upstream/openvpn
1
0
Fork 0
mirror of https://github.com/OpenVPN/openvpn.git synced 2026-06-13 02:43:50 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions 5

crypto_openssl.c: disable explicit initialization on Windows (CVE-2121-3606)

Browse source 
Commit a4071b ("crypto_openssl: add initialization to pick up local
configuration") added openssl initialization to load configuration
file.  However on Windows this file is loaded from user-writable
directory, such as c:\etc\ssl for mingw builds and (for example)
c:\vcpkg\packages\openssl_x64-windows\openvpn.cnf for vcpkg
builds.  This could be a security risk.

CVE-2121-3606 has been assigned to acknowledge this risk.

Since aforementioned commit implements a niche feature which might
be better solved with CryptoAPI on Windows, make this code conditional
(for now).

CVE: 2121-3606
Signed-off-by: Lev Stipakov <lev@openvpn.net>
Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <20210617061226.244-1-lstipakov@gmail.com>
URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg22568.html
Signed-off-by: Gert Doering <gert@greenie.muc.de>
(cherry picked from commit abd5ee9b7d)
This commit is contained in:
Lev Stipakov 2021-06-17 09:12:26 +03:00 committed by Gert Doering
parent d8dee82f11
commit 447cfb4f30
1 changed files with 2 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
src/openvpn/crypto_openssl.c
View file

@ -150,11 +150,13 @@ crypto_init_lib_engine(const char *engine_name)
void
crypto_init_lib(void)
{
#ifndef _WIN32
#if (OPENSSL_VERSION_NUMBER >= 0x10100000L)
OPENSSL_init_crypto(OPENSSL_INIT_LOAD_CONFIG, NULL);
#else
OPENSSL_config(NULL);
#endif
#endif /* _WIN32 */
/*
* If you build the OpenSSL library and OpenVPN with
* CRYPTO_MDEBUG, you will get a listing of OpenSSL