[openssl-commits] [web] master update

[Rich Salz]

The branch master has been updated
       via  33e0bb7ff0d4776aeb917228e03849b502e17ebf (commit)
      from  c5539fee7af88f0d3bb58b9fd5c98de61f00abb8 (commit)


- Log -----------------------------------------------------------------
commit 33e0bb7ff0d4776aeb917228e03849b502e17ebf
Author: wetinee <wetinee0908 at gmail.com>
Date:   Wed Aug 23 14:57:31 2017 +0800

    CVE 2017-3735
    
    Reviewed-by: Rich Salz <rsalz at openssl.org>

-----------------------------------------------------------------------

Summary of changes:
 news/newsflash.txt       |  2 ++
 news/secadv/20170828.txt | 38 ++++++++++++++++++++++++++++++++++++++
 news/vulnerabilities.xml | 34 ++++++++++++++++++++++++++++++++++
 3 files changed, 74 insertions(+)
 create mode 100644 news/secadv/20170828.txt

diff --git a/news/newsflash.txt b/news/newsflash.txt
index 6ff850d..e81ae1a 100644
--- a/news/newsflash.txt
+++ b/news/newsflash.txt
@@ -4,6 +4,8 @@
 # Format is two fields, colon-separated; the first line is the column
 # headings.  URL paths must all be absolute.
 Date: Item
+28-Aug-2017: <a href="/news/secadv/20170828.txt">Security Advisory</a>: Buffer
+overread
 25-May-2017: OpenSSL 1.1.0f is now available, including various bug fixes (no security fixes)
 25-May-2017: OpenSSL 1.0.2l is now available, including various bug fixes (no security fixes)
 04-May-2017: New Blog post: <a href="/blog/blog/2017/05/04/tlsv1.3/">Using TLS1.3 with OpenSSL</a>
diff --git a/news/secadv/20170828.txt b/news/secadv/20170828.txt
new file mode 100644
index 0000000..02a1cba
--- /dev/null
+++ b/news/secadv/20170828.txt
@@ -0,0 +1,38 @@
+
+OpenSSL Security Advisory [28 Aug 2017]
+========================================
+
+Malformed X.509 IPAdressFamily could cause OOB read (CVE-2017-3735)
+===================================================================
+
+Severity: Low
+
+If an X.509 certificate has a malformed IPAddressFamily extension,
+OpenSSL could do a one-byte buffer overread. The most likely result
+would be an erroneous display of the certificate in text format.
+
+As this is a low severity fix, no release is being made. The fix can be
+found in the source repository (1.0.2, 1.1.0, and master branches) in
+the X509v3_addr_get_afi function.  This bug has been present since 2006.
+
+This issue was found by Google's OSS-Fuzz project on August 22.
+The fix was developed by Rich Salz of the OpenSSL development team.
+
+Note
+====
+
+Support for version 1.0.1 ended on 31st December 2016. Support for versions
+0.9.8 and 1.0.0 ended on 31st December 2015. Those versions are no longer
+receiving security updates.
+
+References
+==========
+
+URL for this Security Advisory:
+https://www.openssl.org/news/secadv/20170126.txt
+
+Note: the online version of the advisory may be updated with additional details
+over time.
+
+For details of OpenSSL severity classifications please see:
+https://www.openssl.org/policies/secpolicy.html
diff --git a/news/vulnerabilities.xml b/news/vulnerabilities.xml
index 668e987..5130be3 100644
--- a/news/vulnerabilities.xml
+++ b/news/vulnerabilities.xml
@@ -6,6 +6,40 @@
 -->
 
 <security updated="20170216">
+  <issue public="20170828">
+    <impact severity="Low"/>
+    <cve name="2017-3735"/>
+    <affects base="1.1.0" version="1.1.0"/>
+    <affects base="1.1.0" version="1.1.0a"/>
+    <affects base="1.1.0" version="1.1.0b"/>
+    <affects base="1.1.0" version="1.1.0c"/>
+    <affects base="1.1.0" version="1.1.0d"/>
+    <affects base="1.1.0" version="1.1.0e"/>
+    <affects base="1.1.0" version="1.1.0f"/>
+    <affects base="1.0.2" version="1.0.2a"/>
+    <affects base="1.0.2" version="1.0.2b"/>
+    <affects base="1.0.2" version="1.0.2c"/>
+    <affects base="1.0.2" version="1.0.2d"/>
+    <affects base="1.0.2" version="1.0.2e"/>
+    <affects base="1.0.2" version="1.0.2f"/>
+    <affects base="1.0.2" version="1.0.2g"/>
+    <affects base="1.0.2" version="1.0.2h"/>
+    <affects base="1.0.2" version="1.0.2i"/>
+    <affects base="1.0.2" version="1.0.2j"/>
+    <affects base="1.0.2" version="1.0.2k"/>
+    <affects base="1.0.2" version="1.0.2l"/>
+    <fixed base="1.0.2" version="1.0.2l-git" date="20170828"/>
+    <fixed base="1.1.0" version="1.1.0f-git" date="20170828"/>
+    <problemtype>out-of-bounds read</problemtype>
+    <title>Possible Overread in parsing X.509 IPAdressFamily</title>
+    <description>
+      While parsing an IPAdressFamily extension in an X.509 certificate,
+      it is possible to do a one-byte overread. This would result in
+      an incorrect text display of the certificate.
+    </description>
+    <advisory url="/news/secadv/20170828.txt"/>
+    <reported source="Google OSS-Fuzz"/>
+  </issue>
   <issue public="20170216">
     <impact severity="High"/>
     <cve name="2017-3733"/>