2024-02-03 19:21:26 by Adam Ciarcinski | Files touched by this commit (3) | |
Log message:
openssl: updated to 3.1.5
Changes between 3.1.4 and 3.1.5 [30 Jan 2024]
* A file in PKCS12 format can contain certificates and keys and may come from
an untrusted source. The PKCS12 specification allows certain fields to be
NULL, but OpenSSL did not correctly check for this case. A fix has been
applied to prevent a NULL pointer dereference that results in OpenSSL
crashing. If an application processes PKCS12 files from an untrusted source
using the OpenSSL APIs then that application will be vulnerable to this
issue prior to this fix.
OpenSSL APIs that were vulnerable to this are: PKCS12_parse(),
PKCS12_unpack_p7data(), PKCS12_unpack_p7encdata(), PKCS12_unpack_authsafes()
and PKCS12_newpass().
We have also fixed a similar issue in SMIME_write_PKCS7(). However since this
function is related to writing data we do not consider it security
significant.
([CVE-2024-0727])
|
2024-01-13 21:07:34 by Taylor R Campbell | Files touched by this commit (24) |
Log message:
*/builtin.mk: Use ${_CROSS_DESTDIR:U} for build-time file checks.
These are questions about the target system, whose files at
build-time are all relative to ${_CROSS_DESTDIR} if it is defined,
i.e., if USE_CROSS_COMPILE is set to yes.
No change to native builds because ${_CROSS_DESTDIR:U} is empty in
them. (Possible minor change by adding :Q to ${H_FOO} in command
lines, but if this makes a difference it likely fixes problems.)
|
2023-12-27 16:55:58 by S.P.Zeidler | Files touched by this commit (2) |
Log message:
openssl: fix configure for NetBSD/i386
|
2023-12-27 15:41:31 by Amitai Schleier | Files touched by this commit (1) |
Log message:
openssl: on NetBSD arches without atomic 64-bit ops, use builtin fallbacks.
Fixes these errors on NetBSD/macppc (and presumably the other listed platforms):
ld: ./libcrypto.so: undefined reference to `__atomic_load_8'
ld: ./libcrypto.so: undefined reference to `__atomic_fetch_or_8'
ld: ./libcrypto.so: undefined reference to `__atomic_is_lock_free'
(suggested by riastradh@)
|
2023-11-05 20:37:20 by Nia Alarie | Files touched by this commit (1) |
Log message:
openssl: Fix building on Mac OS X Tiger.
|
2023-10-27 20:30:12 by Jonathan Perkin | Files touched by this commit (4) |
Log message:
openssl: Various install fixes and improvements.
|
2023-10-25 00:11:51 by Thomas Klausner | Files touched by this commit (2298) |
Log message:
*: bump for openssl 3
|
2023-10-24 23:30:35 by Thomas Klausner | Files touched by this commit (8) | |
Log message:
openssl: update to 3.1.4
This is the latest version of the currently newest supported branch.
The 1.1.x branch was de-supported in September.
Based on wip/openssl3 by gdt, tnn, and myself.
|
2023-09-16 04:54:58 by Adam Ciarcinski | Files touched by this commit (2) | |
Log message:
openssl: updated to 1.1.1w
Changes between 1.1.1v and 1.1.1w [11 Sep 2023]
*) Fix POLY1305 MAC implementation corrupting XMM registers on Windows.
The POLY1305 MAC (message authentication code) implementation in OpenSSL
does not save the contents of non-volatile XMM registers on Windows 64
platform when calculating the MAC of data larger than 64 bytes. Before
returning to the caller all the XMM registers are set to zero rather than
restoring their previous content. The vulnerable code is used only on newer
x86_64 processors supporting the AVX512-IFMA instructions.
The consequences of this kind of internal application state corruption can
be various - from no consequences, if the calling application does not
depend on the contents of non-volatile XMM registers at all, to the worst
consequences, where the attacker could get complete control of the
application process. However given the contents of the registers are just
zeroized so the attacker cannot put arbitrary values inside, the most likely
consequence, if any, would be an incorrect result of some application
dependent calculations or a crash leading to a denial of service.
(CVE-2023-4807)
[Bernd Edlinger]
Changes between 1.1.1u and 1.1.1v [1 Aug 2023]
*) Fix excessive time spent checking DH q parameter value.
The function DH_check() performs various checks on DH parameters. After
fixing CVE-2023-3446 it was discovered that a large q parameter value can
also trigger an overly long computation during some of these checks.
A correct q value, if present, cannot be larger than the modulus p
parameter, thus it is unnecessary to perform these checks if q is larger
than p.
If DH_check() is called with such q parameter value,
DH_CHECK_INVALID_Q_VALUE return flag is set and the computationally
intensive checks are skipped.
(CVE-2023-3817)
[Tomáš Mráz]
|
2023-06-27 12:46:51 by Taylor R Campbell | Files touched by this commit (1) |
Log message:
security/openssl: Make this cross-compile.
|