summaryrefslogtreecommitdiff
path: root/security/openssl
AgeCommit message (Collapse)AuthorFilesLines
2014-03-13Set USE_GCC_RUNTIME=yes for packages which build shared libraries but dojperkin1-1/+3
not use libtool to do so. This is required to correctly depend upon a gcc runtime package (e.g. gcc47-libs) when using USE_PKGSRC_GCC_RUNTIME.
2014-03-08Cygwin DLLs are handled automatically now.obache1-3/+0
2014-03-08Cygwin also has shlib.obache1-3/+1
2014-03-03adapt to Haiku R1alpha4obache1-2/+2
2014-02-22Fixes builtin detection with CHECK_BUILTIN.openssl=yes.obache1-1/+6
Define BUILTINK_API_DEPENDS.openssl same as buildlink3.mk if not defined yet for the case checking builtin (CHECK_BUILTIN.openssl==yes).
2014-02-12Undo undesired ABI version bump done by "blbump" script.tron1-2/+2
2014-02-12Set minimum required API version of OpenSSL to 1.0.1c:tron1-3/+3
1.) OpenSSL 0.9.8* doesn't support TLS 1.2, Elliptic curve cryptography and other modern TLS features. 2.) Supporting OpenSSL 0.9.8* causes extra maintenance overhead. As a result NetBSD 5.*, all versions of Mac OS X and possibly other platforms will now use OpenSSL from "pkgsrc".
2014-01-14Add support for MirBSD to OpenSSL.bsiegert2-11/+16
2014-01-10Update "openssl" package to version 1.0.1f. Changes since 1.0.1e:tron9-99/+69
- Fix for TLS record tampering bug. A carefully crafted invalid handshake could crash OpenSSL with a NULL pointer exception. Thanks to Anton Johansson for reporting this issues. (CVE-2013-4353) - Keep original DTLS digest and encryption contexts in retransmission structures so we can use the previous session parameters if they need to be resent. (CVE-2013-6450) [Steve Henson] - Add option SSL_OP_SAFARI_ECDHE_ECDSA_BUG (part of SSL_OP_ALL) which avoids preferring ECDHE-ECDSA ciphers when the client appears to be Safari on OS X. Safari on OS X 10.8..10.8.3 advertises support for several ECDHE-ECDSA ciphers, but fails to negotiate them. The bug is fixed in OS X 10.8.4, but Apple have ruled out both hot fixing 10.8..10.8.3 and forcing users to upgrade to 10.8.4 or newer. [Rob Stradling, Adam Langley]
2013-12-21The syntax of the Configure architecture table changed recently. Ouris2-17/+17
entries for NetbSD architectures without assembler routines and Interix containing ::::::... need to be updated, else -fPIC ends up in the object-to-build list of crypto/modes. The correct entry snippet is stored in ${no_asm}. make test has run successfully in pkgsrc-current and -2013Q3 on Shark (arm, asm-less) as well as i386 (with asm routines).
2013-11-23Use find-headers instead of find-files to detect builtin header files.obache1-8/+4
2013-10-29For Linux/POWERPC64 override the default target, otherwise bad thingsjoerg1-1/+6
happen (TM).
2013-10-06Change to create fake *.pc files much close to real one.obache1-16/+31
Fixes to detect its prefix with `pkg-config --variable=prefix", such as CMake.
2013-10-05Unbreak previous.jperkin1-1/+2
2013-10-03Don't mess with the normal PLIST.${OPSYS} logic. Use a variable tojoerg3-13/+10
control whether PLIST.shlib should be included or not.
2013-10-02Fix case.joerg2-3/+3
2013-10-02Cygwin specific shared libraries.joerg1-0/+3
2013-10-02Drop Windows specific parts to get results consistent with all otherjoerg2-5/+11
platforms for the man pages.
2013-08-27fix openssl builtin support, at least for solarisrichard1-4/+4
2013-07-26Bump PKGREVISION.ryoon5-24/+53
* For DragonFly, use its own condition. * Add Debian GNU/kFreeBSD support.
2013-06-13Allow absolute paths arguments for Configure (e.g. -isysroot /path)adam3-9/+26
2013-06-07require `fgrep' as a tool.obache1-2/+2
fixes build on Haiku, noticed by diger in pkgsrc-users@.
2013-06-01Fix openssl pod docs to work with the very picky pod2man from perl-5.18.0.sbd21-1/+412
2013-05-31Bump all packages for perl-5.18, thatwiz1-1/+2
a) refer 'perl' in their Makefile, or b) have a directory name of p5-*, or c) have any dependency on any p5-* package Like last time, where this caused no complaints.
2013-04-03prevent to reorder libcrypt and libcrypto for Cygwin,obache1-1/+3
it break to build openssl module for ruby193.
2013-02-13Oops, forgot to "cvs rm" an obsolete patch file.taca1-67/+0
Thanks to wiz@ noted via mail.
2013-02-13Update OpenSSL to 1.0.1e. ("Corrected fix" was already incorporated in pkgsrc.)taca2-8/+6
OpenSSL version 1.0.1e released =============================== OpenSSL - The Open Source toolkit for SSL/TLS http://www.openssl.org/ The OpenSSL project team is pleased to announce the release of version 1.0.1e of our open source toolkit for SSL/TLS. This new OpenSSL version is a new feature release. For a complete list of changes, please see http://www.openssl.org/source/exp/CHANGES. The most significant changes are: o Corrected fix for CVE-2013-0169
2013-02-08Fix NetBSD/amd64 build.jperkin2-4/+4
2013-02-08Apply upstream patch to fix data corruption.jperkin3-3/+71
Bump PKGREVISION.
2013-02-07Revert API depends change, not needed.wiz1-2/+2
Ok jperkin.
2013-02-07Reduce minium required OpenSSL version to 1.0.1c (instead of 1.0.1d) whichtron1-3/+3
is what NetBSD 6.0* ships with. The minimum ABI version was incorrect anyway and a result of an unnecessary revision bump of the "openssl" package.
2013-02-06PKGREVISION bumps for the security/openssl 1.0.1d update.jperkin2-3/+4
2013-02-06Update OpenSSL to 1.0.1d. Changes are far too numerous to list, the main ↵jperkin13-168/+250
one being that we can now take advantage of AES-NI support in modern processors to significantly increase performance. Miscellaneous pkgsrc changes: - Remove unnecessary warning message on Solaris. - Fix RPATH for libgost.so. - MD2 support is optional, enabled by default for compatability.
2013-02-05Update openssl to 0.9.8y.taca2-7/+6
Changes between 0.9.8x and 0.9.8y [5 Feb 2013] *) Make the decoding of SSLv3, TLS and DTLS CBC records constant time. This addresses the flaw in CBC record processing discovered by Nadhem Alfardan and Kenny Paterson. Details of this attack can be found at: http://www.isg.rhul.ac.uk/tls/ Thanks go to Nadhem Alfardan and Kenny Paterson of the Information Security Group at Royal Holloway, University of London (www.isg.rhul.ac.uk) for discovering this flaw and Adam Langley and Emilia Käsper for the initial patch. (CVE-2013-0169) [Emilia Käsper, Adam Langley, Ben Laurie, Andy Polyakov, Steve Henson] *) Return an error when checking OCSP signatures when key is NULL. This fixes a DoS attack. (CVE-2013-0166) [Steve Henson] *) Call OCSP Stapling callback after ciphersuite has been chosen, so the right response is stapled. Also change SSL_get_certificate() so it returns the certificate actually sent. See http://rt.openssl.org/Ticket/Display.html?id=2836. (This is a backport) [Rob Stradling <rob.stradling@comodo.com>] *) Fix possible deadlock when decoding public keys. [Steve Henson]
2013-02-01Fix the first master site.jperkin1-2/+2
2013-02-01Use LIBABISUFFIX when creating the .pc files to make builtin opensslhans1-7/+7
work on 64bit SunOS and possibly others.
2012-10-23Drop superfluous PKG_DESTDIR_SUPPORT, "user-destdir" is default these days.asau1-2/+1
2012-10-05Add build dependency on p5-Perl4-CoreLibs, needed since a scriptwiz1-1/+4
uses find.pl. Reported by Jörn Clausen in PR 47036.
2012-10-03Bump all packages that use perl, or depend on a p5-* package, orwiz1-1/+2
are called p5-*. I hope that's all of them.
2012-05-22Fix build on NetBSD/amd64, if the kernel was built on a host with 386 injoerg2-11/+9
its name.
2012-05-11Update openssl to 0.9.8x.taca2-6/+6
OpenSSL CHANGES _______________ Changes between 0.9.8w and 0.9.8x [10 May 2012] *) Sanity check record length before skipping explicit IV in DTLS to fix DoS attack. Thanks to Codenomicon for discovering this issue using Fuzz-o-Matic fuzzing as a service testing platform. (CVE-2012-2333) [Steve Henson] *) Initialise tkeylen properly when encrypting CMS messages. Thanks to Solar Designer of Openwall for reporting this issue. [Steve Henson]
2012-04-24Update openssl package to 0.9.8w.taca2-6/+6
Security fix for CVS-2012-2131. Changes between 0.9.8v and 0.9.8w [23 Apr 2012] *) The fix for CVE-2012-2110 did not take into account that the 'len' argument to BUF_MEM_grow and BUF_MEM_grow_clean is an int in OpenSSL 0.9.8, making it still vulnerable. Fix by rejecting negative len parameter. (CVE-2012-2131) [Tomas Hoger <thoger@redhat.com>]
2012-04-21Update openssl package to 0.9.8v.taca2-6/+6
NEWS ==== This file gives a brief overview of the major changes between each OpenSSL release. For more details please read the CHANGES file. Major changes between OpenSSL 0.9.8u and OpenSSL 0.9.8v: o Fix for ASN1 overflow bug CVE-2012-2110
2012-03-14configure script expects darwin-ppc-cc and not darwin-powerpc-cc.cegger1-1/+3
'should be ok' joerg@
2012-03-13Update openssl pacakge to 0.9.8u.taca3-25/+6
Changes between 0.9.8t and 0.9.8u [12 Mar 2012] *) Fix MMA (Bleichenbacher's attack on PKCS #1 v1.5 RSA padding) weakness in CMS and PKCS7 code. When RSA decryption fails use a random key for content decryption and always return the same error. Note: this attack needs on average 2^20 messages so it only affects automated senders. The old behaviour can be reenabled in the CMS code by setting the CMS_DEBUG_DECRYPT flag: this is useful for debugging and testing where an MMA defence is not necessary. Thanks to Ivan Nestlerode <inestlerode@us.ibm.com> for discovering this issue. (CVE-2012-0884) [Steve Henson] *) Fix CVE-2011-4619: make sure we really are receiving a client hello before rejecting multiple SGC restarts. Thanks to Ivan Nestlerode <inestlerode@us.ibm.com> for discovering this bug. [Steve Henson]
2012-03-05Add fix for CVE-2006-7250pettai3-2/+21
2012-01-31add HP-UX handling for Configure parameterssno1-1/+20
2012-01-20remove restrictions related to idea and mdc2 patents - both are expireddrochner1-8/+1
2012-01-19Update security/openssl package to 0.9.8t.taca2-6/+6
OpenSSL CHANGES _______________ Changes between 0.9.8s and 0.9.8t [18 Jan 2012] *) Fix for DTLS DoS issue introduced by fix for CVE-2011-4109. Thanks to Antonio Martin, Enterprise Secure Access Research and Development, Cisco Systems, Inc. for discovering this bug and preparing a fix. (CVE-2012-0050) [Antonio Martin]
2012-01-06Update openssl pacakge to 0.9.8s.taca4-67/+6
OpenSSL CHANGES _______________ Changes between 0.9.8r and 0.9.8s [4 Jan 2012] *) Nadhem Alfardan and Kenny Paterson have discovered an extension of the Vaudenay padding oracle attack on CBC mode encryption which enables an efficient plaintext recovery attack against the OpenSSL implementation of DTLS. Their attack exploits timing differences arising during decryption processing. A research paper describing this attack can be found at: http://www.isg.rhul.ac.uk/~kp/dtls.pdf Thanks go to Nadhem Alfardan and Kenny Paterson of the Information Security Group at Royal Holloway, University of London (www.isg.rhul.ac.uk) for discovering this flaw and to Robin Seggelmann <seggelmann@fh-muenster.de> and Michael Tuexen <tuexen@fh-muenster.de> for preparing the fix. (CVE-2011-4108) [Robin Seggelmann, Michael Tuexen] *) Stop policy check failure freeing same buffer twice. (CVE-2011-4109) [Ben Laurie, Kasper <ekasper@google.com>] *) Clear bytes used for block padding of SSL 3.0 records. (CVE-2011-4576) [Adam Langley (Google)] *) Only allow one SGC handshake restart for SSL/TLS. (CVE-2011-4619) [Adam Langley (Google)] *) Prevent malformed RFC3779 data triggering an assertion failure. Thanks to Andrew Chi, BBN Technologies, for discovering the flaw and Rob Austein <sra@hactrn.net> for fixing it. (CVE-2011-4577) [Rob Austein <sra@hactrn.net>] *) Fix ssl_ciph.c set-up race. [Adam Langley (Google)] *) Fix spurious failures in ecdsatest.c. [Emilia Käóper (Google)] *) Fix the BIO_f_buffer() implementation (which was mixing different interpretations of the '..._len' fields). [Adam Langley (Google)] *) Fix handling of BN_BLINDING: now BN_BLINDING_invert_ex (rather than BN_BLINDING_invert_ex) calls BN_BLINDING_update, ensuring that concurrent threads won't reuse the same blinding coefficients. This also avoids the need to obtain the CRYPTO_LOCK_RSA_BLINDING lock to call BN_BLINDING_invert_ex, and avoids one use of BN_BLINDING_update for each BN_BLINDING structure (previously, the last update always remained unused). [Emilia Käóper (Google)] *) Fix SSL memory handling for (EC)DH ciphersuites, in particular for multi-threaded use of ECDH. [Adam Langley (Google)] *) Fix x509_name_ex_d2i memory leak on bad inputs. [Bodo Moeller] *) Add protection against ECDSA timing attacks as mentioned in the paper by Billy Bob Brumley and Nicola Tuveri, see: http://eprint.iacr.org/2011/232.pdf [Billy Bob Brumley and Nicola Tuveri] Changes between 0.9.8q and 0.9.8r [8 Feb 2011] *) Fix parsing of OCSP stapling ClientHello extension. CVE-2011-0014 [Neel Mehta, Adam Langley, Bodo Moeller (Google)] *) Fix bug in string printing code: if *any* escaping is enabled we must escape the escape character (backslash) or the resulting string is ambiguous. [Steve Henson] Changes between 0.9.8p and 0.9.8q [2 Dec 2010] *) Disable code workaround for ancient and obsolete Netscape browsers and servers: an attacker can use it in a ciphersuite downgrade attack. Thanks to Martin Rex for discovering this bug. CVE-2010-4180 [Steve Henson] *) Fixed J-PAKE implementation error, originally discovered by Sebastien Martini, further info and confirmation from Stefan Arentz and Feng Hao. Note that this fix is a security fix. CVE-2010-4252 [Ben Laurie]
generated by cgit v1.2.3 (git 2.39.1) at 2024-07-08 00:02:26 +0000