./security/openssl, Secure Socket Layer and cryptographic library

[ CVSweb ] [ Homepage ] [ RSS ] [ Required by ] [ Add to tracker ]


Branch: CURRENT, Version: 1.0.2p, Package name: openssl-1.0.2p, Maintainer: pkgsrc-users

The OpenSSL Project is a collaborative effort to develop a
robust, commercial-grade, full-featured, and Open Source
toolkit implementing the Secure Sockets Layer (SSL v2/v3)
and Transport Layer Security (TLS v1) protocols as well as
a full-strength general purpose cryptography library. The
project is managed by a worldwide community of volunteers
that use the Internet to communicate, plan, and develop the
OpenSSL toolkit and its related documentation.

MESSAGE.SunOS [+/-]

Required to run:
[lang/perl5]

Required to build:
[devel/p5-Perl4-CoreLibs] [pkgtools/cwrappers]

Package options: idea, md2, mdc2, threads

Master sites:

SHA1: f34b5322e92415755c7d58bf5d0d5cf37666382c
RMD160: 0df40a7f180e381bff7d7d9593bdfece4b054951
Filesize: 5213.078 KB

Version history: (Expand)


CVS history: (Expand)


   2018-09-12 14:44:17 by Filip Hajny | Files touched by this commit (3) | Package updated
Log message:
security/openssl: Update to 1.0.2p.

- Client DoS due to large DH parameter

  During key agreement in a TLS handshake using a DH(E) based ciphersuite a
  malicious server can send a very large prime value to the client. This will
  cause the client to spend an unreasonably long period of time generating a
  key for this prime resulting in a hang until the client has finished. This
  could be exploited in a Denial Of Service attack.

  This issue was reported to OpenSSL on 5th June 2018 by Guido Vranken
  (CVE-2018-0732)
  [Guido Vranken]

- Cache timing vulnerability in RSA Key Generation

  The OpenSSL RSA Key generation algorithm has been shown to be vulnerable to
  a cache timing side channel attack. An attacker with sufficient access to
  mount cache timing attacks during the RSA key generation process could
  recover the private key.

  This issue was reported to OpenSSL on 4th April 2018 by Alejandro Cabrera
  Aldaya, Billy Brumley, Cesar Pereida Garcia and Luis Manuel Alvarez Tapia.
  (CVE-2018-0737)
  [Billy Brumley]

- Make EVP_PKEY_asn1_new() a bit stricter about its input.  A NULL pem_str
  parameter is no longer accepted, as it leads to a corrupt table.  NULL
  pem_str is reserved for alias entries only.
  [Richard Levitte]

- Revert blinding in ECDSA sign and instead make problematic addition
  length-invariant. Switch even to fixed-length Montgomery multiplication.
  [Andy Polyakov]

- Change generating and checking of primes so that the error rate of not
  being prime depends on the intended use based on the size of the input.
  For larger primes this will result in more rounds of Miller-Rabin.
  The maximal error rate for primes with more than 1080 bits is lowered
  to 2^-128.
  [Kurt Roeckx, Annie Yousar]

- Increase the number of Miller-Rabin rounds for DSA key generating to 64.
  [Kurt Roeckx]

- Add blinding to ECDSA and DSA signatures to protect against side channel
  attacks discovered by Keegan Ryan (NCC Group).
  [Matt Caswell]

- When unlocking a pass phrase protected PEM file or PKCS#8 container, we
  now allow empty (zero character) pass phrases.
  [Richard Levitte]

- Certificate time validation (X509_cmp_time) enforces stricter
  compliance with RFC 5280. Fractional seconds and timezone offsets
  are no longer allowed.
  [Emilia Käsper]
   2018-08-22 11:48:07 by Thomas Klausner | Files touched by this commit (3558)
Log message:
Recursive bump for perl5-5.28.0
   2018-03-29 13:08:44 by Thomas Klausner | Files touched by this commit (2) | Package updated
Log message:
openssl: update to 1.0.2o.

 Changes between 1.0.2n and 1.0.2o [27 Mar 2018]

  *) Constructed ASN.1 types with a recursive definition could exceed the stack

     Constructed ASN.1 types with a recursive definition (such as can be found
     in PKCS7) could eventually exceed the stack given malicious input with
     excessive recursion. This could result in a Denial Of Service attack. There
     are no such structures used within SSL/TLS that come from untrusted sources
     so this is considered safe.

     This issue was reported to OpenSSL on 4th January 2018 by the OSS-fuzz
     project.
     (CVE-2018-0739)
     [Matt Caswell]
   2018-01-16 10:48:46 by Jonathan Perkin | Files touched by this commit (2)
Log message:
openssl: Don't set LD_LIBRARY_PATH during build.
   2018-01-07 14:04:44 by Roland Illig | Files touched by this commit (583)
Log message:
Fix indentation in buildlink3.mk files.

The actual fix as been done by "pkglint -F */*/buildlink3.mk", and was
reviewed manually.

There are some .include lines that still are indented with zero spaces
although the surrounding .if is indented. This is existing practice.
   2018-01-02 06:37:24 by Maya Rashish | Files touched by this commit (25)
Log message:
Remove traces of crypto restrictions from packages.

ok for idea riastradh.
   2017-12-14 21:44:20 by Matthias Scheler | Files touched by this commit (1)
Log message:
openssl: Fix packaging under macOS

The last change for fixing packaging under macOS did not work when
the object directory resides on a case insensitive file-system.
   2017-12-14 10:18:47 by Jonathan Perkin | Files touched by this commit (2) | Package updated
Log message:
openssl: Avoid case-sensitive issue on Darwin.  Bump PKGREVISION.