Subject: CVS commit: pkgsrc/security/openssl
From: Thomas Klausner
Date: 2018-03-29 13:08:44
Message id: 20180329110844.41ACDFB40@cvs.NetBSD.org

Log Message:
openssl: update to 1.0.2o.

 Changes between 1.0.2n and 1.0.2o [27 Mar 2018]

  *) Constructed ASN.1 types with a recursive definition could exceed the stack

     Constructed ASN.1 types with a recursive definition (such as can be found
     in PKCS7) could eventually exceed the stack given malicious input with
     excessive recursion. This could result in a Denial Of Service attack. There
     are no such structures used within SSL/TLS that come from untrusted sources
     so this is considered safe.

     This issue was reported to OpenSSL on 4th January 2018 by the OSS-fuzz
     project.
     (CVE-2018-0739)
     [Matt Caswell]

Files:
RevisionActionfile
1.238modifypkgsrc/security/openssl/Makefile
1.132modifypkgsrc/security/openssl/distinfo