diff options
author | tnn <tnn> | 2009-01-08 16:38:22 +0000 |
---|---|---|
committer | tnn <tnn> | 2009-01-08 16:38:22 +0000 |
commit | 598de131b79bd4b44dc5f73543e133407b597f2c (patch) | |
tree | 4454a491235e8d0d98ac1f83d4fd0b4c51243b04 /security | |
parent | 416ca3fa1127fc08acf3a3dba646c351081edd32 (diff) | |
download | pkgsrc-598de131b79bd4b44dc5f73543e133407b597f2c.tar.gz |
Update to openssl-0.9.8j. Fixes CVE-2008-5077.
Changes between 0.9.8i and 0.9.8j [07 Jan 2009]
*) Properly check EVP_VerifyFinal() and similar return values
(CVE-2008-5077).
*) Allow the CHIL engine to be loaded, whether the application is
multithreaded or not. (This does not release the developer from the
obligation to set up the dynamic locking callbacks.)
*) Use correct exit code if there is an error in dgst command.
*) Tweak Configure so that you need to say "experimental-jpake" to enable
JPAKE, and need to use -DOPENSSL_EXPERIMENTAL_JPAKE in applications.
*) Add experimental JPAKE support, including demo authentication in
s_client and s_server.
*) Set the comparison function in v3_addr_canonize().
*) Add support for XMPP STARTTLS in s_client.
*) Change the server-side SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG behavior
to ensure that even with this option, only ciphersuites in the
server's preference list will be accepted. (Note that the option
applies only when resuming a session, so the earlier behavior was
just about the algorithm choice for symmetric cryptography.)
Changes between 0.9.8h and 0.9.8i [15 Sep 2008]
*) Fix a state transitition in s3_srvr.c and d1_srvr.c
(was using SSL3_ST_CW_CLNT_HELLO_B, should be ..._ST_SW_SRVR_...).
*) The fix in 0.9.8c that supposedly got rid of unsafe
double-checked locking was incomplete for RSA blinding,
addressing just one layer of what turns out to have been
doubly unsafe triple-checked locking.
So now fix this for real by retiring the MONT_HELPER macro
in crypto/rsa/rsa_eay.c.
*) Various precautionary measures:
- Avoid size_t integer overflow in HASH_UPDATE (md32_common.h).
- Avoid a buffer overflow in d2i_SSL_SESSION() (ssl_asn1.c).
(NB: This would require knowledge of the secret session ticket key
to exploit, in which case you'd be SOL either way.)
- Change bn_nist.c so that it will properly handle input BIGNUMs
outside the expected range.
- Enforce the 'num' check in BN_div() (bn_div.c) for non-BN_DEBUG
builds.
*) Allow engines to be "soft loaded" - i.e. optionally don't die if
the load fails. Useful for distros.
*) Add support for Local Machine Keyset attribute in PKCS#12 files.
*) Fix BN_GF2m_mod_arr() top-bit cleanup code.
*) Expand ENGINE to support engine supplied SSL client certificate functions.
This work was sponsored by Logica.
*) Add CryptoAPI ENGINE to support use of RSA and DSA keys held in Windows
keystores. Support for SSL/TLS client authentication too.
Not compiled unless enable-capieng specified to Configure.
This work was sponsored by Logica.
*) Fix bug in X509_ATTRIBUTE creation: dont set attribute using
ASN1_TYPE_set1 if MBSTRING flag set. This bug would crash certain
attribute creation routines such as certifcate requests and PKCS#12
files.
Diffstat (limited to 'security')
-rw-r--r-- | security/openssl/Makefile | 7 | ||||
-rw-r--r-- | security/openssl/PLIST.common | 3 | ||||
-rw-r--r-- | security/openssl/distinfo | 12 | ||||
-rw-r--r-- | security/openssl/patches/patch-af | 31 | ||||
-rw-r--r-- | security/openssl/patches/patch-am | 22 |
5 files changed, 43 insertions, 32 deletions
diff --git a/security/openssl/Makefile b/security/openssl/Makefile index 8d73800c698..16e46c0c0f4 100644 --- a/security/openssl/Makefile +++ b/security/openssl/Makefile @@ -1,9 +1,8 @@ -# $NetBSD: Makefile,v 1.136 2008/10/25 12:03:35 adrianp Exp $ +# $NetBSD: Makefile,v 1.137 2009/01/08 16:38:22 tnn Exp $ OPENSSL_SNAPSHOT?= # empty OPENSSL_STABLE?= # empty -OPENSSL_VERS?= 0.9.8h -PKGREVISION= 2 +OPENSSL_VERS?= 0.9.8j .if empty(OPENSSL_SNAPSHOT) DISTNAME= openssl-${OPENSSL_VERS} @@ -50,7 +49,7 @@ CONFIGURE_SCRIPT= ./config CONFIGURE_ARGS+= --prefix=${PREFIX:Q} CONFIGURE_ARGS+= --install_prefix=${DESTDIR} CONFIGURE_ARGS+= --openssldir=${PKG_SYSCONFDIR:Q} -CONFIGURE_ARGS+= shared threads +CONFIGURE_ARGS+= shared threads no-fips .if ${OPSYS} == "SunOS" . if ${MACHINE_ARCH} == "sparc" diff --git a/security/openssl/PLIST.common b/security/openssl/PLIST.common index 6cf4171b92d..10cfd0c1573 100644 --- a/security/openssl/PLIST.common +++ b/security/openssl/PLIST.common @@ -1,4 +1,4 @@ -@comment $NetBSD: PLIST.common,v 1.13 2008/04/12 22:43:12 jlam Exp $ +@comment $NetBSD: PLIST.common,v 1.14 2009/01/08 16:38:22 tnn Exp $ bin/c_rehash bin/openssl include/openssl/aes.h @@ -75,6 +75,7 @@ include/openssl/x509v3.h lib/engines/lib4758cca.so lib/engines/libaep.so lib/engines/libatalla.so +lib/engines/libcapi.so lib/engines/libchil.so lib/engines/libcswift.so lib/engines/libgmp.so diff --git a/security/openssl/distinfo b/security/openssl/distinfo index 2522b8bfa03..e694845d690 100644 --- a/security/openssl/distinfo +++ b/security/openssl/distinfo @@ -1,14 +1,14 @@ -$NetBSD: distinfo,v 1.64 2008/10/25 12:03:35 adrianp Exp $ +$NetBSD: distinfo,v 1.65 2009/01/08 16:38:22 tnn Exp $ -SHA1 (openssl-0.9.8h.tar.gz) = ced4f2da24a202e01ea22bef30ebc8aee274de86 -RMD160 (openssl-0.9.8h.tar.gz) = 676337da20c3fc3fc4001a79c6d28589cba719cd -Size (openssl-0.9.8h.tar.gz) = 3439981 bytes +SHA1 (openssl-0.9.8j.tar.gz) = f70f7127a26e951e8a0d854c0c9e6b4c24df78e4 +RMD160 (openssl-0.9.8j.tar.gz) = d60417e0fd943fbffc6dae8391a21dcf5d97e967 +Size (openssl-0.9.8j.tar.gz) = 3738359 bytes SHA1 (patch-aa) = b28ec662bf0586e31d59cab45e3a28b91b10dac1 SHA1 (patch-ac) = a766699f2d007b70689bbad538ede07ded7b34ff SHA1 (patch-ad) = bb86ac463fc4ab8b485df5f1a4fb9c13c1fc41c3 SHA1 (patch-ae) = 7a58f1765a3761321dcc8dafc5fe2e33207be480 -SHA1 (patch-af) = 3c1a88329b1a1c54bdd4624ceaf723af3749ec32 +SHA1 (patch-af) = 1eda5a96835b65d325c77ce5d39f1e524815a3c7 SHA1 (patch-ag) = 5f12c72b85e4b6c6a79dfcf87055e9e029fbd8c8 SHA1 (patch-ak) = 049250b9bd42e6f155145703135dab39a7ec17e0 SHA1 (patch-al) = 076a606352bdeaeea1cc64f16be2ac1325882302 -SHA1 (patch-am) = a2ba07bf35d53b096b3524b2d10ae26eef755da0 +SHA1 (patch-am) = 72d9d776878fc4908c40aacbe4d79ba3edd0a584 diff --git a/security/openssl/patches/patch-af b/security/openssl/patches/patch-af index f6b1053d23d..ebae02aac9d 100644 --- a/security/openssl/patches/patch-af +++ b/security/openssl/patches/patch-af @@ -1,7 +1,7 @@ -$NetBSD: patch-af,v 1.21 2008/01/17 06:42:48 tnn Exp $ +$NetBSD: patch-af,v 1.22 2009/01/08 16:38:22 tnn Exp $ ---- Makefile.org.orig 2007-04-24 01:49:54.000000000 +0200 -+++ Makefile.org 2007-10-28 12:44:05.000000000 +0100 +--- Makefile.org.orig 2008-12-30 14:26:26.000000000 +0100 ++++ Makefile.org @@ -28,6 +28,7 @@ INSTALLTOP=/usr/local/ssl # Do not edit this manually. Use Configure --openssldir=DIR do change this! @@ -10,7 +10,18 @@ $NetBSD: patch-af,v 1.21 2008/01/17 06:42:48 tnn Exp $ # NO_IDEA - Define to build without the IDEA algorithm # NO_RC4 - Define to build without the RC4 algorithm -@@ -125,7 +126,7 @@ TESTS = alltests +@@ -131,8 +132,8 @@ FIPSCANLIB= + + BASEADDR= + +-DIRS= crypto fips ssl engines apps test tools +-SHLIBDIRS= crypto ssl fips ++DIRS= crypto ssl engines apps test tools # fips ++SHLIBDIRS= crypto ssl # fips + + # dirs in crypto to build + SDIRS= \ +@@ -152,7 +153,7 @@ TESTS = alltests MAKEFILE= Makefile @@ -19,15 +30,15 @@ $NetBSD: patch-af,v 1.21 2008/01/17 06:42:48 tnn Exp $ MAN1=1 MAN3=3 MANSUFFIX= -@@ -140,6 +141,7 @@ SHARED_CRYPTO=libcrypto$(SHLIB_EXT) - SHARED_SSL=libssl$(SHLIB_EXT) +@@ -168,6 +169,7 @@ SHARED_SSL=libssl$(SHLIB_EXT) + SHARED_FIPS= SHARED_LIBS= SHARED_LIBS_LINK_EXTS= +LIBRPATH=$(INSTALLTOP)/lib SHARED_LDFLAGS= GENERAL= Makefile -@@ -172,7 +174,7 @@ BUILDENV= PLATFORM='${PLATFORM}' PROCESS +@@ -200,7 +202,7 @@ BUILDENV= PLATFORM='${PLATFORM}' PROCESS CC='${CC}' CFLAG='${CFLAG}' \ AS='${CC}' ASFLAG='${CFLAG} -c' \ AR='${AR}' PERL='${PERL}' RANLIB='${RANLIB}' \ @@ -36,7 +47,7 @@ $NetBSD: patch-af,v 1.21 2008/01/17 06:42:48 tnn Exp $ INSTALL_PREFIX='${INSTALL_PREFIX}' \ INSTALLTOP='${INSTALLTOP}' OPENSSLDIR='${OPENSSLDIR}' \ MAKEDEPEND='$$$${TOP}/util/domd $$$${TOP} -MD ${MAKEDEPPROG}' \ -@@ -473,7 +475,7 @@ dist: +@@ -608,7 +610,7 @@ dist: dist_pem_h: (cd crypto/pem; $(MAKE) -e $(BUILDENV) pem.h; $(MAKE) clean) @@ -45,7 +56,7 @@ $NetBSD: patch-af,v 1.21 2008/01/17 06:42:48 tnn Exp $ install_sw: @$(PERL) $(TOP)/util/mkdir-p.pl $(INSTALL_PREFIX)$(INSTALLTOP)/bin \ -@@ -481,9 +483,7 @@ install_sw: +@@ -616,9 +618,7 @@ install_sw: $(INSTALL_PREFIX)$(INSTALLTOP)/lib/engines \ $(INSTALL_PREFIX)$(INSTALLTOP)/lib/pkgconfig \ $(INSTALL_PREFIX)$(INSTALLTOP)/include/openssl \ @@ -56,7 +67,7 @@ $NetBSD: patch-af,v 1.21 2008/01/17 06:42:48 tnn Exp $ @set -e; headerlist="$(EXHEADER)"; for i in $$headerlist;\ do \ (cp $$i $(INSTALL_PREFIX)$(INSTALLTOP)/include/openssl/$$i; \ -@@ -553,35 +553,53 @@ install_docs: +@@ -688,35 +688,53 @@ install_docs: set -e; for i in doc/apps/*.pod; do \ fn=`basename $$i .pod`; \ sec=`$(PERL) util/extract-section.pl 1 < $$i`; \ diff --git a/security/openssl/patches/patch-am b/security/openssl/patches/patch-am index c34822b608f..b1a763cadbb 100644 --- a/security/openssl/patches/patch-am +++ b/security/openssl/patches/patch-am @@ -1,13 +1,13 @@ -$NetBSD: patch-am,v 1.5 2008/10/25 12:04:34 adrianp Exp $ +$NetBSD: patch-am,v 1.6 2009/01/08 16:38:22 tnn Exp $ ---- crypto/x509/x509_att.c.orig 2008-04-02 12:11:51.000000000 +0100 -+++ crypto/x509/x509_att.c -@@ -303,7 +303,7 @@ int X509_ATTRIBUTE_set1_data(X509_ATTRIB - } - if(!(attr->value.set = sk_ASN1_TYPE_new_null())) goto err; - if(!(ttmp = ASN1_TYPE_new())) goto err; -- if (len == -1) -+ if ((len == -1) && !(attrtype & MBSTRING_FLAG)) +--- crypto/evp/enc_min.c.orig 2008-12-02 19:14:44.000000000 +0100 ++++ crypto/evp/enc_min.c +@@ -199,7 +199,7 @@ int EVP_CipherInit_ex(EVP_CIPHER_CTX *ct + enc = 1; + ctx->encrypt = enc; + } +-#ifdef OPENSSL_NO_FIPS ++#if 0 /* def OPENSSL_NO_FIPS */ + if(FIPS_selftest_failed()) { - if (!ASN1_TYPE_set1(ttmp, attrtype, data)) - goto err; + FIPSerr(FIPS_F_EVP_CIPHERINIT_EX,FIPS_R_FIPS_SELFTEST_FAILED); |