GNOME.org
 

[gnome-continuous-yocto/gnomeostree-3.28-rocko: 2670/8267] openssl: update to 1.0.2i (CVE-2016-6304 and more)

commit d9e1bb679eb4d625a751ad668a18eaaefeaed850
Author: Patrick Ohly <patrick ohly intel com>
Date:   Fri Sep 23 15:26:05 2016 +0200

    openssl: update to 1.0.2i (CVE-2016-6304 and more)
    
    This update fixes several CVEs:
    * OCSP Status Request extension unbounded memory growth (CVE-2016-6304)
    * SWEET32 Mitigation (CVE-2016-2183)
    * OOB write in MDC2_Update() (CVE-2016-6303)
    * Malformed SHA512 ticket DoS (CVE-2016-6302)
    * OOB write in BN_bn2dec() (CVE-2016-2182)
    * OOB read in TS_OBJ_print_bio() (CVE-2016-2180)
    * DTLS buffered message DoS (CVE-2016-2179)
    * DTLS replay protection DoS (CVE-2016-2181)
    * Certificate message OOB reads (CVE-2016-6306)
    
    Of these, only CVE-2016-6304 is considered of high
    severity. Everything else is low. CVE-2016-2177 and CVE-2016-2178 were
    already fixed via local patches, which can be removed now.
    
    See https://www.openssl.org/news/secadv/20160922.txt for details.
    
    Some patches had to be refreshed and one compile error fix from
    upstream's OpenSSL_1_0_2-stable was required. The server.pem
    file is needed for test_dtls.
    
    (From OE-Core rev: d6b69279b5d1370d9c4982d5b1842a471cfd2b0e)
    
    Signed-off-by: Patrick Ohly <patrick ohly intel com>
    Signed-off-by: Richard Purdie <richard purdie linuxfoundation org>

 meta/recipes-connectivity/openssl/openssl.inc      |    1 +
 .../openssl/openssl/CVE-2016-2177.patch            |  286 --------------------
 .../openssl/openssl/CVE-2016-2178.patch            |   51 ----
 .../openssl/Fix-typo-introduced-by-a03f81f4.patch  |   29 ++
 .../openssl/openssl/debian/ca.patch                |    2 +-
 .../openssl/openssl/parallel.patch                 |   17 +-
 .../{openssl_1.0.2h.bb => openssl_1.0.2i.bb}       |    7 +-
 7 files changed, 48 insertions(+), 345 deletions(-)
---
diff --git a/meta/recipes-connectivity/openssl/openssl.inc b/meta/recipes-connectivity/openssl/openssl.inc
index f83664c..cb7ec0a 100644
--- a/meta/recipes-connectivity/openssl/openssl.inc
+++ b/meta/recipes-connectivity/openssl/openssl.inc
@@ -211,6 +211,7 @@ do_install_ptest () {
        ln -sf ${libdir}/ssl/misc/CA.sh  ${D}${PTEST_PATH}/apps
        ln -sf ${sysconfdir}/ssl/openssl.cnf ${D}${PTEST_PATH}/apps
        ln -sf ${bindir}/openssl         ${D}${PTEST_PATH}/apps
+       cp apps/server.pem              ${D}${PTEST_PATH}/apps
        cp apps/server2.pem             ${D}${PTEST_PATH}/apps
        mkdir -p ${D}${PTEST_PATH}/util
        install util/opensslwrap.sh    ${D}${PTEST_PATH}/util
diff --git a/meta/recipes-connectivity/openssl/openssl/Fix-typo-introduced-by-a03f81f4.patch 
b/meta/recipes-connectivity/openssl/openssl/Fix-typo-introduced-by-a03f81f4.patch
new file mode 100644
index 0000000..0411296
--- /dev/null
+++ b/meta/recipes-connectivity/openssl/openssl/Fix-typo-introduced-by-a03f81f4.patch
@@ -0,0 +1,29 @@
+From 581215a519c66db7255ea360ed25bb00033ccd52 Mon Sep 17 00:00:00 2001
+From: Rich Salz <rsalz openssl org>
+Date: Thu, 22 Sep 2016 08:47:45 -0400
+Subject: [PATCH] Fix typo introduced by a03f81f4
+
+Reviewed-by: Richard Levitte <levitte openssl org>
+
+Upstream-Status: Backport 
[https://github.com/openssl/openssl/commit/581215a519c66db7255ea360ed25bb00033ccd52]
+Signed-off-by: Patrick Ohly <patrick ohly intel com>
+---
+ crypto/engine/eng_cryptodev.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/crypto/engine/eng_cryptodev.c b/crypto/engine/eng_cryptodev.c
+index 65a74df..2a2b95c 100644
+--- a/crypto/engine/eng_cryptodev.c
++++ b/crypto/engine/eng_cryptodev.c
+@@ -939,7 +939,7 @@ static int cryptodev_digest_copy(EVP_MD_CTX *to, const EVP_MD_CTX *from)
+     if (fstate->mac_len != 0) {
+         if (fstate->mac_data != NULL) {
+             dstate->mac_data = OPENSSL_malloc(fstate->mac_len);
+-            if (dstate->ac_data == NULL) {
++            if (dstate->mac_data == NULL) {
+                 printf("cryptodev_digest_init: malloc failed\n");
+                 return 0;
+             }
+-- 
+2.1.4
+
diff --git a/meta/recipes-connectivity/openssl/openssl/debian/ca.patch 
b/meta/recipes-connectivity/openssl/openssl/debian/ca.patch
index aba4d42..fb745e4 100644
--- a/meta/recipes-connectivity/openssl/openssl/debian/ca.patch
+++ b/meta/recipes-connectivity/openssl/openssl/debian/ca.patch
@@ -7,7 +7,7 @@ Index: openssl-0.9.8m/apps/CA.pl.in
 @@ -65,6 +65,7 @@
  foreach (@ARGV) {
        if ( /^(-\?|-h|-help)$/ ) {
-           print STDERR "usage: CA -newcert|-newreq|-newreq-nodes|-newca|-sign|-verify\n";
+           print STDERR "usage: CA -newcert|-newreq|-newreq-nodes|-newca|-sign|-signcert|-verify\n";
 +          print STDERR "usage: CA -signcert certfile keyfile|-newcert|-newreq|-newca|-sign|-verify\n";
            exit 0;
        } elsif (/^-newcert$/) {
diff --git a/meta/recipes-connectivity/openssl/openssl/parallel.patch 
b/meta/recipes-connectivity/openssl/openssl/parallel.patch
index b6c2c14..f3f4c99 100644
--- a/meta/recipes-connectivity/openssl/openssl/parallel.patch
+++ b/meta/recipes-connectivity/openssl/openssl/parallel.patch
@@ -6,6 +6,9 @@ https://gitweb.gentoo.org/repo/gentoo.git/plain/dev-libs/openssl/files/openssl-1
 Upstream-Status: Pending
 Signed-off-by: Ross Burton <ross burton intel com>
 
+Refreshed for 1.0.2i
+Signed-off-by: Patrick Ohly <patrick ohly intel com>
+
 --- openssl-1.0.2g/crypto/Makefile
 +++ openssl-1.0.2g/crypto/Makefile
 @@ -85,11 +85,11 @@
@@ -133,7 +136,7 @@ Signed-off-by: Ross Burton <ross burton intel com>
                fi; \
 --- openssl-1.0.2g/test/Makefile
 +++ openssl-1.0.2g/test/Makefile
-@@ -139,7 +139,7 @@
+@@ -144,7 +144,7 @@
  tags:
        ctags $(SRC)
  
@@ -142,7 +145,7 @@ Signed-off-by: Ross Burton <ross burton intel com>
  
  apps:
        @(cd ..; $(MAKE) DIRS=apps all)
-@@ -421,130 +421,130 @@
+@@ -438,136 +438,136 @@
                link_app.$${shlib_target}
  
  $(RSATEST)$(EXE_EXT): $(RSATEST).o $(DLIBCRYPTO)
@@ -309,13 +312,21 @@ Signed-off-by: Ross Burton <ross burton intel com>
 -      @target=$(CLIENTHELLOTEST) $(BUILD_CMD)
 +      +@target=$(CLIENTHELLOTEST) $(BUILD_CMD)
  
+ $(BADDTLSTEST)$(EXE_EXT): $(BADDTLSTEST).o
+-      @target=$(BADDTLSTEST) $(BUILD_CMD)
++      +@target=$(BADDTLSTEST) $(BUILD_CMD)
+ 
  $(SSLV2CONFTEST)$(EXE_EXT): $(SSLV2CONFTEST).o
 -      @target=$(SSLV2CONFTEST) $(BUILD_CMD)
 +      +@target=$(SSLV2CONFTEST) $(BUILD_CMD)
  
+ $(DTLSTEST)$(EXE_EXT): $(DTLSTEST).o ssltestlib.o $(DLIBSSL) $(DLIBCRYPTO)
+-      @target=$(DTLSTEST); exobj=ssltestlib.o; $(BUILD_CMD)
++      +@target=$(DTLSTEST); exobj=ssltestlib.o; $(BUILD_CMD)
+ 
  #$(AESTEST).o: $(AESTEST).c
  #     $(CC) -c $(CFLAGS) -DINTERMEDIATE_VALUE_KAT -DTRACE_KAT_MCT $(AESTEST).c
-@@ -557,7 +557,7 @@
+@@ -580,6 +580,6 @@
  #     fi
  
  dummytest$(EXE_EXT): dummytest.o $(DLIBCRYPTO)
diff --git a/meta/recipes-connectivity/openssl/openssl_1.0.2h.bb 
b/meta/recipes-connectivity/openssl/openssl_1.0.2i.bb
similarity index 91%
rename from meta/recipes-connectivity/openssl/openssl_1.0.2h.bb
rename to meta/recipes-connectivity/openssl/openssl_1.0.2i.bb
index c8444d3..c32f472 100644
--- a/meta/recipes-connectivity/openssl/openssl_1.0.2h.bb
+++ b/meta/recipes-connectivity/openssl/openssl_1.0.2i.bb
@@ -39,12 +39,11 @@ SRC_URI += "file://find.pl;subdir=${BP}/util/ \
             file://ptest_makefile_deps.patch  \
             file://configure-musl-target.patch \
             file://parallel.patch \
-            file://CVE-2016-2177.patch \
-            file://CVE-2016-2178.patch \
             file://openssl-util-perlpath.pl-cwd.patch \
+            file://Fix-typo-introduced-by-a03f81f4.patch \
            "
-SRC_URI[md5sum] = "9392e65072ce4b614c1392eefc1f23d0"
-SRC_URI[sha256sum] = "1d4007e53aad94a5b2002fe045ee7bb0b3d98f1a47f8b2bc851dcd1c74332919"
+SRC_URI[md5sum] = "678374e63f8df456a697d3e5e5a931fb"
+SRC_URI[sha256sum] = "9287487d11c9545b6efb287cdb70535d4e9b284dd10d51441d9b9963d000de6f"
 
 PACKAGES =+ "${PN}-engines"
 FILES_${PN}-engines = "${libdir}/ssl/engines/*.so ${libdir}/engines"
[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]