Re: Security issues with openssl.exe

> Dear Sir or Madam,
>
> in our company we currently use GIT for programming tasks. Furthermore
> we use a VPN to connect to the company network.
>
> This VPN now prevents this connection due to a security problem with
> the "openssl.exe" in the GIT installation folder:
> - C:\Program Files\Git\mingw64\bin\openssl.exe
>
> Description-Text: In order to decrypt SM2 encrypted data an
> application is expected to call the API function EVP_PKEY_decrypt().
> Typically an application will call this function twice. The first
> time, on entry, the \"out\" parameter can be NULL and, on exit, the
> \"outlen\" parameter is populated with the buffer size required to
> hold the decrypted plaintext. The application can then allocate a
> sufficiently sized buffer and call EVP_PKEY_decrypt() again, but this
> time passing a non-NULL value for the \"out\" parameter. A bug in the
> implementation of the SM2 decryption code means that the calculation
> of the buffer size required to hold the plaintext returned by the
> first call to EVP_PKEY_decrypt() can be smaller than the actual size
> required by the second call. This can lead to a buffer overflow when
> EVP_PKEY_decrypt() is called by the application a second time with a
> buffer that is too small. A malicious attacker who is able present SM2
> content for decryption to an application could cause attacker chosen
> data to overflow the buffer by up to a maximum of 62 bytes altering
> the contents of other data held after the buffer, possibly changing
> application behaviour or causing the application to crash. The
> location of the buffer is application dependent but is typically heap
> allocated. Fixed in OpenSSL 1.1.1l (Affected 1.1.1-1.1.1k).
>
> Could you please provide a new Git version with an updated openssl.exe
> to fix this security issues?