軟體下載 OpenSSL 3.0.1 (64-bit)

• 1

  版本確認

• 2

  檔案準備中

• 3

  檔案下載

What's new in this version:

- Fixed invalid handling of X509_verify_cert() internal errors in libssl Internally libssl in OpenSSL calls X509_verify_cert() on the client side to verify a certificate supplied by a server. That function may return a negative return value to indicate an internal error (for example out of memory). Such a negative return value is mishandled by OpenSSL and will cause an IO function (such as SSL_connect() or SSL_do_handshake()) to not indicate success and a subsequent call to SSL_get_error() to return the value SSL_ERROR_WANT_RETRY_VERIFY. This return value is only supposed to be returned by OpenSSL if the application has previously called SSL_CTX_set_cert_verify_callback(). Since most applications do not do this the SSL_ERROR_WANT_RETRY_VERIFY return value from SSL_get_error() will be totally unexpected and applications may not behave correctly as a result. The exact behaviour will depend on the application but it could result in crashes, infinite loops or other similar incorrect responses.
- This issue is made more serious in combination with a separate bug in OpenSSL 3.0 that will cause X509_verify_cert() to indicate an internal error when processing a certificate chain. This will occur where a certificate does not include the Subject Alternative Name extension but where a Certificate Authority has enforced name constraints. This issue can occur even with valid chains. ([CVE-2021-4044])
- Corrected a few file name and file reference bugs in the build, installation and setup scripts, which lead to installation verification failures. Slightly enhanced the installation verification script.
- Fixed EVP_PKEY_eq() to make it possible to use it with strictly private keys
- Fixed PVK encoder to properly query for the passphrase
- Multiple fixes in the OSSL_HTTP API functions
- Allow sign extension in OSSL_PARAM_allocate_from_text() for the OSSL_PARAM_INTEGER data type and return error on negative numbers used with the OSSL_PARAM_UNSIGNED_INTEGER data type. Make OSSL_PARAM_BLD_push_BN{,_pad}() return an error on negative numbers
- Allow copying uninitialized digest contexts with EVP_MD_CTX_copy_ex
- Fixed detection of ARMv7 and ARM64 CPU features on FreeBSD
- Multiple threading fixes
- Added NULL digest implementation to keep compatibility with 1.1.1 version
- Allow fetching an operation from the provider that owns an unexportable key as a fallback if that is still allowed by the property query