diff options
| author | Matt Caswell <matt@openssl.org> | 2024-03-15 18:58:42 +0100 |
|---|---|---|
| committer | Tomas Mraz <tomas@openssl.org> | 2024-04-08 12:06:25 +0200 |
| commit | 21df7f04f6c4a560b4de56d10e1e58958c7e566d (patch) | |
| tree | d145109a73bf824bdba11c95860d2adf0bb969af /ssl/ssl_sess.c | |
| parent | Add a CHANGES.md/NEWS.md entry for the unbounded memory growth bug (diff) | |
| download | openssl-21df7f04f6c4a560b4de56d10e1e58958c7e566d.tar.xz openssl-21df7f04f6c4a560b4de56d10e1e58958c7e566d.zip | |
Hardening around not_resumable sessions
Make sure we can't inadvertently use a not_resumable session
Related to CVE-2024-2511
Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/24042)
Diffstat (limited to 'ssl/ssl_sess.c')
| -rw-r--r-- | ssl/ssl_sess.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/ssl/ssl_sess.c b/ssl/ssl_sess.c index 97830d2e6a..594256d0f1 100644 --- a/ssl/ssl_sess.c +++ b/ssl/ssl_sess.c @@ -519,6 +519,12 @@ SSL_SESSION *lookup_sess_in_cache(SSL_CONNECTION *s, sess_id, sess_id_len, ©); if (ret != NULL) { + if (ret->not_resumable) { + /* If its not resumable then ignore this session */ + if (!copy) + SSL_SESSION_free(ret); + return NULL; + } ssl_tsan_counter(s->session_ctx, &s->session_ctx->stats.sess_cb_hit); |