[openssl/openssl] f675d1: Generate some certificates with the certificatePol...

[Matt Caswell]

  Branch: refs/heads/OpenSSL_1_1_1-stable
  Home:   https://github.com/openssl/openssl
  Commit: f675d164e5d9648c3537a0f5efe1cc2fd232b4a9
      https://github.com/openssl/openssl/commit/f675d164e5d9648c3537a0f5efe1cc2fd232b4a9
  Author: Matt Caswell <matt at openssl.org>
  Date:   2023-03-23 (Thu, 23 Mar 2023)

  Changed paths:
    A test/certs/ca-pol-cert.pem
    A test/certs/ee-cert-policies-bad.pem
    A test/certs/ee-cert-policies.pem
    M test/certs/mkcert.sh
    M test/certs/setup.sh

  Log Message:
  -----------
  Generate some certificates with the certificatePolicies extension

Related-to: CVE-2023-0465

Reviewed-by: Hugo Landau <hlandau at openssl.org>
Reviewed-by: Tomas Mraz <tomas at openssl.org>
(Merged from https://github.com/openssl/openssl/pull/20588)


  Commit: b013765abfa80036dc779dd0e50602c57bb3bf95
      https://github.com/openssl/openssl/commit/b013765abfa80036dc779dd0e50602c57bb3bf95
  Author: Matt Caswell <matt at openssl.org>
  Date:   2023-03-28 (Tue, 28 Mar 2023)

  Changed paths:
    M crypto/x509/x509_vfy.c

  Log Message:
  -----------
  Ensure that EXFLAG_INVALID_POLICY is checked even in leaf certs

Even though we check the leaf cert to confirm it is valid, we
later ignored the invalid flag and did not notice that the leaf
cert was bad.

Fixes: CVE-2023-0465

Reviewed-by: Hugo Landau <hlandau at openssl.org>
Reviewed-by: Tomas Mraz <tomas at openssl.org>
(Merged from https://github.com/openssl/openssl/pull/20588)


  Commit: 23a4cbeb3ad80da3830f760f624599f24236bc38
      https://github.com/openssl/openssl/commit/23a4cbeb3ad80da3830f760f624599f24236bc38
  Author: Matt Caswell <matt at openssl.org>
  Date:   2023-03-28 (Tue, 28 Mar 2023)

  Changed paths:
    M test/recipes/25-test_verify.t

  Log Message:
  -----------
  Add a Certificate Policies Test

Test that a valid certificate policy is accepted and that an invalid
certificate policy is rejected. Specifically we are checking that a
leaf certificate with an invalid policy is detected.

Related-to: CVE-2023-0465

Reviewed-by: Hugo Landau <hlandau at openssl.org>
Reviewed-by: Tomas Mraz <tomas at openssl.org>
(Merged from https://github.com/openssl/openssl/pull/20588)


  Commit: 8bc232b14624b7af01801d7940b7dec59b3ae47d
      https://github.com/openssl/openssl/commit/8bc232b14624b7af01801d7940b7dec59b3ae47d
  Author: Matt Caswell <matt at openssl.org>
  Date:   2023-03-28 (Tue, 28 Mar 2023)

  Changed paths:
    M CHANGES
    M NEWS

  Log Message:
  -----------
  Updated CHANGES and NEWS for CVE-2023-0465

Also updated the entries for CVE-2023-0464

Related-to: CVE-2023-0465

Reviewed-by: Hugo Landau <hlandau at openssl.org>
Reviewed-by: Tomas Mraz <tomas at openssl.org>
(Merged from https://github.com/openssl/openssl/pull/20588)


Compare: https://github.com/openssl/openssl/compare/13e030c60dbb...8bc232b14624