{"push_id":724002723,"size":14,"distinct_size":14,"ref":"refs/heads/master","head":"da24e6f8a05ea657684094e04c1a54efa04c2962","before":"9cf315ef90d0cfeb8bb7a38873eea07a8f0dffec","commits":[{"sha":"2aacec8f4a5ba1b365620a7b17fcce311ada93ad","author":{"email":"1fa2ef4755a9226cb9a0a4840bd89b158ac71391@openssl.org","name":"Matt Caswell"},"message":"Fix alternate chains certificate forgery issue\n\nDuring certificate verfification, OpenSSL will attempt to find an\nalternative certificate chain if the first attempt to build such a chain\nfails. An error in the implementation of this logic can mean that an\nattacker could cause certain checks on untrusted certificates to be\nbypassed, such as the CA flag, enabling them to use a valid leaf\ncertificate to act as a CA and \"issue\" an invalid certificate.\n\nThis occurs where at least one cert is added to the first chain from the\ntrust store, but that chain still ends up being untrusted. In that case\nctx->last_untrusted is decremented in error.\n\nPatch provided by the BoringSSL project.\n\nCVE-2015-1793\n\nReviewed-by: Stephen Henson <steve@openssl.org>","distinct":true,"url":"https://api.github.com/repos/Distrotech/openssl/commits/2aacec8f4a5ba1b365620a7b17fcce311ada93ad"},{"sha":"593e9c638c58e1a510c519db0d024527113330f3","author":{"email":"1fa2ef4755a9226cb9a0a4840bd89b158ac71391@openssl.org","name":"Matt Caswell"},"message":"Add test for CVE-2015-1793\n\nThis adds a test for CVE-2015-1793. This adds a new test file\nverify_extra_test.c, which could form the basis for additional\nverification tests.\n\nReviewed-by: Stephen Henson <steve@openssl.org>","distinct":true,"url":"https://api.github.com/repos/Distrotech/openssl/commits/593e9c638c58e1a510c519db0d024527113330f3"},{"sha":"aae41f8c54257d9fa6904d3a9aa09c5db6cefd0d","author":{"email":"1fa2ef4755a9226cb9a0a4840bd89b158ac71391@openssl.org","name":"Matt Caswell"},"message":"Reject calls to X509_verify_cert that have not been reinitialised\n\nThe function X509_verify_cert checks the value of |ctx->chain| at the\nbeginning, and if it is NULL then it initialises it, along with the value\nof ctx->untrusted. The normal way to use X509_verify_cert() is to first\ncall X509_STORE_CTX_init(); then set up various parameters etc; then call\nX509_verify_cert(); then check the results; and finally call\nX509_STORE_CTX_cleanup(). The initial call to X509_STORE_CTX_init() sets\n|ctx->chain| to NULL. The only place in the OpenSSL codebase  where\n|ctx->chain| is set to anything other than a non NULL value is in\nX509_verify_cert itself. Therefore the only ways that |ctx->chain| could be\nnon NULL on entry to X509_verify_cert is if one of the following occurs:\n1) An application calls X509_verify_cert() twice without re-initialising\nin between.\n2) An application reaches inside the X509_STORE_CTX structure and changes\nthe value of |ctx->chain| directly.\n\nWith regards to the second of these, we should discount this - it should\nnot be supported to allow this.\n\nWith regards to the first of these, the documentation is not exactly\ncrystal clear, but the implication is that you must call\nX509_STORE_CTX_init() before each call to X509_verify_cert(). If you fail\nto do this then, at best, the results would be undefined.\n\nCalling X509_verify_cert() with |ctx->chain| set to a non NULL value is\nlikely to have unexpected results, and could be dangerous. This commit\nchanges the behaviour of X509_verify_cert() so that it causes an error if\n|ctx->chain| is anything other than NULL (because this indicates that we\nhave not been initialised properly). It also clarifies the associated\ndocumentation. This is a follow up commit to CVE-2015-1793.\n\nReviewed-by: Stephen Henson <steve@openssl.org>","distinct":true,"url":"https://api.github.com/repos/Distrotech/openssl/commits/aae41f8c54257d9fa6904d3a9aa09c5db6cefd0d"},{"sha":"79a55b1f2796bf6471360e8b6ab131cdedca256e","author":{"email":"1fa2ef4755a9226cb9a0a4840bd89b158ac71391@openssl.org","name":"Matt Caswell"},"message":"Add documentation for some missing verify options\n\nFills in a couple of verify options that were lacking documentation.\n\nReviewed-by: Rich Salz <rsalz@openssl.org>","distinct":true,"url":"https://api.github.com/repos/Distrotech/openssl/commits/79a55b1f2796bf6471360e8b6ab131cdedca256e"},{"sha":"a64ba70dbb7e4886d7bae0b85a2a1070e22dd8fb","author":{"email":"1fa2ef4755a9226cb9a0a4840bd89b158ac71391@openssl.org","name":"Matt Caswell"},"message":"Add help text for some verify options\n\nFills in the help text for a number of options to verify that were blank.\n\nReviewed-by: Rich Salz <rsalz@openssl.org>","distinct":true,"url":"https://api.github.com/repos/Distrotech/openssl/commits/a64ba70dbb7e4886d7bae0b85a2a1070e22dd8fb"},{"sha":"7f3f41d816bb80e362a5978420f59030b3132c81","author":{"email":"1fa2ef4755a9226cb9a0a4840bd89b158ac71391@openssl.org","name":"Matt Caswell"},"message":"Extend -show_chain option to verify to show more info\n\nThe -show_chain flag to the verify command line app shows information about\nthe chain that has been built. This commit adds the text \"untrusted\" against\nthose certificates that have been used from the untrusted list.\n\nReviewed-by: Rich Salz <rsalz@openssl.org>","distinct":true,"url":"https://api.github.com/repos/Distrotech/openssl/commits/7f3f41d816bb80e362a5978420f59030b3132c81"},{"sha":"6f47ced0157059edee2d4c0d94fcf76e08763c5f","author":{"email":"1fa2ef4755a9226cb9a0a4840bd89b158ac71391@openssl.org","name":"Matt Caswell"},"message":"Update CHANGES and NEWS for the new release\n\nReviewed-by: Stephen Henson <steve@openssl.org>","distinct":true,"url":"https://api.github.com/repos/Distrotech/openssl/commits/6f47ced0157059edee2d4c0d94fcf76e08763c5f"},{"sha":"040b93353e8b48cfc0e2429d96eb3a27f259512d","author":{"email":"1fa2ef4755a9226cb9a0a4840bd89b158ac71391@openssl.org","name":"Matt Caswell"},"message":"Apply some missing updates from previous commits\n\nReviewed-by: Stephen Henson <steve@openssl.org>","distinct":true,"url":"https://api.github.com/repos/Distrotech/openssl/commits/040b93353e8b48cfc0e2429d96eb3a27f259512d"},{"sha":"88f4f91260653865a5cf668dac95156b37192352","author":{"email":"9ce5770b3bb4b2a1d59be2d97e34379cd192299f@openssl.org","name":"Dr. Stephen Henson"},"message":"Sort @sstacklst correctly.\n\nReviewed-by: Rich Salz <rsalz@openssl.org>","distinct":true,"url":"https://api.github.com/repos/Distrotech/openssl/commits/88f4f91260653865a5cf668dac95156b37192352"},{"sha":"851fdda1a1952e482fc3f5f1c7c3acdff132bbae","author":{"email":"9ce5770b3bb4b2a1d59be2d97e34379cd192299f@openssl.org","name":"Dr. Stephen Henson"},"message":"make stacks\n\nReviewed-by: Rich Salz <rsalz@openssl.org>","distinct":true,"url":"https://api.github.com/repos/Distrotech/openssl/commits/851fdda1a1952e482fc3f5f1c7c3acdff132bbae"},{"sha":"99dcd88035330d59ab40b5bc0f551aca7020cd30","author":{"email":"aac3f3b92e79603bfd34a7782243ccf92805a8f0@au1.ibm.com","name":"Peter Waltenberg"},"message":"Exit on error in ecparam\n\nReviewed-by: Tim Hudson <tjh@openssl.org>","distinct":true,"url":"https://api.github.com/repos/Distrotech/openssl/commits/99dcd88035330d59ab40b5bc0f551aca7020cd30"},{"sha":"2fc52c912a79eefe8610984bac5eed3a2589ee85","author":{"email":"9ce5770b3bb4b2a1d59be2d97e34379cd192299f@openssl.org","name":"Dr. Stephen Henson"},"message":"correct example\n\nReviewed-by: Rich Salz <rsalz@openssl.org>","distinct":true,"url":"https://api.github.com/repos/Distrotech/openssl/commits/2fc52c912a79eefe8610984bac5eed3a2589ee85"},{"sha":"27f98436b9a84b94fbdd8e32960504634ae44cc0","author":{"email":"5fb523282dd7956571c80524edc2dccfa0bd8234@openssl.org","name":"Richard Levitte"},"message":"Stop using tardy\n\nInstead of piping through tardy, and possibly suffering from bugs in certain\nversions, use --transform, --owner and --group directly with GNU tar (we\nalready expect that tar variant).\n\nReviewed-by: Rich Salz <rsalz@openssl.org>","distinct":true,"url":"https://api.github.com/repos/Distrotech/openssl/commits/27f98436b9a84b94fbdd8e32960504634ae44cc0"},{"sha":"da24e6f8a05ea657684094e04c1a54efa04c2962","author":{"email":"5fb523282dd7956571c80524edc2dccfa0bd8234@openssl.org","name":"Richard Levitte"},"message":"Set numeric IDs for tar as well\n\nReviewed-by: Matt Caswell <matt@openssl.org>","distinct":true,"url":"https://api.github.com/repos/Distrotech/openssl/commits/da24e6f8a05ea657684094e04c1a54efa04c2962"}]}