From mboxrd@z Thu Jan 1 00:00:00 1970 From: Michael Tremer To: ipfire-scm@lists.ipfire.org Subject: [git.ipfire.org] IPFire 2.x development tree branch, next, updated. a9e6119972ea3fa61d830fc0fcd8e029c2aedd20 Date: Tue, 14 Aug 2018 19:15:29 +0100 Message-ID: <20180814181530.29FFE1081BD3@git01.ipfire.org> MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="===============6309364097722729359==" List-Id: --===============6309364097722729359== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, next has been updated via a9e6119972ea3fa61d830fc0fcd8e029c2aedd20 (commit) from f2f0d61fc1ecaff1f13ece1c0f85d2adbe2ba347 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit a9e6119972ea3fa61d830fc0fcd8e029c2aedd20 Author: Michael Tremer Date: Tue Aug 14 19:12:53 2018 +0100 openssl: Update to 1.1.0i and 1.0.2p =20 Changes between 1.1.0h and 1.1.0i [14 Aug 2018] =20 *) Client DoS due to large DH parameter =20 During key agreement in a TLS handshake using a DH(E) based ciphersu= ite a malicious server can send a very large prime value to the client. Th= is will cause the client to spend an unreasonably long period of time genera= ting a key for this prime resulting in a hang until the client has finished= . This could be exploited in a Denial Of Service attack. =20 This issue was reported to OpenSSL on 5th June 2018 by Guido Vranken (CVE-2018-0732) [Guido Vranken] =20 *) Cache timing vulnerability in RSA Key Generation =20 The OpenSSL RSA Key generation algorithm has been shown to be vulner= able to a cache timing side channel attack. An attacker with sufficient acce= ss to mount cache timing attacks during the RSA key generation process cou= ld recover the private key. =20 This issue was reported to OpenSSL on 4th April 2018 by Alejandro Ca= brera Aldaya, Billy Brumley, Cesar Pereida Garcia and Luis Manuel Alvarez = Tapia. (CVE-2018-0737) [Billy Brumley] =20 *) Make EVP_PKEY_asn1_new() a bit stricter about its input. A NULL pem= _str parameter is no longer accepted, as it leads to a corrupt table. NU= LL pem_str is reserved for alias entries only. [Richard Levitte] =20 *) Revert blinding in ECDSA sign and instead make problematic addition length-invariant. Switch even to fixed-length Montgomery multiplicat= ion. [Andy Polyakov] =20 *) Change generating and checking of primes so that the error rate of n= ot being prime depends on the intended use based on the size of the inp= ut. For larger primes this will result in more rounds of Miller-Rabin. The maximal error rate for primes with more than 1080 bits is lowered to 2^-128. [Kurt Roeckx, Annie Yousar] =20 *) Increase the number of Miller-Rabin rounds for DSA key generating to= 64. [Kurt Roeckx] =20 *) Add blinding to ECDSA and DSA signatures to protect against side cha= nnel attacks discovered by Keegan Ryan (NCC Group). [Matt Caswell] =20 *) When unlocking a pass phrase protected PEM file or PKCS#8 container,= we now allow empty (zero character) pass phrases. [Richard Levitte] =20 *) Certificate time validation (X509_cmp_time) enforces stricter compliance with RFC 5280. Fractional seconds and timezone offsets are no longer allowed. [Emilia K=C3=A4sper] =20 *) Fixed a text canonicalisation bug in CMS =20 Where a CMS detached signature is used with text content the text go= es through a canonicalisation process first prior to signing or verifyi= ng a signature. This process strips trailing space at the end of lines, c= onverts line terminators to CRLF and removes additional trailing line termin= ators at the end of a file. A bug in the canonicalisation process meant th= at some characters, such as form-feed, were incorrectly treated as whit= espace and removed. This is contrary to the specification (RFC5485). This f= ix could mean that detached text data signed with an earlier version of OpenSSL 1.1.0 may fail to verify using the fixed version, or text da= ta signed with a fixed OpenSSL may fail to verify with an earlier versi= on of OpenSSL 1.1.0. A workaround is to only verify the canonicalised text= data and use the "-binary" flag (for the "cms" command line application) = or set the SMIME_BINARY/PKCS7_BINARY/CMS_BINARY flags (if using CMS_verify(= )). [Matt Caswell] =20 Changes between 1.0.2o and 1.0.2p [14 Aug 2018] =20 *) Client DoS due to large DH parameter =20 During key agreement in a TLS handshake using a DH(E) based ciphersu= ite a malicious server can send a very large prime value to the client. Th= is will cause the client to spend an unreasonably long period of time genera= ting a key for this prime resulting in a hang until the client has finished= . This could be exploited in a Denial Of Service attack. =20 This issue was reported to OpenSSL on 5th June 2018 by Guido Vranken (CVE-2018-0732) [Guido Vranken] =20 *) Cache timing vulnerability in RSA Key Generation =20 The OpenSSL RSA Key generation algorithm has been shown to be vulner= able to a cache timing side channel attack. An attacker with sufficient acce= ss to mount cache timing attacks during the RSA key generation process cou= ld recover the private key. =20 This issue was reported to OpenSSL on 4th April 2018 by Alejandro Ca= brera Aldaya, Billy Brumley, Cesar Pereida Garcia and Luis Manuel Alvarez = Tapia. (CVE-2018-0737) [Billy Brumley] =20 *) Make EVP_PKEY_asn1_new() a bit stricter about its input. A NULL pem= _str parameter is no longer accepted, as it leads to a corrupt table. NU= LL pem_str is reserved for alias entries only. [Richard Levitte] =20 *) Revert blinding in ECDSA sign and instead make problematic addition length-invariant. Switch even to fixed-length Montgomery multiplicat= ion. [Andy Polyakov] =20 *) Change generating and checking of primes so that the error rate of n= ot being prime depends on the intended use based on the size of the inp= ut. For larger primes this will result in more rounds of Miller-Rabin. The maximal error rate for primes with more than 1080 bits is lowered to 2^-128. [Kurt Roeckx, Annie Yousar] =20 *) Increase the number of Miller-Rabin rounds for DSA key generating to= 64. [Kurt Roeckx] =20 *) Add blinding to ECDSA and DSA signatures to protect against side cha= nnel attacks discovered by Keegan Ryan (NCC Group). [Matt Caswell] =20 *) When unlocking a pass phrase protected PEM file or PKCS#8 container,= we now allow empty (zero character) pass phrases. [Richard Levitte] =20 *) Certificate time validation (X509_cmp_time) enforces stricter compliance with RFC 5280. Fractional seconds and timezone offsets are no longer allowed. [Emilia K=C3=A4sper] =20 Signed-off-by: Michael Tremer ----------------------------------------------------------------------- Summary of changes: config/rootfiles/common/openssl | 76 +++++++++++++++++++++++++++++++++++++++= ++ lfs/openssl | 4 +-- lfs/openssl-compat | 4 +-- 3 files changed, 80 insertions(+), 4 deletions(-) Difference in files: diff --git a/config/rootfiles/common/openssl b/config/rootfiles/common/openssl index dd20f9fab..8b26c4b42 100644 --- a/config/rootfiles/common/openssl +++ b/config/rootfiles/common/openssl @@ -1285,13 +1285,17 @@ usr/lib/libssl.so.1.1 #usr/share/doc/openssl/html/man3/EVP_EncryptInit_ex.html #usr/share/doc/openssl/html/man3/EVP_EncryptUpdate.html #usr/share/doc/openssl/html/man3/EVP_MD_CTX_block_size.html +#usr/share/doc/openssl/html/man3/EVP_MD_CTX_clear_flags.html #usr/share/doc/openssl/html/man3/EVP_MD_CTX_copy.html #usr/share/doc/openssl/html/man3/EVP_MD_CTX_copy_ex.html #usr/share/doc/openssl/html/man3/EVP_MD_CTX_free.html #usr/share/doc/openssl/html/man3/EVP_MD_CTX_md.html +#usr/share/doc/openssl/html/man3/EVP_MD_CTX_md_data.html #usr/share/doc/openssl/html/man3/EVP_MD_CTX_new.html #usr/share/doc/openssl/html/man3/EVP_MD_CTX_reset.html +#usr/share/doc/openssl/html/man3/EVP_MD_CTX_set_flags.html #usr/share/doc/openssl/html/man3/EVP_MD_CTX_size.html +#usr/share/doc/openssl/html/man3/EVP_MD_CTX_test_flags.html #usr/share/doc/openssl/html/man3/EVP_MD_CTX_type.html #usr/share/doc/openssl/html/man3/EVP_MD_block_size.html #usr/share/doc/openssl/html/man3/EVP_MD_meth_dup.html @@ -1628,6 +1632,7 @@ usr/lib/libssl.so.1.1 #usr/share/doc/openssl/html/man3/OCSP_SINGLERESP_free.html #usr/share/doc/openssl/html/man3/OCSP_SINGLERESP_new.html #usr/share/doc/openssl/html/man3/OCSP_basic_add1_nonce.html +#usr/share/doc/openssl/html/man3/OCSP_basic_verify.html #usr/share/doc/openssl/html/man3/OCSP_cert_id_new.html #usr/share/doc/openssl/html/man3/OCSP_cert_to_id.html #usr/share/doc/openssl/html/man3/OCSP_check_nonce.html @@ -2364,6 +2369,7 @@ usr/lib/libssl.so.1.1 #usr/share/doc/openssl/html/man3/SSL_get_selected_srtp_profile.html #usr/share/doc/openssl/html/man3/SSL_get_server_random.html #usr/share/doc/openssl/html/man3/SSL_get_session.html +#usr/share/doc/openssl/html/man3/SSL_get_shared_ciphers.html #usr/share/doc/openssl/html/man3/SSL_get_shared_curve.html #usr/share/doc/openssl/html/man3/SSL_get_shared_sigalgs.html #usr/share/doc/openssl/html/man3/SSL_get_shutdown.html @@ -2651,8 +2657,36 @@ usr/lib/libssl.so.1.1 #usr/share/doc/openssl/html/man3/X509_EXTENSION_set_critical.html #usr/share/doc/openssl/html/man3/X509_EXTENSION_set_data.html #usr/share/doc/openssl/html/man3/X509_EXTENSION_set_object.html +#usr/share/doc/openssl/html/man3/X509_LOOKUP_ctrl_fn.html #usr/share/doc/openssl/html/man3/X509_LOOKUP_file.html +#usr/share/doc/openssl/html/man3/X509_LOOKUP_get_by_alias_fn.html +#usr/share/doc/openssl/html/man3/X509_LOOKUP_get_by_fingerprint_fn.html +#usr/share/doc/openssl/html/man3/X509_LOOKUP_get_by_issuer_serial_fn.html +#usr/share/doc/openssl/html/man3/X509_LOOKUP_get_by_subject_fn.html +#usr/share/doc/openssl/html/man3/X509_LOOKUP_get_method_data.html +#usr/share/doc/openssl/html/man3/X509_LOOKUP_get_store.html #usr/share/doc/openssl/html/man3/X509_LOOKUP_hash_dir.html +#usr/share/doc/openssl/html/man3/X509_LOOKUP_meth_free.html +#usr/share/doc/openssl/html/man3/X509_LOOKUP_meth_get_ctrl.html +#usr/share/doc/openssl/html/man3/X509_LOOKUP_meth_get_free.html +#usr/share/doc/openssl/html/man3/X509_LOOKUP_meth_get_get_by_alias.html +#usr/share/doc/openssl/html/man3/X509_LOOKUP_meth_get_get_by_fingerprint.html +#usr/share/doc/openssl/html/man3/X509_LOOKUP_meth_get_get_by_issuer_serial.h= tml +#usr/share/doc/openssl/html/man3/X509_LOOKUP_meth_get_get_by_subject.html +#usr/share/doc/openssl/html/man3/X509_LOOKUP_meth_get_init.html +#usr/share/doc/openssl/html/man3/X509_LOOKUP_meth_get_new_item.html +#usr/share/doc/openssl/html/man3/X509_LOOKUP_meth_get_shutdown.html +#usr/share/doc/openssl/html/man3/X509_LOOKUP_meth_new.html +#usr/share/doc/openssl/html/man3/X509_LOOKUP_meth_set_ctrl.html +#usr/share/doc/openssl/html/man3/X509_LOOKUP_meth_set_free.html +#usr/share/doc/openssl/html/man3/X509_LOOKUP_meth_set_get_by_alias.html +#usr/share/doc/openssl/html/man3/X509_LOOKUP_meth_set_get_by_fingerprint.html +#usr/share/doc/openssl/html/man3/X509_LOOKUP_meth_set_get_by_issuer_serial.h= tml +#usr/share/doc/openssl/html/man3/X509_LOOKUP_meth_set_get_by_subject.html +#usr/share/doc/openssl/html/man3/X509_LOOKUP_meth_set_init.html +#usr/share/doc/openssl/html/man3/X509_LOOKUP_meth_set_new_item.html +#usr/share/doc/openssl/html/man3/X509_LOOKUP_meth_set_shutdown.html +#usr/share/doc/openssl/html/man3/X509_LOOKUP_set_method_data.html #usr/share/doc/openssl/html/man3/X509_NAME_ENTRY_create_by_NID.html #usr/share/doc/openssl/html/man3/X509_NAME_ENTRY_create_by_OBJ.html #usr/share/doc/openssl/html/man3/X509_NAME_ENTRY_create_by_txt.html @@ -2683,6 +2717,8 @@ usr/lib/libssl.so.1.1 #usr/share/doc/openssl/html/man3/X509_NAME_print.html #usr/share/doc/openssl/html/man3/X509_NAME_print_ex.html #usr/share/doc/openssl/html/man3/X509_NAME_print_ex_fp.html +#usr/share/doc/openssl/html/man3/X509_OBJECT_set1_X509.html +#usr/share/doc/openssl/html/man3/X509_OBJECT_set1_X509_CRL.html #usr/share/doc/openssl/html/man3/X509_PUBKEY_free.html #usr/share/doc/openssl/html/man3/X509_PUBKEY_get.html #usr/share/doc/openssl/html/man3/X509_PUBKEY_get0.html @@ -2828,6 +2864,7 @@ usr/lib/libssl.so.1.1 #usr/share/doc/openssl/html/man3/X509_VERIFY_PARAM_get_auth_level.html #usr/share/doc/openssl/html/man3/X509_VERIFY_PARAM_get_depth.html #usr/share/doc/openssl/html/man3/X509_VERIFY_PARAM_get_flags.html +#usr/share/doc/openssl/html/man3/X509_VERIFY_PARAM_get_hostflags.html #usr/share/doc/openssl/html/man3/X509_VERIFY_PARAM_get_inh_flags.html #usr/share/doc/openssl/html/man3/X509_VERIFY_PARAM_get_time.html #usr/share/doc/openssl/html/man3/X509_VERIFY_PARAM_set1_email.html @@ -2852,6 +2889,7 @@ usr/lib/libssl.so.1.1 #usr/share/doc/openssl/html/man3/X509_check_ip.html #usr/share/doc/openssl/html/man3/X509_check_ip_asc.html #usr/share/doc/openssl/html/man3/X509_check_issued.html +#usr/share/doc/openssl/html/man3/X509_cmp_time.html #usr/share/doc/openssl/html/man3/X509_delete_ext.html #usr/share/doc/openssl/html/man3/X509_digest.html #usr/share/doc/openssl/html/man3/X509_dup.html @@ -4531,13 +4569,17 @@ usr/lib/libssl.so.1.1 #usr/share/man/man3/EVP_EncryptInit_ex.3 #usr/share/man/man3/EVP_EncryptUpdate.3 #usr/share/man/man3/EVP_MD_CTX_block_size.3 +#usr/share/man/man3/EVP_MD_CTX_clear_flags.3 #usr/share/man/man3/EVP_MD_CTX_copy.3 #usr/share/man/man3/EVP_MD_CTX_copy_ex.3 #usr/share/man/man3/EVP_MD_CTX_free.3 #usr/share/man/man3/EVP_MD_CTX_md.3 +#usr/share/man/man3/EVP_MD_CTX_md_data.3 #usr/share/man/man3/EVP_MD_CTX_new.3 #usr/share/man/man3/EVP_MD_CTX_reset.3 +#usr/share/man/man3/EVP_MD_CTX_set_flags.3 #usr/share/man/man3/EVP_MD_CTX_size.3 +#usr/share/man/man3/EVP_MD_CTX_test_flags.3 #usr/share/man/man3/EVP_MD_CTX_type.3 #usr/share/man/man3/EVP_MD_block_size.3 #usr/share/man/man3/EVP_MD_meth_dup.3 @@ -4874,6 +4916,7 @@ usr/lib/libssl.so.1.1 #usr/share/man/man3/OCSP_SINGLERESP_free.3 #usr/share/man/man3/OCSP_SINGLERESP_new.3 #usr/share/man/man3/OCSP_basic_add1_nonce.3 +#usr/share/man/man3/OCSP_basic_verify.3 #usr/share/man/man3/OCSP_cert_id_new.3 #usr/share/man/man3/OCSP_cert_to_id.3 #usr/share/man/man3/OCSP_check_nonce.3 @@ -5610,6 +5653,7 @@ usr/lib/libssl.so.1.1 #usr/share/man/man3/SSL_get_selected_srtp_profile.3 #usr/share/man/man3/SSL_get_server_random.3 #usr/share/man/man3/SSL_get_session.3 +#usr/share/man/man3/SSL_get_shared_ciphers.3 #usr/share/man/man3/SSL_get_shared_curve.3 #usr/share/man/man3/SSL_get_shared_sigalgs.3 #usr/share/man/man3/SSL_get_shutdown.3 @@ -5897,8 +5941,36 @@ usr/lib/libssl.so.1.1 #usr/share/man/man3/X509_EXTENSION_set_critical.3 #usr/share/man/man3/X509_EXTENSION_set_data.3 #usr/share/man/man3/X509_EXTENSION_set_object.3 +#usr/share/man/man3/X509_LOOKUP_ctrl_fn.3 #usr/share/man/man3/X509_LOOKUP_file.3 +#usr/share/man/man3/X509_LOOKUP_get_by_alias_fn.3 +#usr/share/man/man3/X509_LOOKUP_get_by_fingerprint_fn.3 +#usr/share/man/man3/X509_LOOKUP_get_by_issuer_serial_fn.3 +#usr/share/man/man3/X509_LOOKUP_get_by_subject_fn.3 +#usr/share/man/man3/X509_LOOKUP_get_method_data.3 +#usr/share/man/man3/X509_LOOKUP_get_store.3 #usr/share/man/man3/X509_LOOKUP_hash_dir.3 +#usr/share/man/man3/X509_LOOKUP_meth_free.3 +#usr/share/man/man3/X509_LOOKUP_meth_get_ctrl.3 +#usr/share/man/man3/X509_LOOKUP_meth_get_free.3 +#usr/share/man/man3/X509_LOOKUP_meth_get_get_by_alias.3 +#usr/share/man/man3/X509_LOOKUP_meth_get_get_by_fingerprint.3 +#usr/share/man/man3/X509_LOOKUP_meth_get_get_by_issuer_serial.3 +#usr/share/man/man3/X509_LOOKUP_meth_get_get_by_subject.3 +#usr/share/man/man3/X509_LOOKUP_meth_get_init.3 +#usr/share/man/man3/X509_LOOKUP_meth_get_new_item.3 +#usr/share/man/man3/X509_LOOKUP_meth_get_shutdown.3 +#usr/share/man/man3/X509_LOOKUP_meth_new.3 +#usr/share/man/man3/X509_LOOKUP_meth_set_ctrl.3 +#usr/share/man/man3/X509_LOOKUP_meth_set_free.3 +#usr/share/man/man3/X509_LOOKUP_meth_set_get_by_alias.3 +#usr/share/man/man3/X509_LOOKUP_meth_set_get_by_fingerprint.3 +#usr/share/man/man3/X509_LOOKUP_meth_set_get_by_issuer_serial.3 +#usr/share/man/man3/X509_LOOKUP_meth_set_get_by_subject.3 +#usr/share/man/man3/X509_LOOKUP_meth_set_init.3 +#usr/share/man/man3/X509_LOOKUP_meth_set_new_item.3 +#usr/share/man/man3/X509_LOOKUP_meth_set_shutdown.3 +#usr/share/man/man3/X509_LOOKUP_set_method_data.3 #usr/share/man/man3/X509_NAME_ENTRY_create_by_NID.3 #usr/share/man/man3/X509_NAME_ENTRY_create_by_OBJ.3 #usr/share/man/man3/X509_NAME_ENTRY_create_by_txt.3 @@ -5929,6 +6001,8 @@ usr/lib/libssl.so.1.1 #usr/share/man/man3/X509_NAME_print.3 #usr/share/man/man3/X509_NAME_print_ex.3 #usr/share/man/man3/X509_NAME_print_ex_fp.3 +#usr/share/man/man3/X509_OBJECT_set1_X509.3 +#usr/share/man/man3/X509_OBJECT_set1_X509_CRL.3 #usr/share/man/man3/X509_PUBKEY_free.3 #usr/share/man/man3/X509_PUBKEY_get.3 #usr/share/man/man3/X509_PUBKEY_get0.3 @@ -6074,6 +6148,7 @@ usr/lib/libssl.so.1.1 #usr/share/man/man3/X509_VERIFY_PARAM_get_auth_level.3 #usr/share/man/man3/X509_VERIFY_PARAM_get_depth.3 #usr/share/man/man3/X509_VERIFY_PARAM_get_flags.3 +#usr/share/man/man3/X509_VERIFY_PARAM_get_hostflags.3 #usr/share/man/man3/X509_VERIFY_PARAM_get_inh_flags.3 #usr/share/man/man3/X509_VERIFY_PARAM_get_time.3 #usr/share/man/man3/X509_VERIFY_PARAM_set1_email.3 @@ -6098,6 +6173,7 @@ usr/lib/libssl.so.1.1 #usr/share/man/man3/X509_check_ip.3 #usr/share/man/man3/X509_check_ip_asc.3 #usr/share/man/man3/X509_check_issued.3 +#usr/share/man/man3/X509_cmp_time.3 #usr/share/man/man3/X509_delete_ext.3 #usr/share/man/man3/X509_digest.3 #usr/share/man/man3/X509_dup.3 diff --git a/lfs/openssl b/lfs/openssl index 71f2bc826..94a08b97d 100644 --- a/lfs/openssl +++ b/lfs/openssl @@ -24,7 +24,7 @@ =20 include Config =20 -VER =3D 1.1.0h +VER =3D 1.1.0i =20 THISAPP =3D openssl-$(VER) DL_FILE =3D $(THISAPP).tar.gz @@ -87,7 +87,7 @@ objects =3D $(DL_FILE) =20 $(DL_FILE) =3D $(DL_FROM)/$(DL_FILE) =20 -$(DL_FILE)_MD5 =3D 5271477e4d93f4ea032b665ef095ff24 +$(DL_FILE)_MD5 =3D 9495126aafd2659d357ea66a969c3fe1 =20 install : $(TARGET) =20 diff --git a/lfs/openssl-compat b/lfs/openssl-compat index 9e991b496..d784903ba 100644 --- a/lfs/openssl-compat +++ b/lfs/openssl-compat @@ -24,7 +24,7 @@ =20 include Config =20 -VER =3D 1.0.2o +VER =3D 1.0.2p =20 THISAPP =3D openssl-$(VER) DL_FILE =3D $(THISAPP).tar.gz @@ -84,7 +84,7 @@ objects =3D $(DL_FILE) =20 $(DL_FILE) =3D $(DL_FROM)/$(DL_FILE) =20 -$(DL_FILE)_MD5 =3D 44279b8557c3247cbe324e2322ecd114 +$(DL_FILE)_MD5 =3D ac5eb30bf5798aa14b1ae6d0e7da58df =20 install : $(TARGET) =20 hooks/post-receive -- IPFire 2.x development tree --===============6309364097722729359==--