Update dependency openssl/openssl to v3.1.3

[renovate]

This PR contains the following updates:

Package	Update	Change
openssl/openssl	patch	3.1.1 -> 3.1.3

---

Release Notes

openssl/openssl (openssl/openssl)

v3.1.3

Compare Source

• Fix POLY1305 MAC implementation corrupting XMM registers on Windows.

  The POLY1305 MAC (message authentication code) implementation in OpenSSL
  does not save the contents of non-volatile XMM registers on Windows 64
  platform when calculating the MAC of data larger than 64 bytes. Before
  returning to the caller all the XMM registers are set to zero rather than
  restoring their previous content. The vulnerable code is used only on newer
  x86_64 processors supporting the AVX512-IFMA instructions.

  The consequences of this kind of internal application state corruption can
  be various - from no consequences, if the calling application does not
  depend on the contents of non-volatile XMM registers at all, to the worst
  consequences, where the attacker could get complete control of the
  application process. However given the contents of the registers are just
  zeroized so the attacker cannot put arbitrary values inside, the most likely
  consequence, if any, would be an incorrect result of some application
  dependent calculations or a crash leading to a denial of service.

  ([CVE-2023-4807])

  Bernd Edlinger

v3.1.2

Compare Source

• Fix POLY1305 MAC implementation corrupting XMM registers on Windows.

  The POLY1305 MAC (message authentication code) implementation in OpenSSL
  does not save the contents of non-volatile XMM registers on Windows 64
  platform when calculating the MAC of data larger than 64 bytes. Before
  returning to the caller all the XMM registers are set to zero rather than
  restoring their previous content. The vulnerable code is used only on newer
  x86_64 processors supporting the AVX512-IFMA instructions.

  The consequences of this kind of internal application state corruption can
  be various - from no consequences, if the calling application does not
  depend on the contents of non-volatile XMM registers at all, to the worst
  consequences, where the attacker could get complete control of the
  application process. However given the contents of the registers are just
  zeroized so the attacker cannot put arbitrary values inside, the most likely
  consequence, if any, would be an incorrect result of some application
  dependent calculations or a crash leading to a denial of service.

  ([CVE-2023-4807])

  Bernd Edlinger

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - "before 2am" (UTC).

🚦 Automerge: Disabled because a matching PR was automerged previously.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate. View repository job log here.

[renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠ Warning: custom changes will be lost.