diff --git a/secadv/20260313.txt b/secadv/20260313.txt new file mode 100644 index 0000000..09277c7 --- /dev/null +++ b/secadv/20260313.txt @@ -0,0 +1,80 @@ +OpenSSL Security Advisory [13th March 2026] +=========================================== + +OpenSSL TLS 1.3 server may choose unexpected key agreement group (CVE-2026-2673) +================================================================================ + +Severity: Low + +Issue summary: An OpenSSL TLS 1.3 server may fail to negotiate the expected +preferred key exchange group when its key exchange group configuration includes +the default by using the "DEFAULT" keyword. + +Impact summary: A less preferred key exchange may be used even when a more +preferred group is supported by both client and server, if the group +was not included among the client's initial predicated keyshares. +This will sometimes be the case with the new hybrid post-quantum groups, +if the client chooses to defer their use until specifically requested by +the server. + +If an OpenSSL TLS 1.3 server's configuration uses the "DEFAULT" keyword to +interpolate the built-in default group list into its own configuration, perhaps +adding or removing specific elements, then an implementation defect causes the +"DEFAULT" list to lose its "tuple" structure, and all server-supported groups +were treated as a single sufficiently secure "tuple", with the server not +sending a Hello Retry Request (HRR) even when a group in a more preferred tuple +was mutually supported. + +As a result, the client and server might fail to negotiate a mutually supported +post-quantum key agreement group, such as "X25519MLKEM768", if the client's +configuration results in only "classical" groups (such as "X25519" being the +only ones in the client's initial keyshare prediction). + +OpenSSL 3.5 and later support a new syntax for selecting the most preferred TLS +1.3 key agreement group on TLS servers. The old syntax had a single "flat" +list of groups, and treated all the supported groups as sufficiently secure. +If any of the keyshares predicted by the client were supported by the server +the most preferred among these was selected, even if other groups supported by +the client, but not included in the list of predicted keyshares would have been +more preferred, if included. + +The new syntax partitions the groups into distinct "tuples" of roughly +equivalent security. Within each tuple the most preferred group included among +the client's predicted keyshares is chosen, but if the client supports a group +from a more preferred tuple, but did not predict any corresponding keyshares, +the server will ask the client to retry the ClientHello (by issuing a Hello +Retry Request or HRR) with the most preferred mutually supported group. + +The above works as expected when the server's configuration uses the built-in +default group list, or explicitly defines its own list by directly defining the +various desired groups and group "tuples". + +No OpenSSL FIPS modules are affected by this issue, the code in question lies +outside the FIPS boundary. + +OpenSSL 3.6 and 3.5 are vulnerable to this issue. + +OpenSSL 3.6 users should upgrade to OpenSSL 3.6.2 once it is released. +OpenSSL 3.5 users should upgrade to OpenSSL 3.5.6 once it is released. + +OpenSSL 3.4, 3.3, 3.0, 1.0.2 and 1.1.1 are not affected by this issue. + +Due to the low severity of this issue we are not issuing new releases of +OpenSSL at this time. The fix will be included in the next release of 3.6 +and 3.5 branches, once it becomes available. The fix is also available in commit +2157c9d8 (for 3.6) and commit 85977e01 (for 3.5) in the OpenSSL git repository. + +This issue was internally reported on the 16th of February 2026 by Viktor +Dukhovni. The fix was developed by Viktor Dukhovni. + +General Advisory Notes +====================== + +URL for this Security Advisory: +https://openssl-library.org/news/secadv/20260313.txt + +Note: the online version of the advisory may be updated with additional details +over time. + +For details of OpenSSL severity classifications please see: +https://openssl-library.org/policies/general/security-policy/ diff --git a/secjson/CVE-2026-2673.json b/secjson/CVE-2026-2673.json new file mode 100644 index 0000000..66d38c1 --- /dev/null +++ b/secjson/CVE-2026-2673.json @@ -0,0 +1,119 @@ +{ + "containers": { + "cna": { + "affected": [ + { + "defaultStatus": "unaffected", + "product": "OpenSSL", + "vendor": "OpenSSL", + "versions": [ + { + "lessThan": "3.6.2", + "status": "affected", + "version": "3.6.0", + "versionType": "semver" + }, + { + "lessThan": "3.5.6", + "status": "affected", + "version": "3.5.0", + "versionType": "semver" + } + ] + } + ], + "credits": [ + { + "lang": "en", + "type": "reporter", + "value": "Viktor Dukhovni" + }, + { + "lang": "en", + "type": "remediation developer", + "value": "Viktor Dukhovni" + } + ], + "datePublic": "2026-03-13T14:00:00.000Z", + "descriptions": [ + { + "lang": "en", + "supportingMedia": [ + { + "base64": false, + "type": "text/html", + "value": "Issue summary: An OpenSSL TLS 1.3 server may fail to negotiate the expected
preferred key exchange group when its key exchange group configuration includes
the default by using the 'DEFAULT' keyword.

Impact summary: A less preferred key exchange may be used even when a more
preferred group is supported by both client and server, if the group
was not included among the client's initial predicated keyshares.
This will sometimes be the case with the new hybrid post-quantum groups,
if the client chooses to defer their use until specifically requested by
the server.

If an OpenSSL TLS 1.3 server's configuration uses the 'DEFAULT' keyword to
interpolate the built-in default group list into its own configuration, perhaps
adding or removing specific elements, then an implementation defect causes the
'DEFAULT' list to lose its 'tuple' structure, and all server-supported groups
were treated as a single sufficiently secure 'tuple', with the server not
sending a Hello Retry Request (HRR) even when a group in a more preferred tuple
was mutually supported.

As a result, the client and server might fail to negotiate a mutually supported
post-quantum key agreement group, such as 'X25519MLKEM768', if the client's
configuration results in only 'classical' groups (such as 'X25519' being the
only ones in the client's initial keyshare prediction).

OpenSSL 3.5 and later support a new syntax for selecting the most preferred TLS
1.3 key agreement group on TLS servers. The old syntax had a single 'flat'
list of groups, and treated all the supported groups as sufficiently secure.
If any of the keyshares predicted by the client were supported by the server
the most preferred among these was selected, even if other groups supported by
the client, but not included in the list of predicted keyshares would have been
more preferred, if included.

The new syntax partitions the groups into distinct 'tuples' of roughly
equivalent security. Within each tuple the most preferred group included among
the client's predicted keyshares is chosen, but if the client supports a group
from a more preferred tuple, but did not predict any corresponding keyshares,
the server will ask the client to retry the ClientHello (by issuing a Hello
Retry Request or HRR) with the most preferred mutually supported group.

The above works as expected when the server's configuration uses the built-in
default group list, or explicitly defines its own list by directly defining the
various desired groups and group 'tuples'.

No OpenSSL FIPS modules are affected by this issue, the code in question lies
outside the FIPS boundary.

OpenSSL 3.6 and 3.5 are vulnerable to this issue.

OpenSSL 3.6 users should upgrade to OpenSSL 3.6.2 once it is released.
OpenSSL 3.5 users should upgrade to OpenSSL 3.5.6 once it is released.

OpenSSL 3.4, 3.3, 3.0, 1.0.2 and 1.1.1 are not affected by this issue." + } + ], + "value": "Issue summary: An OpenSSL TLS 1.3 server may fail to negotiate the expected\npreferred key exchange group when its key exchange group configuration includes\nthe default by using the 'DEFAULT' keyword.\n\nImpact summary: A less preferred key exchange may be used even when a more\npreferred group is supported by both client and server, if the group\nwas not included among the client's initial predicated keyshares.\nThis will sometimes be the case with the new hybrid post-quantum groups,\nif the client chooses to defer their use until specifically requested by\nthe server.\n\nIf an OpenSSL TLS 1.3 server's configuration uses the 'DEFAULT' keyword to\ninterpolate the built-in default group list into its own configuration, perhaps\nadding or removing specific elements, then an implementation defect causes the\n'DEFAULT' list to lose its 'tuple' structure, and all server-supported groups\nwere treated as a single sufficiently secure 'tuple', with the server not\nsending a Hello Retry Request (HRR) even when a group in a more preferred tuple\nwas mutually supported.\n\nAs a result, the client and server might fail to negotiate a mutually supported\npost-quantum key agreement group, such as 'X25519MLKEM768', if the client's\nconfiguration results in only 'classical' groups (such as 'X25519' being the\nonly ones in the client's initial keyshare prediction).\n\nOpenSSL 3.5 and later support a new syntax for selecting the most preferred TLS\n1.3 key agreement group on TLS servers. The old syntax had a single 'flat'\nlist of groups, and treated all the supported groups as sufficiently secure.\nIf any of the keyshares predicted by the client were supported by the server\nthe most preferred among these was selected, even if other groups supported by\nthe client, but not included in the list of predicted keyshares would have been\nmore preferred, if included.\n\nThe new syntax partitions the groups into distinct 'tuples' of roughly\nequivalent security. Within each tuple the most preferred group included among\nthe client's predicted keyshares is chosen, but if the client supports a group\nfrom a more preferred tuple, but did not predict any corresponding keyshares,\nthe server will ask the client to retry the ClientHello (by issuing a Hello\nRetry Request or HRR) with the most preferred mutually supported group.\n\nThe above works as expected when the server's configuration uses the built-in\ndefault group list, or explicitly defines its own list by directly defining the\nvarious desired groups and group 'tuples'.\n\nNo OpenSSL FIPS modules are affected by this issue, the code in question lies\noutside the FIPS boundary.\n\nOpenSSL 3.6 and 3.5 are vulnerable to this issue.\n\nOpenSSL 3.6 users should upgrade to OpenSSL 3.6.2 once it is released.\nOpenSSL 3.5 users should upgrade to OpenSSL 3.5.6 once it is released.\n\nOpenSSL 3.4, 3.3, 3.0, 1.0.2 and 1.1.1 are not affected by this issue." + } + ], + "metrics": [ + { + "format": "other", + "other": { + "content": { + "text": "Low" + }, + "type": "https://openssl-library.org/policies/general/security-policy/" + } + } + ], + "problemTypes": [ + { + "descriptions": [ + { + "cweId": "CWE-757", + "description": "CWE-757 Selection of Less-Secure Algorithm During Negotiation ('Algorithm Downgrade')", + "lang": "en", + "type": "CWE" + } + ] + } + ], + "providerMetadata": { + "orgId": "00000000-0000-4000-9000-000000000000", + "shortName": "openssl" + }, + "references": [ + { + "name": "OpenSSL Advisory", + "tags": [ + "vendor-advisory" + ], + "url": "https://openssl-library.org/news/secadv/20260313.txt" + }, + { + "name": "3.6.2 git commit", + "tags": [ + "patch" + ], + "url": "https://github.com/openssl/openssl/commit/2157c9d81f7b0bd7dfa25b960e928ec28e8dd63f" + }, + { + "name": "3.5.6 git commit", + "tags": [ + "patch" + ], + "url": "https://github.com/openssl/openssl/commit/85977e013f32ceb96aa034c0e741adddc1a05e34" + } + ], + "source": { + "discovery": "UNKNOWN" + }, + "title": "OpenSSL TLS 1.3 server may choose unexpected key agreement group", + "x_generator": { + "engine": "Vulnogram 0.2.0" + } + } + }, + "cveMetadata": { + "assignerOrgId": "00000000-0000-4000-9000-000000000000", + "cveId": "CVE-2026-2673", + "requesterUserId": "00000000-0000-4000-9000-000000000000", + "serial": 1, + "state": "PUBLISHED" + }, + "dataType": "CVE_RECORD", + "dataVersion": "5.1" +}