| Brad Bishop | 37a0e4d | 2017-12-04 01:01:44 -0500 | [diff] [blame] | 1 | From d795f5f20a29adecf92c09459a3ee07ffac01a99 Mon Sep 17 00:00:00 2001 |
| 2 | From: Rich Salz <rsalz@akamai.com> |
| 3 | Date: Sat, 13 Jun 2015 17:03:39 -0400 |
| 4 | Subject: [PATCH] Use SHA256 not MD5 as default digest. |
| 5 | |
| 6 | Commit f8547f62c212837dbf44fb7e2755e5774a59a57b upstream. |
| 7 | |
| 8 | Upstream-Status: Backport |
| 9 | Backport from OpenSSL 2.0 to OpenSSL 1.0.2 |
| 10 | Commit f8547f62c212837dbf44fb7e2755e5774a59a57b |
| 11 | |
| 12 | CVE: CVE-2004-2761 |
| 13 | |
| 14 | The MD5 Message-Digest Algorithm is not collision resistant, |
| 15 | which makes it easier for context-dependent attackers to |
| 16 | conduct spoofing attacks, as demonstrated by attacks on the |
| 17 | use of MD5 in the signature algorithm of an X.509 certificate. |
| 18 | |
| 19 | Reviewed-by: Viktor Dukhovni <viktor@openssl.org> |
| 20 | Signed-off-by: Zhang Xiao <xiao.zhang@windriver.com> |
| 21 | Signed-off-by: T.O. Radzy Radzykewycz <radzy@windriver.com> |
| 22 | --- |
| 23 | apps/ca.c | 2 +- |
| 24 | apps/dgst.c | 2 +- |
| 25 | apps/enc.c | 2 +- |
| 26 | 3 files changed, 3 insertions(+), 3 deletions(-) |
| 27 | |
| 28 | diff --git a/apps/ca.c b/apps/ca.c |
| 29 | index 3b7336c..8f3a84b 100644 |
| 30 | --- a/apps/ca.c |
| 31 | +++ b/apps/ca.c |
| 32 | @@ -1612,7 +1612,7 @@ static int certify_cert(X509 **xret, char *infile, EVP_PKEY *pkey, X509 *x509, |
| 33 | } else |
| 34 | BIO_printf(bio_err, "Signature ok\n"); |
| 35 | |
| 36 | - if ((rreq = X509_to_X509_REQ(req, NULL, EVP_md5())) == NULL) |
| 37 | + if ((rreq = X509_to_X509_REQ(req, NULL, NULL)) == NULL) |
| 38 | goto err; |
| 39 | |
| 40 | ok = do_body(xret, pkey, x509, dgst, sigopts, policy, db, serial, subj, |
| 41 | diff --git a/apps/dgst.c b/apps/dgst.c |
| 42 | index 95e5fa3..0d1529f 100644 |
| 43 | --- a/apps/dgst.c |
| 44 | +++ b/apps/dgst.c |
| 45 | @@ -442,7 +442,7 @@ int MAIN(int argc, char **argv) |
| 46 | goto end; |
| 47 | } |
| 48 | if (md == NULL) |
| 49 | - md = EVP_md5(); |
| 50 | + md = EVP_sha256(); |
| 51 | if (!EVP_DigestInit_ex(mctx, md, impl)) { |
| 52 | BIO_printf(bio_err, "Error setting digest %s\n", pname); |
| 53 | ERR_print_errors(bio_err); |
| 54 | diff --git a/apps/enc.c b/apps/enc.c |
| 55 | index 7b7c70b..a7d944c 100644 |
| 56 | --- a/apps/enc.c |
| 57 | +++ b/apps/enc.c |
| 58 | @@ -344,7 +344,7 @@ int MAIN(int argc, char **argv) |
| 59 | } |
| 60 | |
| 61 | if (dgst == NULL) { |
| 62 | - dgst = EVP_md5(); |
| 63 | + dgst = EVP_sha256(); |
| 64 | } |
| 65 | |
| 66 | if (bufsize != NULL) { |
| 67 | -- |
| 68 | 1.9.1 |
| 69 | |