[git.ipfire.org] IPFire 2.x development tree branch, next, updated. 83d225dd43a00070fb51d1c434cb3738427438c1

[git@ipfire.org]

[-- Attachment #1: Type: text/plain, Size: 5754 bytes --]

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "IPFire 2.x development tree".

The branch, next has been updated
       via  83d225dd43a00070fb51d1c434cb3738427438c1 (commit)
      from  2b6cce9b481cfa21807401075ef8cc9c156283d0 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 83d225dd43a00070fb51d1c434cb3738427438c1
Author: Michael Tremer <michael.tremer(a)ipfire.org>
Date:   Thu Jan 26 15:21:58 2017 +0000

    openssl: Update to 1.0.2k
    
    https://www.openssl.org/news/secadv/20170126.txt
    
    Truncated packet could crash via OOB read (CVE-2017-3731)
    =========================================================
    
    Severity: Moderate
    
    If an SSL/TLS server or client is running on a 32-bit host, and a specific
    cipher is being used, then a truncated packet can cause that server or client
    to perform an out-of-bounds read, usually resulting in a crash.
    
    For OpenSSL 1.1.0, the crash can be triggered when using CHACHA20/POLY1305;
    users should upgrade to 1.1.0d
    
    For Openssl 1.0.2, the crash can be triggered when using RC4-MD5; users who have
    not disabled that algorithm should update to 1.0.2k
    
    This issue was reported to OpenSSL on 13th November 2016 by Robert Święcki of
    Google. The fix was developed by Andy Polyakov of the OpenSSL development team.
    
    Bad (EC)DHE parameters cause a client crash (CVE-2017-3730)
    ===========================================================
    
    Severity: Moderate
    
    If a malicious server supplies bad parameters for a DHE or ECDHE key exchange
    then this can result in the client attempting to dereference a NULL pointer
    leading to a client crash. This could be exploited in a Denial of Service
    attack.
    
    OpenSSL 1.1.0 users should upgrade to 1.1.0d
    
    This issue does not affect OpenSSL version 1.0.2.
    
    Note that this issue was fixed prior to it being recognised as a security
    concern. This means the git commit with the fix does not contain the CVE
    identifier. The relevant fix commit can be identified by commit hash efbe126e3.
    
    This issue was reported to OpenSSL on 14th January 2017 by Guido Vranken. The
    fix was developed by Matt Caswell of the OpenSSL development team.
    
    BN_mod_exp may produce incorrect results on x86_64 (CVE-2017-3732)
    ==================================================================
    
    Severity: Moderate
    
    There is a carry propagating bug in the x86_64 Montgomery squaring procedure. No
    EC algorithms are affected. Analysis suggests that attacks against RSA and DSA
    as a result of this defect would be very difficult to perform and are not
    believed likely. Attacks against DH are considered just feasible (although very
    difficult) because most of the work necessary to deduce information
    about a private key may be performed offline. The amount of resources
    required for such an attack would be very significant and likely only
    accessible to a limited number of attackers. An attacker would
    additionally need online access to an unpatched system using the target
    private key in a scenario with persistent DH parameters and a private
    key that is shared between multiple clients. For example this can occur by
    default in OpenSSL DHE based SSL/TLS ciphersuites. Note: This issue is very
    similar to CVE-2015-3193 but must be treated as a separate problem.
    
    OpenSSL 1.1.0 users should upgrade to 1.1.0d
    OpenSSL 1.0.2 users should upgrade to 1.0.2k
    
    This issue was reported to OpenSSL on 15th January 2017 by the OSS-Fuzz project.
    The fix was developed by Andy Polyakov of the OpenSSL development team.
    
    Montgomery multiplication may produce incorrect results (CVE-2016-7055)
    =======================================================================
    
    Severity: Low
    
    This issue was previously fixed in 1.1.0c and covered in security advisory
    https://www.openssl.org/news/secadv/20161110.txt
    
    OpenSSL 1.0.2 users should upgrade to 1.0.2k
    
    Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>

-----------------------------------------------------------------------

Summary of changes:
 config/rootfiles/{oldcore/99 => core/109}/filelists/openssl | 0
 lfs/openssl                                                 | 4 ++--
 2 files changed, 2 insertions(+), 2 deletions(-)
 copy config/rootfiles/{oldcore/99 => core/109}/filelists/openssl (100%)

Difference in files:
diff --git a/config/rootfiles/core/109/filelists/openssl b/config/rootfiles/core/109/filelists/openssl
new file mode 120000
index 0000000..e011a92
--- /dev/null
+++ b/config/rootfiles/core/109/filelists/openssl
@@ -0,0 +1 @@
+../../../common/openssl
\ No newline at end of file
diff --git a/lfs/openssl b/lfs/openssl
index 0405a77..cece007 100644
--- a/lfs/openssl
+++ b/lfs/openssl
@@ -24,7 +24,7 @@
 
 include Config
 
-VER        = 1.0.2j
+VER        = 1.0.2k
 
 THISAPP    = openssl-$(VER)
 DL_FILE    = $(THISAPP).tar.gz
@@ -87,7 +87,7 @@ objects = $(DL_FILE)
 
 $(DL_FILE) = $(DL_FROM)/$(DL_FILE)
 
-$(DL_FILE)_MD5 = 96322138f0b69e61b7212bc53d5e912b
+$(DL_FILE)_MD5 = f965fc0bf01bf882b31314b61391ae65
 
 install : $(TARGET)
 


hooks/post-receive
--
IPFire 2.x development tree