1From 51e8a84ce742db0f6c70510d0159dad8f7825908 Mon Sep 17 00:00:00 2001 2From: Tomas Mraz <tomas@openssl.org> 3Date: Tue, 21 Mar 2023 16:15:47 +0100 4Subject: [PATCH] Fix documentation of X509_VERIFY_PARAM_add0_policy() 5 6The function was incorrectly documented as enabling policy checking. 7 8Fixes: CVE-2023-0466 9 10Reviewed-by: Matt Caswell <matt@openssl.org> 11Reviewed-by: Paul Dale <pauli@openssl.org> 12(Merged from https://github.com/openssl/openssl/pull/20563) 13 14Upstream-Status: Backport from [https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=51e8a84ce742db0f6c70510d0159dad8f7825908] 15CVE: CVE-2023-0466 16Signed-off-by: Siddharth Doshi <sdoshi@mvista.com> 17--- 18 doc/man3/X509_VERIFY_PARAM_set_flags.pod | 9 +++++++-- 19 1 file changed, 7 insertions(+), 2 deletions(-) 20 21diff --git a/doc/man3/X509_VERIFY_PARAM_set_flags.pod b/doc/man3/X509_VERIFY_PARAM_set_flags.pod 22index 75a1677..43c1900 100644 23--- a/doc/man3/X509_VERIFY_PARAM_set_flags.pod 24+++ b/doc/man3/X509_VERIFY_PARAM_set_flags.pod 25@@ -98,8 +98,9 @@ B<trust>. 26 X509_VERIFY_PARAM_set_time() sets the verification time in B<param> to 27 B<t>. Normally the current time is used. 28 29-X509_VERIFY_PARAM_add0_policy() enables policy checking (it is disabled 30-by default) and adds B<policy> to the acceptable policy set. 31+X509_VERIFY_PARAM_add0_policy() adds B<policy> to the acceptable policy set. 32+Contrary to preexisting documentation of this function it does not enable 33+policy checking. 34 35 X509_VERIFY_PARAM_set1_policies() enables policy checking (it is disabled 36 by default) and sets the acceptable policy set to B<policies>. Any existing 37@@ -400,6 +401,10 @@ The X509_VERIFY_PARAM_get_hostflags() function was added in OpenSSL 1.1.0i. 38 The X509_VERIFY_PARAM_get0_host(), X509_VERIFY_PARAM_get0_email(), 39 and X509_VERIFY_PARAM_get1_ip_asc() functions were added in OpenSSL 3.0. 40 41+The function X509_VERIFY_PARAM_add0_policy() was historically documented as 42+enabling policy checking however the implementation has never done this. 43+The documentation was changed to align with the implementation. 44+ 45 =head1 COPYRIGHT 46 47 Copyright 2009-2023 The OpenSSL Project Authors. All Rights Reserved. 48-- 492.35.7 50 51