mirror of
https://git.FreeBSD.org/ports.git
synced 2024-12-23 04:23:08 +00:00
security/openssl-devel: Update to 1.1.0i
- Includes vulnerability fixes that were already added to the port as patches
This commit is contained in:
parent
de269f48f9
commit
b8837b0fe6
Notes:
svn2git
2021-03-31 03:12:20 +00:00
svn path=/head/; revision=477158
@ -2,8 +2,7 @@
|
||||
# $FreeBSD$
|
||||
|
||||
PORTNAME= openssl
|
||||
PORTVERSION= 1.1.0h
|
||||
PORTREVISION= 2
|
||||
PORTVERSION= 1.1.0i
|
||||
CATEGORIES= security devel
|
||||
MASTER_SITES= https://www.openssl.org/source/ \
|
||||
ftp://ftp.cert.dfn.de/pub/tools/net/openssl/source/
|
||||
|
@ -1,3 +1,3 @@
|
||||
TIMESTAMP = 1522162483
|
||||
SHA256 (openssl-1.1.0h.tar.gz) = 5835626cde9e99656585fc7aaa2302a73a7e1340bf8c14fd635a62c66802a517
|
||||
SIZE (openssl-1.1.0h.tar.gz) = 5422717
|
||||
TIMESTAMP = 1534254208
|
||||
SHA256 (openssl-1.1.0i.tar.gz) = ebbfc844a8c8cc0ea5dc10b86c9ce97f401837f3fa08c17b2cdadc118253cf99
|
||||
SIZE (openssl-1.1.0i.tar.gz) = 5453234
|
||||
|
@ -1,39 +0,0 @@
|
||||
From ea7abeeabf92b7aca160bdd0208636d4da69f4f4 Mon Sep 17 00:00:00 2001
|
||||
From: Guido Vranken <guidovranken@gmail.com>
|
||||
Date: Mon, 11 Jun 2018 19:38:54 +0200
|
||||
Subject: [PATCH] Reject excessively large primes in DH key generation.
|
||||
|
||||
CVE-2018-0732
|
||||
|
||||
Signed-off-by: Guido Vranken <guidovranken@gmail.com>
|
||||
|
||||
(cherry picked from commit 91f7361f47b082ae61ffe1a7b17bb2adf213c7fe)
|
||||
|
||||
Reviewed-by: Tim Hudson <tjh@openssl.org>
|
||||
Reviewed-by: Matt Caswell <matt@openssl.org>
|
||||
(Merged from https://github.com/openssl/openssl/pull/6457)
|
||||
---
|
||||
crypto/dh/dh_key.c | 7 ++++++-
|
||||
1 file changed, 6 insertions(+), 1 deletion(-)
|
||||
|
||||
diff --git a/crypto/dh/dh_key.c b/crypto/dh/dh_key.c
|
||||
index fce9ff47f36..58003d70878 100644
|
||||
--- crypto/dh/dh_key.c.orig
|
||||
+++ crypto/dh/dh_key.c
|
||||
@@ -78,10 +78,15 @@ static int generate_key(DH *dh)
|
||||
int ok = 0;
|
||||
int generate_new_key = 0;
|
||||
unsigned l;
|
||||
- BN_CTX *ctx;
|
||||
+ BN_CTX *ctx = NULL;
|
||||
BN_MONT_CTX *mont = NULL;
|
||||
BIGNUM *pub_key = NULL, *priv_key = NULL;
|
||||
|
||||
+ if (BN_num_bits(dh->p) > OPENSSL_DH_MAX_MODULUS_BITS) {
|
||||
+ DHerr(DH_F_GENERATE_KEY, DH_R_MODULUS_TOO_LARGE);
|
||||
+ return 0;
|
||||
+ }
|
||||
+
|
||||
ctx = BN_CTX_new();
|
||||
if (ctx == NULL)
|
||||
goto err;
|
@ -1,27 +0,0 @@
|
||||
From 6939eab03a6e23d2bd2c3f5e34fe1d48e542e787 Mon Sep 17 00:00:00 2001
|
||||
From: Billy Brumley <bbrumley@gmail.com>
|
||||
Date: Wed, 11 Apr 2018 10:10:58 +0300
|
||||
Subject: [PATCH] RSA key generation: ensure BN_mod_inverse and BN_mod_exp_mont
|
||||
both get called with BN_FLG_CONSTTIME flag set.
|
||||
|
||||
CVE-2018-0737
|
||||
|
||||
Reviewed-by: Rich Salz <rsalz@openssl.org>
|
||||
Reviewed-by: Matt Caswell <matt@openssl.org>
|
||||
---
|
||||
crypto/rsa/rsa_gen.c | 2 ++
|
||||
1 file changed, 2 insertions(+)
|
||||
|
||||
diff --git a/crypto/rsa/rsa_gen.c b/crypto/rsa/rsa_gen.c
|
||||
index 9af43e05863..79f77e3eafd 100644
|
||||
--- crypto/rsa/rsa_gen.c.orig
|
||||
+++ crypto/rsa/rsa_gen.c
|
||||
@@ -89,6 +89,8 @@ static int rsa_builtin_keygen(RSA *rsa, int bits, BIGNUM *e_value,
|
||||
if (BN_copy(rsa->e, e_value) == NULL)
|
||||
goto err;
|
||||
|
||||
+ BN_set_flags(rsa->p, BN_FLG_CONSTTIME);
|
||||
+ BN_set_flags(rsa->q, BN_FLG_CONSTTIME);
|
||||
BN_set_flags(r2, BN_FLG_CONSTTIME);
|
||||
/* generate p and q */
|
||||
for (;;) {
|
@ -598,9 +598,9 @@ man/man1/x509.1.gz
|
||||
%%MAN3%%man/man3/BN_value_one.3.gz
|
||||
%%MAN3%%man/man3/BN_with_flags.3.gz
|
||||
%%MAN3%%man/man3/BN_zero.3.gz
|
||||
%%MAN3%%man/man3/BUF_MEM_free.3.gz
|
||||
%%MAN3%%man/man3/BUF_MEM_grow.3.gz
|
||||
%%MAN3%%man/man3/BUF_MEM_grow_clean.3.gz
|
||||
%%MAN3%%man/man3/BUF_MEM_free.3.gz
|
||||
%%MAN3%%man/man3/BUF_MEM_new.3.gz
|
||||
%%MAN3%%man/man3/BUF_MEM_new_ex.3.gz
|
||||
%%MAN3%%man/man3/BUF_reverse.3.gz
|
||||
@ -978,7 +978,6 @@ man/man1/x509.1.gz
|
||||
%%MAN3%%man/man3/EC_KEY_get_enc_flags.3.gz
|
||||
%%MAN3%%man/man3/EC_KEY_get_ex_data.3.gz
|
||||
%%MAN3%%man/man3/EC_KEY_get_ex_new_index.3.gz
|
||||
%%MAN3%%man/man3/EC_KEY_set_ex_data.3.gz
|
||||
%%MAN3%%man/man3/EC_KEY_get_flags.3.gz
|
||||
%%MAN3%%man/man3/EC_KEY_get_method.3.gz
|
||||
%%MAN3%%man/man3/EC_KEY_key2buf.3.gz
|
||||
@ -992,6 +991,7 @@ man/man1/x509.1.gz
|
||||
%%MAN3%%man/man3/EC_KEY_set_asn1_flag.3.gz
|
||||
%%MAN3%%man/man3/EC_KEY_set_conv_form.3.gz
|
||||
%%MAN3%%man/man3/EC_KEY_set_enc_flags.3.gz
|
||||
%%MAN3%%man/man3/EC_KEY_set_ex_data.3.gz
|
||||
%%MAN3%%man/man3/EC_KEY_set_flags.3.gz
|
||||
%%MAN3%%man/man3/EC_KEY_set_group.3.gz
|
||||
%%MAN3%%man/man3/EC_KEY_set_method.3.gz
|
||||
@ -1270,13 +1270,17 @@ man/man1/x509.1.gz
|
||||
%%MAN3%%man/man3/EVP_EncryptInit_ex.3.gz
|
||||
%%MAN3%%man/man3/EVP_EncryptUpdate.3.gz
|
||||
%%MAN3%%man/man3/EVP_MD_CTX_block_size.3.gz
|
||||
%%MAN3%%man/man3/EVP_MD_CTX_clear_flags.3.gz
|
||||
%%MAN3%%man/man3/EVP_MD_CTX_copy.3.gz
|
||||
%%MAN3%%man/man3/EVP_MD_CTX_copy_ex.3.gz
|
||||
%%MAN3%%man/man3/EVP_MD_CTX_free.3.gz
|
||||
%%MAN3%%man/man3/EVP_MD_CTX_md.3.gz
|
||||
%%MAN3%%man/man3/EVP_MD_CTX_md_data.3.gz
|
||||
%%MAN3%%man/man3/EVP_MD_CTX_new.3.gz
|
||||
%%MAN3%%man/man3/EVP_MD_CTX_reset.3.gz
|
||||
%%MAN3%%man/man3/EVP_MD_CTX_set_flags.3.gz
|
||||
%%MAN3%%man/man3/EVP_MD_CTX_size.3.gz
|
||||
%%MAN3%%man/man3/EVP_MD_CTX_test_flags.3.gz
|
||||
%%MAN3%%man/man3/EVP_MD_CTX_type.3.gz
|
||||
%%MAN3%%man/man3/EVP_MD_block_size.3.gz
|
||||
%%MAN3%%man/man3/EVP_MD_meth_dup.3.gz
|
||||
@ -1449,8 +1453,8 @@ man/man1/x509.1.gz
|
||||
%%MAN3%%man/man3/EVP_cast5_cfb.3.gz
|
||||
%%MAN3%%man/man3/EVP_cast5_ecb.3.gz
|
||||
%%MAN3%%man/man3/EVP_cast5_ofb.3.gz
|
||||
%%MAN3%%man/man3/EVP_chacha20_poly1305.3.gz
|
||||
%%MAN3%%man/man3/EVP_chacha20.3.gz
|
||||
%%MAN3%%man/man3/EVP_chacha20_poly1305.3.gz
|
||||
%%MAN3%%man/man3/EVP_cleanup.3.gz
|
||||
%%MAN3%%man/man3/EVP_des_cbc.3.gz
|
||||
%%MAN3%%man/man3/EVP_des_cfb.3.gz
|
||||
@ -1613,6 +1617,7 @@ man/man1/x509.1.gz
|
||||
%%MAN3%%man/man3/OCSP_SINGLERESP_free.3.gz
|
||||
%%MAN3%%man/man3/OCSP_SINGLERESP_new.3.gz
|
||||
%%MAN3%%man/man3/OCSP_basic_add1_nonce.3.gz
|
||||
%%MAN3%%man/man3/OCSP_basic_verify.3.gz
|
||||
%%MAN3%%man/man3/OCSP_cert_id_new.3.gz
|
||||
%%MAN3%%man/man3/OCSP_cert_to_id.3.gz
|
||||
%%MAN3%%man/man3/OCSP_check_nonce.3.gz
|
||||
@ -2349,6 +2354,7 @@ man/man1/x509.1.gz
|
||||
%%MAN3%%man/man3/SSL_get_selected_srtp_profile.3.gz
|
||||
%%MAN3%%man/man3/SSL_get_server_random.3.gz
|
||||
%%MAN3%%man/man3/SSL_get_session.3.gz
|
||||
%%MAN3%%man/man3/SSL_get_shared_ciphers.3.gz
|
||||
%%MAN3%%man/man3/SSL_get_shared_curve.3.gz
|
||||
%%MAN3%%man/man3/SSL_get_shared_sigalgs.3.gz
|
||||
%%MAN3%%man/man3/SSL_get_shutdown.3.gz
|
||||
@ -2636,8 +2642,36 @@ man/man1/x509.1.gz
|
||||
%%MAN3%%man/man3/X509_EXTENSION_set_critical.3.gz
|
||||
%%MAN3%%man/man3/X509_EXTENSION_set_data.3.gz
|
||||
%%MAN3%%man/man3/X509_EXTENSION_set_object.3.gz
|
||||
%%MAN3%%man/man3/X509_LOOKUP_ctrl_fn.3.gz
|
||||
%%MAN3%%man/man3/X509_LOOKUP_file.3.gz
|
||||
%%MAN3%%man/man3/X509_LOOKUP_get_by_alias_fn.3.gz
|
||||
%%MAN3%%man/man3/X509_LOOKUP_get_by_fingerprint_fn.3.gz
|
||||
%%MAN3%%man/man3/X509_LOOKUP_get_by_issuer_serial_fn.3.gz
|
||||
%%MAN3%%man/man3/X509_LOOKUP_get_by_subject_fn.3.gz
|
||||
%%MAN3%%man/man3/X509_LOOKUP_get_method_data.3.gz
|
||||
%%MAN3%%man/man3/X509_LOOKUP_get_store.3.gz
|
||||
%%MAN3%%man/man3/X509_LOOKUP_hash_dir.3.gz
|
||||
%%MAN3%%man/man3/X509_LOOKUP_meth_free.3.gz
|
||||
%%MAN3%%man/man3/X509_LOOKUP_meth_get_ctrl.3.gz
|
||||
%%MAN3%%man/man3/X509_LOOKUP_meth_get_free.3.gz
|
||||
%%MAN3%%man/man3/X509_LOOKUP_meth_get_get_by_alias.3.gz
|
||||
%%MAN3%%man/man3/X509_LOOKUP_meth_get_get_by_fingerprint.3.gz
|
||||
%%MAN3%%man/man3/X509_LOOKUP_meth_get_get_by_issuer_serial.3.gz
|
||||
%%MAN3%%man/man3/X509_LOOKUP_meth_get_get_by_subject.3.gz
|
||||
%%MAN3%%man/man3/X509_LOOKUP_meth_get_init.3.gz
|
||||
%%MAN3%%man/man3/X509_LOOKUP_meth_get_new_item.3.gz
|
||||
%%MAN3%%man/man3/X509_LOOKUP_meth_get_shutdown.3.gz
|
||||
%%MAN3%%man/man3/X509_LOOKUP_meth_new.3.gz
|
||||
%%MAN3%%man/man3/X509_LOOKUP_meth_set_ctrl.3.gz
|
||||
%%MAN3%%man/man3/X509_LOOKUP_meth_set_free.3.gz
|
||||
%%MAN3%%man/man3/X509_LOOKUP_meth_set_get_by_alias.3.gz
|
||||
%%MAN3%%man/man3/X509_LOOKUP_meth_set_get_by_fingerprint.3.gz
|
||||
%%MAN3%%man/man3/X509_LOOKUP_meth_set_get_by_issuer_serial.3.gz
|
||||
%%MAN3%%man/man3/X509_LOOKUP_meth_set_get_by_subject.3.gz
|
||||
%%MAN3%%man/man3/X509_LOOKUP_meth_set_init.3.gz
|
||||
%%MAN3%%man/man3/X509_LOOKUP_meth_set_new_item.3.gz
|
||||
%%MAN3%%man/man3/X509_LOOKUP_meth_set_shutdown.3.gz
|
||||
%%MAN3%%man/man3/X509_LOOKUP_set_method_data.3.gz
|
||||
%%MAN3%%man/man3/X509_NAME_ENTRY_create_by_NID.3.gz
|
||||
%%MAN3%%man/man3/X509_NAME_ENTRY_create_by_OBJ.3.gz
|
||||
%%MAN3%%man/man3/X509_NAME_ENTRY_create_by_txt.3.gz
|
||||
@ -2668,6 +2702,8 @@ man/man1/x509.1.gz
|
||||
%%MAN3%%man/man3/X509_NAME_print.3.gz
|
||||
%%MAN3%%man/man3/X509_NAME_print_ex.3.gz
|
||||
%%MAN3%%man/man3/X509_NAME_print_ex_fp.3.gz
|
||||
%%MAN3%%man/man3/X509_OBJECT_set1_X509.3.gz
|
||||
%%MAN3%%man/man3/X509_OBJECT_set1_X509_CRL.3.gz
|
||||
%%MAN3%%man/man3/X509_PUBKEY_free.3.gz
|
||||
%%MAN3%%man/man3/X509_PUBKEY_get.3.gz
|
||||
%%MAN3%%man/man3/X509_PUBKEY_get0.3.gz
|
||||
@ -2813,6 +2849,7 @@ man/man1/x509.1.gz
|
||||
%%MAN3%%man/man3/X509_VERIFY_PARAM_get_auth_level.3.gz
|
||||
%%MAN3%%man/man3/X509_VERIFY_PARAM_get_depth.3.gz
|
||||
%%MAN3%%man/man3/X509_VERIFY_PARAM_get_flags.3.gz
|
||||
%%MAN3%%man/man3/X509_VERIFY_PARAM_get_hostflags.3.gz
|
||||
%%MAN3%%man/man3/X509_VERIFY_PARAM_get_inh_flags.3.gz
|
||||
%%MAN3%%man/man3/X509_VERIFY_PARAM_get_time.3.gz
|
||||
%%MAN3%%man/man3/X509_VERIFY_PARAM_set1_email.3.gz
|
||||
@ -2837,6 +2874,7 @@ man/man1/x509.1.gz
|
||||
%%MAN3%%man/man3/X509_check_ip.3.gz
|
||||
%%MAN3%%man/man3/X509_check_ip_asc.3.gz
|
||||
%%MAN3%%man/man3/X509_check_issued.3.gz
|
||||
%%MAN3%%man/man3/X509_cmp_time.3.gz
|
||||
%%MAN3%%man/man3/X509_delete_ext.3.gz
|
||||
%%MAN3%%man/man3/X509_digest.3.gz
|
||||
%%MAN3%%man/man3/X509_dup.3.gz
|
||||
|
Loading…
Reference in New Issue
Block a user