kpriv/freebsd-ports
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

security/openssl-devel: Update to 1.1.0i

Browse source 
- Includes vulnerability fixes that were already
   added to the port as patches
This commit is contained in:
Bernard Spil 2018-08-14 14:25:18 +00:00
parent de269f48f9
commit b8837b0fe6
Notes: svn2git 2021-03-31 03:12:20 +00:00 
svn path=/head/; revision=477158
5 changed files with 45 additions and 74 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
security/openssl-devel/Makefile
View file

@ -2,8 +2,7 @@
# $FreeBSD$
PORTNAME= openssl
PORTVERSION= 1.1.0h
PORTREVISION= 2
PORTVERSION= 1.1.0i
CATEGORIES= security devel
MASTER_SITES= https://www.openssl.org/source/ \
ftp://ftp.cert.dfn.de/pub/tools/net/openssl/source/

6
security/openssl-devel/distinfo
View file

@ -1,3 +1,3 @@
TIMESTAMP = 1522162483
SHA256 (openssl-1.1.0h.tar.gz) = 5835626cde9e99656585fc7aaa2302a73a7e1340bf8c14fd635a62c66802a517
SIZE (openssl-1.1.0h.tar.gz) = 5422717
TIMESTAMP = 1534254208
SHA256 (openssl-1.1.0i.tar.gz) = ebbfc844a8c8cc0ea5dc10b86c9ce97f401837f3fa08c17b2cdadc118253cf99
SIZE (openssl-1.1.0i.tar.gz) = 5453234

39
security/openssl-devel/files/patch-CVE-2018-0732
View file

@ -1,39 +0,0 @@
From ea7abeeabf92b7aca160bdd0208636d4da69f4f4 Mon Sep 17 00:00:00 2001
From: Guido Vranken <guidovranken@gmail.com>
Date: Mon, 11 Jun 2018 19:38:54 +0200
Subject: [PATCH] Reject excessively large primes in DH key generation.
CVE-2018-0732
Signed-off-by: Guido Vranken <guidovranken@gmail.com>
(cherry picked from commit 91f7361f47b082ae61ffe1a7b17bb2adf213c7fe)
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6457)
---
crypto/dh/dh_key.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/crypto/dh/dh_key.c b/crypto/dh/dh_key.c
index fce9ff47f36..58003d70878 100644
--- crypto/dh/dh_key.c.orig
+++ crypto/dh/dh_key.c
@@ -78,10 +78,15 @@ static int generate_key(DH *dh)
int ok = 0;
int generate_new_key = 0;
unsigned l;
- BN_CTX *ctx;
+ BN_CTX *ctx = NULL;
BN_MONT_CTX *mont = NULL;
BIGNUM *pub_key = NULL, *priv_key = NULL;
+ if (BN_num_bits(dh->p) > OPENSSL_DH_MAX_MODULUS_BITS) {
+ DHerr(DH_F_GENERATE_KEY, DH_R_MODULUS_TOO_LARGE);
+ return 0;
+ }
+
ctx = BN_CTX_new();
if (ctx == NULL)
goto err;

27
security/openssl-devel/files/patch-CVE-2018-7037
View file

@ -1,27 +0,0 @@
From 6939eab03a6e23d2bd2c3f5e34fe1d48e542e787 Mon Sep 17 00:00:00 2001
From: Billy Brumley <bbrumley@gmail.com>
Date: Wed, 11 Apr 2018 10:10:58 +0300
Subject: [PATCH] RSA key generation: ensure BN_mod_inverse and BN_mod_exp_mont
both get called with BN_FLG_CONSTTIME flag set.
CVE-2018-0737
Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
---
crypto/rsa/rsa_gen.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/crypto/rsa/rsa_gen.c b/crypto/rsa/rsa_gen.c
index 9af43e05863..79f77e3eafd 100644
--- crypto/rsa/rsa_gen.c.orig
+++ crypto/rsa/rsa_gen.c
@@ -89,6 +89,8 @@ static int rsa_builtin_keygen(RSA *rsa, int bits, BIGNUM *e_value,
if (BN_copy(rsa->e, e_value) == NULL)
goto err;
+ BN_set_flags(rsa->p, BN_FLG_CONSTTIME);
+ BN_set_flags(rsa->q, BN_FLG_CONSTTIME);
BN_set_flags(r2, BN_FLG_CONSTTIME);
/* generate p and q */
for (;;) {

44
security/openssl-devel/pkg-plist
View file

@ -598,9 +598,9 @@ man/man1/x509.1.gz
%%MAN3%%man/man3/BN_value_one.3.gz
%%MAN3%%man/man3/BN_with_flags.3.gz
%%MAN3%%man/man3/BN_zero.3.gz
%%MAN3%%man/man3/BUF_MEM_free.3.gz
%%MAN3%%man/man3/BUF_MEM_grow.3.gz
%%MAN3%%man/man3/BUF_MEM_grow_clean.3.gz
%%MAN3%%man/man3/BUF_MEM_free.3.gz
%%MAN3%%man/man3/BUF_MEM_new.3.gz
%%MAN3%%man/man3/BUF_MEM_new_ex.3.gz
%%MAN3%%man/man3/BUF_reverse.3.gz
@ -978,7 +978,6 @@ man/man1/x509.1.gz
%%MAN3%%man/man3/EC_KEY_get_enc_flags.3.gz
%%MAN3%%man/man3/EC_KEY_get_ex_data.3.gz
%%MAN3%%man/man3/EC_KEY_get_ex_new_index.3.gz
%%MAN3%%man/man3/EC_KEY_set_ex_data.3.gz
%%MAN3%%man/man3/EC_KEY_get_flags.3.gz
%%MAN3%%man/man3/EC_KEY_get_method.3.gz
%%MAN3%%man/man3/EC_KEY_key2buf.3.gz
@ -992,6 +991,7 @@ man/man1/x509.1.gz
%%MAN3%%man/man3/EC_KEY_set_asn1_flag.3.gz
%%MAN3%%man/man3/EC_KEY_set_conv_form.3.gz
%%MAN3%%man/man3/EC_KEY_set_enc_flags.3.gz
%%MAN3%%man/man3/EC_KEY_set_ex_data.3.gz
%%MAN3%%man/man3/EC_KEY_set_flags.3.gz
%%MAN3%%man/man3/EC_KEY_set_group.3.gz
%%MAN3%%man/man3/EC_KEY_set_method.3.gz
@ -1270,13 +1270,17 @@ man/man1/x509.1.gz
%%MAN3%%man/man3/EVP_EncryptInit_ex.3.gz
%%MAN3%%man/man3/EVP_EncryptUpdate.3.gz
%%MAN3%%man/man3/EVP_MD_CTX_block_size.3.gz
%%MAN3%%man/man3/EVP_MD_CTX_clear_flags.3.gz
%%MAN3%%man/man3/EVP_MD_CTX_copy.3.gz
%%MAN3%%man/man3/EVP_MD_CTX_copy_ex.3.gz
%%MAN3%%man/man3/EVP_MD_CTX_free.3.gz
%%MAN3%%man/man3/EVP_MD_CTX_md.3.gz
%%MAN3%%man/man3/EVP_MD_CTX_md_data.3.gz
%%MAN3%%man/man3/EVP_MD_CTX_new.3.gz
%%MAN3%%man/man3/EVP_MD_CTX_reset.3.gz
%%MAN3%%man/man3/EVP_MD_CTX_set_flags.3.gz
%%MAN3%%man/man3/EVP_MD_CTX_size.3.gz
%%MAN3%%man/man3/EVP_MD_CTX_test_flags.3.gz
%%MAN3%%man/man3/EVP_MD_CTX_type.3.gz
%%MAN3%%man/man3/EVP_MD_block_size.3.gz
%%MAN3%%man/man3/EVP_MD_meth_dup.3.gz
@ -1449,8 +1453,8 @@ man/man1/x509.1.gz
%%MAN3%%man/man3/EVP_cast5_cfb.3.gz
%%MAN3%%man/man3/EVP_cast5_ecb.3.gz
%%MAN3%%man/man3/EVP_cast5_ofb.3.gz
%%MAN3%%man/man3/EVP_chacha20_poly1305.3.gz
%%MAN3%%man/man3/EVP_chacha20.3.gz
%%MAN3%%man/man3/EVP_chacha20_poly1305.3.gz
%%MAN3%%man/man3/EVP_cleanup.3.gz
%%MAN3%%man/man3/EVP_des_cbc.3.gz
%%MAN3%%man/man3/EVP_des_cfb.3.gz
@ -1613,6 +1617,7 @@ man/man1/x509.1.gz
%%MAN3%%man/man3/OCSP_SINGLERESP_free.3.gz
%%MAN3%%man/man3/OCSP_SINGLERESP_new.3.gz
%%MAN3%%man/man3/OCSP_basic_add1_nonce.3.gz
%%MAN3%%man/man3/OCSP_basic_verify.3.gz
%%MAN3%%man/man3/OCSP_cert_id_new.3.gz
%%MAN3%%man/man3/OCSP_cert_to_id.3.gz
%%MAN3%%man/man3/OCSP_check_nonce.3.gz
@ -2349,6 +2354,7 @@ man/man1/x509.1.gz
%%MAN3%%man/man3/SSL_get_selected_srtp_profile.3.gz
%%MAN3%%man/man3/SSL_get_server_random.3.gz
%%MAN3%%man/man3/SSL_get_session.3.gz
%%MAN3%%man/man3/SSL_get_shared_ciphers.3.gz
%%MAN3%%man/man3/SSL_get_shared_curve.3.gz
%%MAN3%%man/man3/SSL_get_shared_sigalgs.3.gz
%%MAN3%%man/man3/SSL_get_shutdown.3.gz
@ -2636,8 +2642,36 @@ man/man1/x509.1.gz
%%MAN3%%man/man3/X509_EXTENSION_set_critical.3.gz
%%MAN3%%man/man3/X509_EXTENSION_set_data.3.gz
%%MAN3%%man/man3/X509_EXTENSION_set_object.3.gz
%%MAN3%%man/man3/X509_LOOKUP_ctrl_fn.3.gz
%%MAN3%%man/man3/X509_LOOKUP_file.3.gz
%%MAN3%%man/man3/X509_LOOKUP_get_by_alias_fn.3.gz
%%MAN3%%man/man3/X509_LOOKUP_get_by_fingerprint_fn.3.gz
%%MAN3%%man/man3/X509_LOOKUP_get_by_issuer_serial_fn.3.gz
%%MAN3%%man/man3/X509_LOOKUP_get_by_subject_fn.3.gz
%%MAN3%%man/man3/X509_LOOKUP_get_method_data.3.gz
%%MAN3%%man/man3/X509_LOOKUP_get_store.3.gz
%%MAN3%%man/man3/X509_LOOKUP_hash_dir.3.gz
%%MAN3%%man/man3/X509_LOOKUP_meth_free.3.gz
%%MAN3%%man/man3/X509_LOOKUP_meth_get_ctrl.3.gz
%%MAN3%%man/man3/X509_LOOKUP_meth_get_free.3.gz
%%MAN3%%man/man3/X509_LOOKUP_meth_get_get_by_alias.3.gz
%%MAN3%%man/man3/X509_LOOKUP_meth_get_get_by_fingerprint.3.gz
%%MAN3%%man/man3/X509_LOOKUP_meth_get_get_by_issuer_serial.3.gz
%%MAN3%%man/man3/X509_LOOKUP_meth_get_get_by_subject.3.gz
%%MAN3%%man/man3/X509_LOOKUP_meth_get_init.3.gz
%%MAN3%%man/man3/X509_LOOKUP_meth_get_new_item.3.gz
%%MAN3%%man/man3/X509_LOOKUP_meth_get_shutdown.3.gz
%%MAN3%%man/man3/X509_LOOKUP_meth_new.3.gz
%%MAN3%%man/man3/X509_LOOKUP_meth_set_ctrl.3.gz
%%MAN3%%man/man3/X509_LOOKUP_meth_set_free.3.gz
%%MAN3%%man/man3/X509_LOOKUP_meth_set_get_by_alias.3.gz
%%MAN3%%man/man3/X509_LOOKUP_meth_set_get_by_fingerprint.3.gz
%%MAN3%%man/man3/X509_LOOKUP_meth_set_get_by_issuer_serial.3.gz
%%MAN3%%man/man3/X509_LOOKUP_meth_set_get_by_subject.3.gz
%%MAN3%%man/man3/X509_LOOKUP_meth_set_init.3.gz
%%MAN3%%man/man3/X509_LOOKUP_meth_set_new_item.3.gz
%%MAN3%%man/man3/X509_LOOKUP_meth_set_shutdown.3.gz
%%MAN3%%man/man3/X509_LOOKUP_set_method_data.3.gz
%%MAN3%%man/man3/X509_NAME_ENTRY_create_by_NID.3.gz
%%MAN3%%man/man3/X509_NAME_ENTRY_create_by_OBJ.3.gz
%%MAN3%%man/man3/X509_NAME_ENTRY_create_by_txt.3.gz
@ -2668,6 +2702,8 @@ man/man1/x509.1.gz
%%MAN3%%man/man3/X509_NAME_print.3.gz
%%MAN3%%man/man3/X509_NAME_print_ex.3.gz
%%MAN3%%man/man3/X509_NAME_print_ex_fp.3.gz
%%MAN3%%man/man3/X509_OBJECT_set1_X509.3.gz
%%MAN3%%man/man3/X509_OBJECT_set1_X509_CRL.3.gz
%%MAN3%%man/man3/X509_PUBKEY_free.3.gz
%%MAN3%%man/man3/X509_PUBKEY_get.3.gz
%%MAN3%%man/man3/X509_PUBKEY_get0.3.gz
@ -2813,6 +2849,7 @@ man/man1/x509.1.gz
%%MAN3%%man/man3/X509_VERIFY_PARAM_get_auth_level.3.gz
%%MAN3%%man/man3/X509_VERIFY_PARAM_get_depth.3.gz
%%MAN3%%man/man3/X509_VERIFY_PARAM_get_flags.3.gz
%%MAN3%%man/man3/X509_VERIFY_PARAM_get_hostflags.3.gz
%%MAN3%%man/man3/X509_VERIFY_PARAM_get_inh_flags.3.gz
%%MAN3%%man/man3/X509_VERIFY_PARAM_get_time.3.gz
%%MAN3%%man/man3/X509_VERIFY_PARAM_set1_email.3.gz
@ -2837,6 +2874,7 @@ man/man1/x509.1.gz
%%MAN3%%man/man3/X509_check_ip.3.gz
%%MAN3%%man/man3/X509_check_ip_asc.3.gz
%%MAN3%%man/man3/X509_check_issued.3.gz
%%MAN3%%man/man3/X509_cmp_time.3.gz
%%MAN3%%man/man3/X509_delete_ext.3.gz
%%MAN3%%man/man3/X509_digest.3.gz
%%MAN3%%man/man3/X509_dup.3.gz