys into one (D)TLS record. The most extreme edge case is that, in (D)TLS 1.3, it was possible that an unencrypted (D)TLS 1.3 record from the server containing first a ServerHello message and then the rest of the first server flight would be accepted by a wolfSSL client. In (D)TLS 1.3 the handshake is encrypted after the ServerHello but a wolfSSL client would accept an unencrypted flight from the server. This does not compromise key negotiation and authentication so it is assigned a low severity rating. Thanks to Johannes Wilson for the report (Sectra Communications and Linköping University). The fix for this issue is located in the following GitHub Pull Request: https://github.com/wolfSSL/wolfssl/pull/7029.
|
|
|
|
|
|
## New Feature Additions
|
|
|
|
|
|
-* Build option for disabling CRL date checks (`WOLFSSL_NO_CRL_DATE_CHECK`) (PR 6927)
|
|
|
-* Support for STM32WL55 and improvements to PKA ECC support (PR 6937)
|
|
|
-* Add option to skip cookie exchange on DTLS 1.3 session resumption (PR 6929)
|
|
|
-* Add implementation of SRTP KDF and SRTCP KDF (`--enable-srtp-kdf`) (PR 6888)
|
|
|
-* Add `wolfSSL_EXTENDED_KEY_USAGE_free()` (PR 6916)
|
|
|
-* Add AES bitsliced implementation that is cache attack safe (`--enable-aes-bitsliced`) (PR 6854)
|
|
|
-* Add memcached support and automated testing (PR 6430, 7022)
|
|
|
-* Add Hardware Encryption Acceleration for ESP32-C3, ESP32-C6, and ESP32-S2 (PR 6990)
|
|
|
-* Add (D)TLS 1.3 support for 0.5-RTT data (PR 7010)
|
|
|
+* Added --enable-experimental configure flag to gate out features that are considered to be experimental. Now liboqs, kyber, lms, xmss, and dual-alg-certs require the --enable-experimental flag.
|
|
|
+
|
|
|
+### POST QUANTUM SUPPORT ADDITIONS
|
|
|
+* Experimental framework for using wolfSSL’s XMSS implementation (PR 7161)
|
|
|
+* Experimental framework for using wolfSSL’s LMS implementation (PR 7283)
|
|
|
+* Experimental wolfSSL Kyber implementation and assembly optimizations, enabled with --enable-experimental --enable-kyber (PR 7318)
|
|
|
+* Experimental support for post quantum dual key/signature certificates. A few known issues and sanitizer checks are in progress with this feature. Enabled with the configure flags --enable-experimental --enable-dual-alg-certs (PR 7112)
|
|
|
+* CryptoCb support for PQC algorithms (PR 7110)
|
|
|
+
|
|
|
+### OTHER FEATURE ADDITIONS
|
|
|
+* The Linux kernel module now supports registration of AES-GCM, AES-XTS, AES-CBC, and AES-CFB with the kernel cryptosystem through the new --enable-linuxkm-lkcapi-register option, enabling automatic use of wolfCrypt implementations by the dm-crypt/luks and ESP subsystems. In particular, wolfCrypt AES-XTS with –enable-aesni is faster than the native kernel implementation.
|
|
|
+* CryptoCb hook to one-shot CMAC functions (PR 7059)
|
|
|
+* BER content streaming support for PKCS7_VerifySignedData and sign/encrypt operations (PR 6961 & 7184)
|
|
|
+* IoT-Safe SHA-384 and SHA-512 support (PR 7176)
|
|
|
+* I/O callbacks for content and output with PKCS7 bundle sign/encrypt to reduce peak memory usage (PR 7272)
|
|
|
+* Microchip PIC24 support and example project (PR 7151)
|
|
|
+* AutoSAR shim layer for RNG, SHA256, and AES (PR 7296)
|
|
|
+* wolfSSL_CertManagerUnloadIntermediateCerts API to clear intermediate certs added to certificate store (PR 7245)
|
|
|
+* Implement SSL_get_peer_signature_nid and SSL_get_peer_signature_type_nid (PR 7236)
|
|
|
+
|
|
|
|
|
|
## Enhancements and Optimizations
|
|
|
|
|
|
-* Better built in testing of “`--sys-ca-certs`” configure option (PR 6910)
|
|
|
-* Updated CMakeLists.txt for Espressif wolfSSL component usage (PR 6877)
|
|
|
-* Disable TLS 1.1 by default (unless SSL 3.0 or TLS 1.0 is enabled) (PR 6946)
|
|
|
-* Add “`--enable-quic`” to “`--enable-all`” configure option (PR 6957)
|
|
|
-* Add support to SP C implementation for RSA exponent up to 64-bits (PR 6959)
|
|
|
-* Add result of “`HAVE___UINT128_T`” to options.h for CMake builds (PR 6965)
|
|
|
-* Add optimized assembly for AES-GCM on ARM64 using hardware crypto instructions (PR 6967)
|
|
|
-* Add built-in cipher suite tests for DTLS 1.3 PQC (PR 6952)
|
|
|
-* Add wolfCrypt test and unit test to ctest (PR 6977)
|
|
|
-* Move OpenSSL compatibility crypto APIs into `ssl_crypto.c` file (PR 6935)
|
|
|
-* Validate time generated from XGMTIME() (PR 6958)
|
|
|
-* Allow wolfCrypt benchmark to run with microsecond accuracy (PR 6868)
|
|
|
-* Add GitHub Actions testing with nginx 1.24.0 (PR 6982)
|
|
|
-* Allow encoding of CA:FALSE BasicConstraint during cert generation (PR 6953)
|
|
|
-* Add CMake option to enable DTLS-SRTP (PR 6991)
|
|
|
-* Add CMake options for enabling QUIC and cURL (PR 7049)
|
|
|
-* Improve RSA blinding to make code more constant time (PR 6955)
|
|
|
-* Refactor AES-NI implementation macros to allow dynamic fallback to C (PR 6981)
|
|
|
-* Default to native Windows threading API on MinGW (PR 7015)
|
|
|
-* Return better error codes from OCSP response check (PR 7028)
|
|
|
-* Updated Espressif ESP32 TLS client and server examples (PR 6844)
|
|
|
-* Add/clean up support for ESP-IDF v5.1 for a variety of ESP32 chips (PR 7035, 7037)
|
|
|
-* Add API to choose dynamic certs based on client ciphers/sigalgs (PR 6963)
|
|
|
-* Improve Arduino IDE 1.5 project file to match recursive style (PR 7007)
|
|
|
-* Simplify and improve apple-universal build script (PR 7025)
|
|
|
+* Remove obsolete user-crypto functionality and Intel IPP support (PR 7097)
|
|
|
+* Support for RSA-PSS signatures with CRL use (PR 7119)
|
|
|
+* Enhancement for AES-GCM use with Xilsecure on Microblaze (PR 7051)
|
|
|
+* Support for crypto cb only build with ECC and NXP CAAM (PR 7269)
|
|
|
+* Improve liboqs integration adding locking and init/cleanup functions (PR 7026)
|
|
|
+* Prevent memory access before clientSession->serverRow and clientSession->serverIdx are sanitized (PR 7096)
|
|
|
+* Enhancements to reproducible build (PR 7267)
|
|
|
+* Update Arduino example TLS Client/Server and improve support for ESP32 (PR 7304 & 7177)
|
|
|
+* XC32 compiler version 4.x compatibility (PR 7128)
|
|
|
+* Porting for build on PlayStation 3 and 4 (PR 7072)
|
|
|
+* Improvements for Espressif use; SHA HW/SW selection and use on ESP32-C2/ESP8684, wolfSSL_NewThread() type, component cmake fix, and update TLS client example for ESP8266 (PR 7081, 7173, 7077, 7148, 7240)
|
|
|
+* Allow crypto callbacks with SHA-1 HW (PR 7087)
|
|
|
+* Update OpenSSH port to version 9.6p1(PR 7203)
|
|
|
+* ARM Thumb2 enhancements, AES-GCM support for GCM_SMALL, alignment fix on key, fix for ASM clobber list (PR 7291,7301,7221)
|
|
|
+* Expand heap hint support for static memory build with more x509 functions (PR 7136)
|
|
|
+* Improving ARMv8 ChaCha20 ASM (alignment) (PR 7182)
|
|
|
+* Unknown extension callback wolfSSL_CertManagerSetUnknownExtCallback added to CertManager (PR 7194)
|
|
|
+* Implement wc_rng_new_ex for use with devID’s with crypto callback (PR 7271)
|
|
|
+* Allow reading 0-RTT data after writing 0.5-RTT data (PR 7102)
|
|
|
+* Send alert on bad PSK binder error (PR 7235)
|
|
|
+* Enhancements to CMake build files for use with cross compiling (PR 7188)
|
|
|
+
|
|
|
|
|
|
## Fixes
|
|
|
|
|
|
-* Fix for async edge case with Intel QuickAssist/Cavium Nitrox (PR 6931)
|
|
|
-* Fix for building PKCS#7 with RSA disabled (PR 6902)
|
|
|
-* Fix for advancing output pointer in `wolfSSL_i2d_X509()` (PR 6891)
|
|
|
-* Fix for `EVP_EncodeBlock()` appending a newline (PR 6900)
|
|
|
-* Fix for `wolfSSL_RSA_verify_PKCS1_PSS()` with `RSA_PSS_SALTLEN_AUTO` (PR 6938)
|
|
|
-* Fixes for CODESonar reports around `isalpha()` and `isalnum()` calls (PR 6810)
|
|
|
-* Fix for SP ARM64 integer math to avoid compiler optimization issues (PR 6942)
|
|
|
-* Fix for SP Thumb2 inline assembly to add IAR build support (PR 6943, 6971)
|
|
|
-* Fix for SP Thumb2 to make functions not inlined (PR 6993)
|
|
|
-* Fix for SP Cortex-M assembly large build with IAR (PR 6954)
|
|
|
-* Fix for SP ARM64 assembly montgomery reduction by 4 (PR 6947)
|
|
|
-* Fix for SP ARM64 P-256 for not inlining functions for iOS compatibility (PR 6979)
|
|
|
-* Fix for `WOLFSSL_CALLBACKS` and potential memory error (PR 6949)
|
|
|
-* Fixes for wolfSSL’s Zephyr OS port (PR 6930)
|
|
|
-* Fix for build errors when building for NXP mmCAU (`FREESCALE_MMCAU`) (PR 6970)
|
|
|
-* Fix for TLS 1.3 `SendBuffered()` return code in non-blocking mode (PR 7001)
|
|
|
-* Fix for TLS `Hmac_UpdateFinal()` when padding byte is invalid (PR 6998)
|
|
|
-* Fix for ARMv8 AES-GCM streaming to check size of IV before storing (PR 6996)
|
|
|
-* Add missing calls to `wc_AesInit()` before `wc_AesSetKey()` (PR 7011)
|
|
|
-* Fix build errors with DTLS 1.3 enabled but TLS 1.2 disabled (PR 6976)
|
|
|
-* Fixes for building wolfSSL in Visual Studio (PR 7040)
|
|
|
+* Fix for checking result of MAC verify when no AAD is used with AES-GCM and Xilinx Xilsecure (PR 7051)
|
|
|
+* Fix for Aria sign use (PR 7082)
|
|
|
+* Fix for invalid `dh_ffdhe_test` test case using Intel QuickAssist (PR 7085)
|
|
|
+*Fixes for TI AES and SHA on TM4C with HW acceleration and add full AES GCM and CCM support with TLS (PR 7018)
|
|
|
+* Fixes for STM32 PKA use with ECC (PR 7098)
|
|
|
+* Fixes for TLS 1.3 with crypto callbacks to offload KDF / HMAC operation (PR 7070)
|
|
|
+* Fix include path for FSP 3.5 on Renesas RA6M4 (PR 7101)
|
|
|
+* Siphash x64 asm fix for use with older compilers (PR 7299)
|
|
|
+* Fix for SGX build with SP (PR 7308)
|
|
|
+* Fix to Make it mandatory that the cookie is sent back in new ClientHello when seen in a HelloRetryRequest with (PR 7190)
|
|
|
+* Fix for wrap around behavior with BIO pairs (PR 7169)
|
|
|
+* OCSP fixes for parsing of response correctly when there was a revocation reason and returning correct error value with date checks (PR 7241 & 7255)
|
|
|
+* Fix build with `NO_STDIO_FILESYSTEM` and improve checks for `XGETENV` (PR 7150)
|
|
|
+* Fix for DTLS sequence number and cookie when downgrading DTLS version (PR 7214)
|
|
|
+* Fix for write_dup use with chacha-poly cipher suites (PR 7206)
|
|
|
+* Fix for multiple handshake messages in one record failing with OUT_OF_ORDER_E when downgrading from TLS 1.3 to TLS 1.2 (PR 7141)
|
|
|
+* Fix for AES ECB build with Thumb and alignment (PR 7094)
|
|
|
+* Fix for negotiate handshake until the end in wolfSSL_read/wolfSSL_write if hitting an edge case with want read/write (PR 7237)
|
|
|
|
|
|
For additional vulnerability information visit the vulnerability page at:
|
|
|
https://www.wolfssl.com/docs/security-vulnerabilities/
|
|
|
@@ -237,4 +242,4 @@ More info can be found on-line at: https://wolfssl.com/wolfSSL/Docs.html
|
|
|
│ └── wolfcrypt [Header files]
|
|
|
├── wrapper [wolfSSL language wrappers]
|
|
|
└── zephyr [Port of wolfSSL for Zephyr RTOS]
|
|
|
-```
|
|
|
+```
|
JacobBarthelmeh