OpenSSL: Fix the RSA_SSLV23_PADDING padding type

This also fixes the public function RSA_padding_check_SSLv23.

Commit 6555a89 changed the padding check logic in RSA_padding_check_SSLv23
so that padding is rejected if the nul delimiter byte is not immediately
preceded by at least 8 bytes containing 0x03. Prior to that commit the
padding is rejected if it *is* preceded by at least 8 bytes containing 0x03.

Presumably this change was made to be consistent with what it says in
appendix E.3 of RFC 5246. Unfortunately that RFC is in error, and the
original behaviour was correct. This is fixed in later errata issued for
that RFC.

Applications that use SSLv2 or call RSA_paddin_check_SSLv23 directly, or
use the RSA_SSLV23_PADDING mode may be impacted. The effect of the original
error is that an RSA message encrypted by an SSLv2 only client will fail to
be decrypted properly by a TLS capable server, or a message encrypted by a
TLS capable client will fail to decrypt on an SSLv2 only server. Most
significantly an RSA message encrypted by a TLS capable client will be
successfully decrypted by a TLS capable server. This last case should fail
due to a rollback being detected.

Thanks to D. Katz and Joel Luellwitz (both from Trustwave) for reporting
this issue.

CVE-2021-23839

https://github.com/openssl/openssl/commit/30919ab80a478f2d81f2e9acdcca3fa4740cd547

Git Hash: 0ad812e6cda6c0138b821902b53cf070b79ddd5b
Git Author: matt@openssl.org

openssl: Fix a read buffer overrun in X509_CERT_AUX_print()

This is a backport of commit c5dc9ab965f to 1.0.2. That commit fixed
the same bug but in master/1.1.1 it is in the function X509_aux_print().
The original commit had the following description:

Fix a read buffer overrun in X509_aux_print().

The ASN1_STRING_get0_data(3) manual explitely cautions the reader
that the data is not necessarily NUL-terminated, and the function
X509_alias_set1(3) does not sanitize the data passed into it in any
way either, so we must assume the return value from X509_alias_get0(3)
is merely a byte array and not necessarily a string in the sense
of the C language.

I found this bug while writing manual pages for X509_print_ex(3)
and related functions. Theo Buehler <tb@openbsd.org> checked my
patch to fix the same bug in LibreSSL, see

http://cvsweb.openbsd.org/src/lib/libcrypto/asn1/t_x509a.c#rev1.9

As an aside, note that the function still produces incomplete and
misleading results when the data contains a NUL byte in the middle
and that error handling is consistently absent throughout, even
though the function provides an "int" return value obviously intended
to be 1 for success and 0 for failure, and even though this function
is called by another function that also wants to return 1 for success
and 0 for failure and even does so in many of its code paths, though
not in others. But let's stay focussed. Many things would be nice
to have in the wide wild world, but a buffer overflow must not be
allowed to remain in our backyard.

CVE-2021-3712

Reviewed-by: Paul Dale <pauli@openssl.org>

Git Hash: c40b21a7e2a030434d6850c28a4217c46b33577b
Git Author: matt@openssl.org

OpenSSL: Fix Null pointer deref in X509_issuer_and_serial_hash()

Note it is backported from OpenSSL 1.1.1j to fix CVE-2021-23841.

https://github.com/openssl/openssl/commit/122a19ab48091c657f7cb1fb3af9fc07bd557bbf

Git Hash: 2dcaecea30c0258d0541aaf434df95d143d07c06
Git Author: jkim@FreeBSD.org

OpenSSL: Don't overflow the output length in EVP_CipherUpdate calls

Note it is backported from OpenSSL 1.1.1j to fix CVE-2021-23840.

https://github.com/openssl/openssl/commit/6a51b9e1d0cf0bf8515f7201b68fb0a3482b3dc1

Git Hash: 9e94eac9765f54671b90150955e0851579959daa
Git Author: jkim@FreeBSD.org

OpenSSL: backport fixes for CVE-2020-1971 from head (r368447)

Note this is a direct commit because we have OpenSSL 1.0.2u in this branch.

Merge OpenSSL 1.0.2u.

Merge OpenSSL 1.0.2t.

Merge OpenSSL 1.0.2s.

Approved by: re (kib)

Merge OpenSSL 1.0.2r.

Merge OpenSSL 1.0.2q.

MFC: r337791

Merge OpenSSL 1.0.2p.

MFC: r331627

Merge OpenSSL 1.0.2o.

MFC: r326662

Merge OpenSSL 1.0.2n.

MFC: r325328

Merge OpenSSL 1.0.2m.