Path to this page:
Subject: CVS commit: pkgsrc/security/openssl
From: Thomas Klausner
Date: 2018-03-29 13:08:44
Message id: 20180329110844.41ACDFB40@cvs.NetBSD.org
Log Message:
openssl: update to 1.0.2o.
Changes between 1.0.2n and 1.0.2o [27 Mar 2018]
*) Constructed ASN.1 types with a recursive definition could exceed the stack
Constructed ASN.1 types with a recursive definition (such as can be found
in PKCS7) could eventually exceed the stack given malicious input with
excessive recursion. This could result in a Denial Of Service attack. There
are no such structures used within SSL/TLS that come from untrusted sources
so this is considered safe.
This issue was reported to OpenSSL on 4th January 2018 by the OSS-fuzz
project.
(CVE-2018-0739)
[Matt Caswell]
Files: