{"push_id":989950587,"size":1,"distinct_size":1,"ref":"refs/heads/OpenSSL_1_0_2-stable","head":"c436c990f68938fdda1f2bd703bf0cd8dbfa49d2","before":"f78baa9d715a00cb691c3c74791308fb131a833c","commits":[{"sha":"c436c990f68938fdda1f2bd703bf0cd8dbfa49d2","author":{"email":"b460d66aaf00c296a3db1c1d9eeafc081d5f7d70@intel.com","name":"David Woodhouse"},"message":"RT4175: Fix PKCS7_verify() regression with Authenticode signatures\n\nThis is a partial revert of commit c8491de39 (\"GH354: Memory leak fixes\"),\nwhich was cherry-picked from commit 55500ea7c in OpenSSL 1.1.\n\nThat commit introduced a change in behaviour which is a regression for\nsoftware implementing Microsoft Authenticode — which requires a PKCS#7\nsignature to be validated against explicit external data, even though\nit's a non-detached signature with its own embedded data.\n\nThe is fixed differently in OpenSSL 1.1 by commit 6b2ebe433 (\"Add\nPKCS7_NO_DUAL_CONTENT flag\"), but that approach isn't viable in the\n1.0.2 stable branch, so just comment the offending check back out again.\n\nSigned-off-by: Rich Salz <rsalz@openssl.org>\nReviewed-by: Tim Hudson <tjh@openssl.org>","distinct":true,"url":"https://api.github.com/repos/rhuijben/openssl/commits/c436c990f68938fdda1f2bd703bf0cd8dbfa49d2"}]}