summaryrefslogtreecommitdiff
path: root/security/openssl
AgeCommit message (Collapse)AuthorFilesLines
2022-11-05openssl: pkglint cleanupwiz1-11/+11
2022-11-05openssl: update to 1.1.1s.wiz3-7/+9
Major changes between OpenSSL 1.1.1r and OpenSSL 1.1.1s [1 Nov 2022] o Fixed a regression introduced in OpenSSL 1.1.1r not refreshing the certificate data to be signed before signing the certificate. Major changes between OpenSSL 1.1.1q and OpenSSL 1.1.1r [11 Oct 2022] o Added a missing header for memcmp that caused compilation failure on some platforms
2022-10-12openssl: downgrade to 1.1.1qwiz2-6/+6
The tarball was retracted due to a regression, to quote: We have received a report of a significant regression in the latest 3.0.6 and 1.1.1r versions. The regression is not thought to have security consequences. While the regression is further investigated we have taken the decision to withdraw the 3.0.6 and 1.1.1r versions and instead recommend that users remain on the previous 3.0.5 and 1.1.1q versions for now. We will issue a new plan for the release of 3.0.7 and 1.1.1s soon. From https://mta.openssl.org/pipermail/openssl-announce/2022-October/000237.html
2022-10-12openssl: update to 1.1.1r.wiz2-6/+6
Major changes between OpenSSL 1.1.1q and OpenSSL 1.1.1r [11 Oct 2022] o Added a missing header for memcmp that caused compilation failure on some platforms
2022-07-11openssl: update to 1.1.1q.wiz2-7/+6
Major changes between OpenSSL 1.1.1p and OpenSSL 1.1.1q [5 Jul 2022] o Fixed AES OCB failure to encrypt some bytes on 32-bit x86 platforms (CVE-2022-2097)
2022-06-28*: recursive bump for perl 5.36wiz2-3/+4
2022-06-21openssl: Update to 1.1.1p.jperkin3-7/+11
Approved during freeze by gdt@, tested on SmartOS and macOS. Major changes between OpenSSL 1.1.1o and OpenSSL 1.1.1p [21 Jun 2022] o Fixed additional bugs in the c_rehash script which was not properly sanitising shell metacharacters to prevent command injection (CVE-2022-2068)
2022-05-10openssl: update to 1.1.1o.wiz2-6/+6
Major changes between OpenSSL 1.1.1n and OpenSSL 1.1.1o [3 May 2022] o Fixed a bug in the c_rehash script which was not properly sanitising shell metacharacters to prevent command injection (CVE-2022-1292)
2022-03-15openssl: update to 1.1.1n.wiz3-7/+11
Major changes between OpenSSL 1.1.1m and OpenSSL 1.1.1n [15 Mar 2022] o Fixed a bug in the BN_mod_sqrt() function that can cause it to loop forever for non-prime moduli ([CVE-2022-0778])
2022-02-28openssl: update to 1.1.1m.wiz5-61/+11
Changes between 1.1.1l and 1.1.1m [14 Dec 2021] *) Avoid loading of a dynamic engine twice. *) Fixed building on Debian with kfreebsd kernels *) Prioritise DANE TLSA issuer certs over peer certs *) Fixed random API for MacOS prior to 10.12
2022-01-11Apply upstream c023d98dcf2ba1cc30f545ae54d0e037e80a8794:schmonz3-10/+47
Darwin platform allows to build on releases before Yosemite/ios 8. Fixes build on Snow Leopard. Still builds on Monterey.
2022-01-11Omit "-MT $@" from generated make rules, as it breaks SunPro builds andschmonz3-9/+24
"-o $@" is already sufficient. Also for SunPro, set OPENSSL_HOST.SunOS-x86_64=solaris64-x86_64-cc (that's cc, not gcc) to avoid this error linking libcrypto.so: cc: Warning: Option --libgcc passed to ld, if ld is invoked, ignored otherwise cc: No valid input files specified, no output generated "make package" succeeds on: - Solaris 11 with "Studio 12.6 Sun C 5.15" - Tribblix m25.1 with pkgsrc gcc7 - CentOS 7 with pkgsrc gcc7 - FreeBSD 13 with system clang - OpenBSD 7.0 with system clang - NetBSD 9.2 and -current with system gcc - CentOS 8 with system gcc - Debian 11, 10, 9 with system gcc - Devuan 4 with system gcc - Ubuntu 21, 18, 16, 14 with system gcc - Void with system gcc - Gentoo with system gcc
2021-10-26security: Replace RMD160 checksums with BLAKE2s checksumsnia1-2/+2
All checksums have been double-checked against existing RMD160 and SHA512 hashes Unfetchable distfiles (fetched conditionally?): ./security/cyrus-sasl/distinfo cyrus-sasl-dedad73e5e7a75d01a5f3d5a6702ab8ccd2ff40d.patch.v2
2021-10-07security: Remove SHA1 hashes for distfilesnia1-2/+1
2021-08-25openssl: fix building on Darwinadam3-3/+18
2021-08-25openssl: Update to 1.1.1l.jperkin5-33/+13
Changes between 1.1.1k and 1.1.1l [24 Aug 2021] *) Fixed an SM2 Decryption Buffer Overflow. In order to decrypt SM2 encrypted data an application is expected to call the API function EVP_PKEY_decrypt(). Typically an application will call this function twice. The first time, on entry, the "out" parameter can be NULL and, on exit, the "outlen" parameter is populated with the buffer size required to hold the decrypted plaintext. The application can then allocate a sufficiently sized buffer and call EVP_PKEY_decrypt() again, but this time passing a non-NULL value for the "out" parameter. A bug in the implementation of the SM2 decryption code means that the calculation of the buffer size required to hold the plaintext returned by the first call to EVP_PKEY_decrypt() can be smaller than the actual size required by the second call. This can lead to a buffer overflow when EVP_PKEY_decrypt() is called by the application a second time with a buffer that is too small. A malicious attacker who is able present SM2 content for decryption to an application could cause attacker chosen data to overflow the buffer by up to a maximum of 62 bytes altering the contents of other data held after the buffer, possibly changing application behaviour or causing the application to crash. The location of the buffer is application dependent but is typically heap allocated. (CVE-2021-3711) [Matt Caswell] *) Fixed various read buffer overruns processing ASN.1 strings ASN.1 strings are represented internally within OpenSSL as an ASN1_STRING structure which contains a buffer holding the string data and a field holding the buffer length. This contrasts with normal C strings which are repesented as a buffer for the string data which is terminated with a NUL (0) byte. Although not a strict requirement, ASN.1 strings that are parsed using OpenSSL's own "d2i" functions (and other similar parsing functions) as well as any string whose value has been set with the ASN1_STRING_set() function will additionally NUL terminate the byte array in the ASN1_STRING structure. However, it is possible for applications to directly construct valid ASN1_STRING structures which do not NUL terminate the byte array by directly setting the "data" and "length" fields in the ASN1_STRING array. This can also happen by using the ASN1_STRING_set0() function. Numerous OpenSSL functions that print ASN.1 data have been found to assume that the ASN1_STRING byte array will be NUL terminated, even though this is not guaranteed for strings that have been directly constructed. Where an application requests an ASN.1 structure to be printed, and where that ASN.1 structure contains ASN1_STRINGs that have been directly constructed by the application without NUL terminating the "data" field, then a read buffer overrun can occur. The same thing can also occur during name constraints processing of certificates (for example if a certificate has been directly constructed by the application instead of loading it via the OpenSSL parsing functions, and the certificate contains non NUL terminated ASN1_STRING structures). It can also occur in the X509_get1_email(), X509_REQ_get1_email() and X509_get1_ocsp() functions. If a malicious actor can cause an application to directly construct an ASN1_STRING and then process it through one of the affected OpenSSL functions then this issue could be hit. This might result in a crash (causing a Denial of Service attack). It could also result in the disclosure of private memory contents (such as private keys, or sensitive plaintext). (CVE-2021-3712) [Matt Caswell]
2021-07-18PR 55733 Joern Clausen: use GNU m4 with security/openssl on Solaris.dholland1-1/+2
Seems that Solaris's m4 overflows internal limits.
2021-07-10openssl: Stop passing CFLAGS/LDFLAGS to configure.jperkin1-2/+1
If this ever worked it only did by accident. Specifying, for example, "-arch arm64" as used on macOS is enough to break its custom configure script that assumes all arguments start with "-". The flags seem to propogate through the environment normally.
2021-07-09On Mac OS X Snow Leopard with ABI=64, configure was selecting a 32-bitschmonz1-1/+6
build (and then failing in the assembler). Override its choice on Darwin/x86_64 by specifying KERNEL_BITS=${ABI} in CONFIGURE_ENV.
2021-05-24*: recursive bump for perl 5.34wiz1-1/+2
2021-04-22openssl: add note on updatingnia1-1/+4
2021-04-22Fix c++17 and openssl on solaris/illumosnros2-1/+21
gcc on solaris/illumos defines __STDC_VERSION__ in c++ mode where _Noreturn does not exist. This causes breakage when building c++17 programs that use openssl.
2021-03-25openssl: Update to 1.1.1k.jperkin2-7/+7
Approved by @wiz during freeze. Changes between 1.1.1j and 1.1.1k [25 Mar 2021] *) Fixed a problem with verifying a certificate chain when using the X509_V_FLAG_X509_STRICT flag. This flag enables additional security checks of the certificates present in a certificate chain. It is not set by default. Starting from OpenSSL version 1.1.1h a check to disallow certificates in the chain that have explicitly encoded elliptic curve parameters was added as an additional strict check. An error in the implementation of this check meant that the result of a previous check to confirm that certificates in the chain are valid CA certificates was overwritten. This effectively bypasses the check that non-CA certificates must not be able to issue other certificates. If a "purpose" has been configured then there is a subsequent opportunity for checks that the certificate is a valid CA. All of the named "purpose" values implemented in libcrypto perform this check. Therefore, where a purpose is set the certificate chain will still be rejected even when the strict flag has been used. A purpose is set by default in libssl client and server certificate verification routines, but it can be overridden or removed by an application. In order to be affected, an application must explicitly set the X509_V_FLAG_X509_STRICT verification flag and either not set a purpose for the certificate verification or, in the case of TLS client or server applications, override the default purpose. (CVE-2021-3450) [Tomáš Mráz] *) Fixed an issue where an OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. If a TLSv1.2 renegotiation ClientHello omits the signature_algorithms extension (where it was present in the initial ClientHello), but includes a signature_algorithms_cert extension then a NULL pointer dereference will result, leading to a crash and a denial of service attack. A server is only vulnerable if it has TLSv1.2 and renegotiation enabled (which is the default configuration). OpenSSL TLS clients are not impacted by this issue. (CVE-2021-3449) [Peter Kästle and Samuel Sapalski]
2021-03-01seurity/openssl: Accomodate non-standard paths and cert bundlesgdt1-2/+17
Some systems choose unusual paths fro certs, and some use bundles. Try to accomodate that, in particular by defining SSLCERTBUNDLE. Patch concept from Thomas Orgis on tech-pkg, with no objections.
2021-02-20openssl: update to 1.1.1j.wiz3-8/+10
Major changes between OpenSSL 1.1.1i and OpenSSL 1.1.1j [16 Feb 2021] o Fixed a NULL pointer deref in the X509_issuer_and_serial_hash() function (CVE-2021-23841) o Fixed the RSA_padding_check_SSLv23() function and the RSA_SSLV23_PADDING padding mode to correctly check for rollback attacks o Fixed an overflow in the EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate functions (CVE-2021-23840) o Fixed SRP_Calc_client_key so that it runs in constant time
2021-01-25Fix build on OpenBSD by defining __STDC_NO_ATOMICS__.schmonz1-2/+3
2020-12-08openssl: update to 1.1.1i.wiz3-30/+7
Major changes between OpenSSL 1.1.1h and OpenSSL 1.1.1i [8 Dec 2020] o Fixed NULL pointer deref in GENERAL_NAME_cmp (CVE-2020-1971)
2020-10-13openssl: add -lrt for the benefit of Solaris 10.maya1-1/+3
PR pkg/55688 PR pkg/54958
2020-09-30openssl: update to 1.1.1h.wiz4-57/+12
Major changes between OpenSSL 1.1.1g and OpenSSL 1.1.1h [22 Sep 2020] o Disallow explicit curve parameters in verifications chains when X509_V_FLAG_X509_STRICT is used o Enable 'MinProtocol' and 'MaxProtocol' to configure both TLS and DTLS contexts o Oracle Developer Studio will start reporting deprecation warnings
2020-09-29Fix the build on sparc64 (and other architectures that use m4 to generatemartin2-7/+18
asm files).
2020-08-31*: bump PKGREVISION for perl-5.32.wiz1-2/+2
2020-07-22security/openssl: Make compatible with Apple Siliconsjmulder3-2/+26
2020-07-13openssl: Fix c_rehash manual page entry.jperkin2-5/+7
Previously after the openssl-* renames it ended up as a dangling symlink, causing "pkg_admin check" failures. Bump PKGREVISION.
2020-07-10Unbreak security/openssl build on pre-v9 Darwin.hauke3-2/+33
(1) There is no {get,make,set}context support before Darwin 9 (2) Instead of failing the build on makedepend(8) malfunction, have make(1) ignore its return value - which used to be the default for previous OpenSSL versions.
2020-05-23openssl: Unbreak Darwin installs after --libdir change.jperkin2-1/+17
Adding --libdir seems innocuous enough, but due to OpenSSL's crazy complicated build system actually results in LIBDIR becoming unset, which trickles down to the Darwin -install_name being wrong. This broke the 'openssl' command and thus many many dependencies. Switch to $(libdir) instead which appears to still be set correctly.
2020-05-21openssl: Pass explicit libdirnia1-1/+2
Some linuxes have /lib64. pkgsrc should never use /lib64. Pointed out by sobukus on freenode
2020-04-30openssl: Fix KERN_ARND usage on NetBSD.nia3-2/+51
XXX upstream
2020-04-21new manual in 1.1.1gsevan1-1/+2
2020-04-21Update to OpenSSL 1.1.1gsevan2-7/+7
Major changes between OpenSSL 1.1.1f and OpenSSL 1.1.1g [21 Apr 2020] Fixed segmentation fault in SSL_check_chain() (CVE-2020-1967)
2020-03-31Update to openssl 1.1.1fsevan3-50/+50
Changes between 1.1.1e and 1.1.1f * Revert the unexpected EOF reporting via SSL_ERROR_SSL
2020-03-22openssl: update to 1.1.1e.wiz3-9/+45
Major changes between OpenSSL 1.1.1d and OpenSSL 1.1.1e [17 Mar 2020] o Fixed an overflow bug in the x64_64 Montgomery squaring procedure used in exponentiation with 512-bit moduli (CVE-2019-1551)
2020-02-12openssl: Spell x86_64 correctly.jperkin1-2/+2
2020-02-12security/openssl: fix the recent fix for building on Solaris and HP-UXrillig1-2/+2
2020-02-11security/openssl: fix build on Solarisrillig1-1/+9
This fixes PR pkg/54894.
2020-02-11openssl: Handle i386 SunOS.jperkin1-1/+12
The OpenSSL config script isn't clever enough to detect multiarch platforms so we need to manually specify the host OS.
2020-01-28openssl: fix PR pkg/54890triaxx1-2/+2
pkgsrc changes: --------------- * Make the BUILDLINK_API_DEPENDS of builtin.mk match the one of buildlink3.mk.
2020-01-20openssl: Explicitly disable afalgeng for now.jperkin2-3/+6
This is only supported in certain Linux configurations, so will need proper PLIST logic if it is to be properly handled as an option. Fixes EL7.
2020-01-18*: Recursive revision bump for openssl 1.1.1.jperkin2-4/+4
2020-01-16openssl: rc5 patents expired some years agowiz2-9/+4
Remove its LICENSE line and enable rc5 option by default. Bump PKGREVISION.
2020-01-16openssl: add PLIST.Linux for afalg.sowiz1-0/+2
From Michael Forney in PR 54866
generated by cgit v1.2.3 (git 2.46.0) at 2026-08-16 04:55:28 +0000