Per the upstream release notes, this is a ["bugfix release"](https://github.com/openssl/openssl/blob/openssl-3.0/CHANGES.md#openssl-30). It does not contain any security-critical bugfixes, unlike the most recent prior releases of OpenSSL 3.0. This release is not an immediate candidate for inclusion in 14.3-* releases. That being said, content from this release will potentially be rolled into upcoming releases by virtue of this being an iterative 3.0.x release. The changes may be benign, but some care might be required in the event that some of the bugfixes affect shipping code which requires behavior that may have been changed in this release. Obtained from: https://github.com/openssl/openssl/releases/download/openssl-3.0.17/openssl-3.0.17.tar.gz
This release incorporates the following bug fixes and mitigations: - [CVE-2024-13176](https://www.openssl.org/news/vulnerabilities.html#CVE-2024-13176 - [CVE-2024-9143](https://www.openssl.org/news/vulnerabilities.html#CVE-2024-9143) Release notes can be found at: https://openssl-library.org/news/openssl-3.0-notes/index.html
This release resolves 3 upstream found CVEs: - Fixed potential use after free after SSL_free_buffers() is called (CVE-2024-4741) - Fixed an issue where checking excessively long DSA keys or parameters may be very slow (CVE-2024-4603) - Fixed unbounded memory growth with session handling in TLSv1.3 (CVE-2024-2511)
Major changes between OpenSSL 3.0.10 and OpenSSL 3.0.11:
* Fix POLY1305 MAC implementation corrupting XMM registers on Windows
([CVE-2023-4807])
Release notes can otherwise be found at
https://www.openssl.org/news/openssl-3.0-notes.html.
Obtained from: https://www.openssl.org/source/openssl-3.0.11.tar.gz
Sponsored by: The FreeBSD Foundation
Test Plan:
```
$ git status
On branch vendor/openssl-3.0
Your branch is up to date with 'origin/vendor/openssl-3.0'.
nothing to commit, working tree clean
$ OSSLVER=3.0.11
$ XLIST=FREEBSD-Xlist
$ (cd ..; fetch https://www.openssl.org/source/openssl-${OSSLVER}.tar.gz https://www.openssl.org/source/openssl-${OSSLVER}.tar.gz.asc)
openssl-3.0.11.tar.gz 14 MB 17 MBps 01s
openssl-3.0.11.tar.gz.asc 833 B 8301 kBps 00s
$ gpg --list-keys
/home/khorben/.gnupg/pubring.kbx
--------------------------------
pub rsa4096 2011-03-01 [SCA]
DC34EE5DB2417BCC151E5100E5F8F8212F77A498
uid [ unknown] Willem Toorop <willem@nlnetlabs.nl>
sub rsa4096 2011-03-01 [E]
pub rsa4096 2014-10-04 [SC] [expires: 2024-01-30]
EFC0A467D613CB83C7ED6D30D894E2CE8B3D79F5
uid [ unknown] OpenSSL security team <openssl-security@openssl.org>
uid [ unknown] OpenSSL OMC <openssl-omc@openssl.org>
uid [ unknown] OpenSSL Security <openssl-security@openssl.org>
sub rsa4096 2014-10-04 [E] [expires: 2024-01-30]
$ gpg --verify ../openssl-${OSSLVER}.tar.gz.asc ../openssl-${OSSLVER}.tar.gz
gpg: Signature made Tue Sep 19 15:02:51 2023 CEST
gpg: using RSA key EFC0A467D613CB83C7ED6D30D894E2CE8B3D79F5
gpg: Good signature from "OpenSSL security team <openssl-security@openssl.org>" [unknown]
gpg: aka "OpenSSL OMC <openssl-omc@openssl.org>" [unknown]
gpg: aka "OpenSSL Security <openssl-security@openssl.org>" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg: There is no indication that the signature belongs to the owner.
Primary key fingerprint: EFC0 A467 D613 CB83 C7ED 6D30 D894 E2CE 8B3D 79F5
$ tar -x -X $XLIST -f ../openssl-${OSSLVER}.tar.gz -C ..
$ rsync --exclude FREEBSD.* --delete -av ../openssl-${OSSLVER}/* .
[...]
$ diff -arq ../openssl-${OSSLVER} .
Only in .: .git
Only in .: FREEBSD-Xlist
Only in .: FREEBSD-upgrade
Only in .: appveyor.yml
$ git status FREEBSD*
On branch vendor/openssl-3.0
Your branch is up to date with 'origin/vendor/openssl-3.0'.
nothing to commit, working tree clean
```
Summary:
Release notes can be found at
https://www.openssl.org/news/openssl-3.0-notes.html .
Obtained from: https://www.openssl.org/source/openssl-3.0.8.tar.gz
Differential Revision: https://reviews.freebsd.org/D38835
Test Plan:
```
$ git status
On branch vendor/openssl-3.0
nothing to commit, working tree clean
$ (cd ..; fetch http://www.openssl.org/source/openssl-${OSSLVER}.tar.gz http://www.openssl.org/source/openssl-${OSSLVER}.tar.gz.asc)
openssl-3.0.8.tar.gz 14 MB 4507 kBps 04s
openssl-3.0.8.tar.gz.asc 833 B 10 MBps 00s
$ set | egrep '(XLIST|OSSLVER)='
OSSLVER=3.0.8
XLIST=FREEBSD-Xlist
$ gpg --list-keys
/home/ngie/.gnupg/pubring.kbx
-----------------------------
pub rsa4096 2014-10-04 [SC]
7953AC1FBC3DC8B3B292393ED5E9E43F7DF9EE8C
uid [ unknown] Richard Levitte <richard@levitte.org>
uid [ unknown] Richard Levitte <levitte@lp.se>
uid [ unknown] Richard Levitte <levitte@openssl.org>
sub rsa4096 2014-10-04 [E]
$ gpg --verify openssl-${OSSLVER}.tar.gz.asc openssl-${OSSLVER}.tar.gz
gpg: Signature made Tue Feb 7 05:43:55 2023 PST
gpg: using RSA key 7953AC1FBC3DC8B3B292393ED5E9E43F7DF9EE8C
gpg: Good signature from "Richard Levitte <richard@levitte.org>" [unknown]
gpg: aka "Richard Levitte <levitte@lp.se>" [unknown]
gpg: aka "Richard Levitte <levitte@openssl.org>" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg: There is no indication that the signature belongs to the owner.
Primary key fingerprint: 7953 AC1F BC3D C8B3 B292 393E D5E9 E43F 7DF9 EE8C
$ (cd vendor.checkout/; git status; find . -type f -or -type l | cut -c 3- | sort > ../old)
On branch vendor/openssl-3.0
nothing to commit, working tree clean
$ tar -x -X $XLIST -f ../openssl-${OSSLVER}.tar.gz -C ..
$ rsync --exclude FREEBSD.* --delete -avzz ../openssl-${OSSLVER}/* .
$ cat .git
gitdir: /home/ngie/git/freebsd-src/.git/worktrees/vendor.checkout
$ diff -arq ../openssl-3.0.8 .
Only in .: .git
Only in .: FREEBSD-Xlist
Only in .: FREEBSD-upgrade
$ git status FREEBSD*
On branch vendor/openssl-3.0
nothing to commit, working tree clean
$
```
Reviewers: emaste, jkim
Subscribers: imp, andrew, dab
Differential Revision: https://reviews.freebsd.org/D38835