From b8837b0fe65a83b5a5d7cf9d470cb8984c6b6b79 Mon Sep 17 00:00:00 2001 From: Bernard Spil Date: Tue, 14 Aug 2018 14:25:18 +0000 Subject: [PATCH] security/openssl-devel: Update to 1.1.0i - Includes vulnerability fixes that were already added to the port as patches --- security/openssl-devel/Makefile | 3 +- security/openssl-devel/distinfo | 6 +-- .../openssl-devel/files/patch-CVE-2018-0732 | 39 ---------------- .../openssl-devel/files/patch-CVE-2018-7037 | 27 ------------ security/openssl-devel/pkg-plist | 44 +++++++++++++++++-- 5 files changed, 45 insertions(+), 74 deletions(-) delete mode 100644 security/openssl-devel/files/patch-CVE-2018-0732 delete mode 100644 security/openssl-devel/files/patch-CVE-2018-7037 diff --git a/security/openssl-devel/Makefile b/security/openssl-devel/Makefile index 07ef24c50430..e0fbfb0efaa3 100644 --- a/security/openssl-devel/Makefile +++ b/security/openssl-devel/Makefile @@ -2,8 +2,7 @@ # $FreeBSD$ PORTNAME= openssl -PORTVERSION= 1.1.0h -PORTREVISION= 2 +PORTVERSION= 1.1.0i CATEGORIES= security devel MASTER_SITES= https://www.openssl.org/source/ \ ftp://ftp.cert.dfn.de/pub/tools/net/openssl/source/ diff --git a/security/openssl-devel/distinfo b/security/openssl-devel/distinfo index aad60dbcdc78..412680cd2c8f 100644 --- a/security/openssl-devel/distinfo +++ b/security/openssl-devel/distinfo @@ -1,3 +1,3 @@ -TIMESTAMP = 1522162483 -SHA256 (openssl-1.1.0h.tar.gz) = 5835626cde9e99656585fc7aaa2302a73a7e1340bf8c14fd635a62c66802a517 -SIZE (openssl-1.1.0h.tar.gz) = 5422717 +TIMESTAMP = 1534254208 +SHA256 (openssl-1.1.0i.tar.gz) = ebbfc844a8c8cc0ea5dc10b86c9ce97f401837f3fa08c17b2cdadc118253cf99 +SIZE (openssl-1.1.0i.tar.gz) = 5453234 diff --git a/security/openssl-devel/files/patch-CVE-2018-0732 b/security/openssl-devel/files/patch-CVE-2018-0732 deleted file mode 100644 index ccc444c8bf5c..000000000000 --- a/security/openssl-devel/files/patch-CVE-2018-0732 +++ /dev/null @@ -1,39 +0,0 @@ -From ea7abeeabf92b7aca160bdd0208636d4da69f4f4 Mon Sep 17 00:00:00 2001 -From: Guido Vranken -Date: Mon, 11 Jun 2018 19:38:54 +0200 -Subject: [PATCH] Reject excessively large primes in DH key generation. - -CVE-2018-0732 - -Signed-off-by: Guido Vranken - -(cherry picked from commit 91f7361f47b082ae61ffe1a7b17bb2adf213c7fe) - -Reviewed-by: Tim Hudson -Reviewed-by: Matt Caswell -(Merged from https://github.com/openssl/openssl/pull/6457) ---- - crypto/dh/dh_key.c | 7 ++++++- - 1 file changed, 6 insertions(+), 1 deletion(-) - -diff --git a/crypto/dh/dh_key.c b/crypto/dh/dh_key.c -index fce9ff47f36..58003d70878 100644 ---- crypto/dh/dh_key.c.orig -+++ crypto/dh/dh_key.c -@@ -78,10 +78,15 @@ static int generate_key(DH *dh) - int ok = 0; - int generate_new_key = 0; - unsigned l; -- BN_CTX *ctx; -+ BN_CTX *ctx = NULL; - BN_MONT_CTX *mont = NULL; - BIGNUM *pub_key = NULL, *priv_key = NULL; - -+ if (BN_num_bits(dh->p) > OPENSSL_DH_MAX_MODULUS_BITS) { -+ DHerr(DH_F_GENERATE_KEY, DH_R_MODULUS_TOO_LARGE); -+ return 0; -+ } -+ - ctx = BN_CTX_new(); - if (ctx == NULL) - goto err; diff --git a/security/openssl-devel/files/patch-CVE-2018-7037 b/security/openssl-devel/files/patch-CVE-2018-7037 deleted file mode 100644 index fb2c5a176031..000000000000 --- a/security/openssl-devel/files/patch-CVE-2018-7037 +++ /dev/null @@ -1,27 +0,0 @@ -From 6939eab03a6e23d2bd2c3f5e34fe1d48e542e787 Mon Sep 17 00:00:00 2001 -From: Billy Brumley -Date: Wed, 11 Apr 2018 10:10:58 +0300 -Subject: [PATCH] RSA key generation: ensure BN_mod_inverse and BN_mod_exp_mont - both get called with BN_FLG_CONSTTIME flag set. - -CVE-2018-0737 - -Reviewed-by: Rich Salz -Reviewed-by: Matt Caswell ---- - crypto/rsa/rsa_gen.c | 2 ++ - 1 file changed, 2 insertions(+) - -diff --git a/crypto/rsa/rsa_gen.c b/crypto/rsa/rsa_gen.c -index 9af43e05863..79f77e3eafd 100644 ---- crypto/rsa/rsa_gen.c.orig -+++ crypto/rsa/rsa_gen.c -@@ -89,6 +89,8 @@ static int rsa_builtin_keygen(RSA *rsa, int bits, BIGNUM *e_value, - if (BN_copy(rsa->e, e_value) == NULL) - goto err; - -+ BN_set_flags(rsa->p, BN_FLG_CONSTTIME); -+ BN_set_flags(rsa->q, BN_FLG_CONSTTIME); - BN_set_flags(r2, BN_FLG_CONSTTIME); - /* generate p and q */ - for (;;) { diff --git a/security/openssl-devel/pkg-plist b/security/openssl-devel/pkg-plist index 227a7fcfd297..cd7f68505bbd 100644 --- a/security/openssl-devel/pkg-plist +++ b/security/openssl-devel/pkg-plist @@ -598,9 +598,9 @@ man/man1/x509.1.gz %%MAN3%%man/man3/BN_value_one.3.gz %%MAN3%%man/man3/BN_with_flags.3.gz %%MAN3%%man/man3/BN_zero.3.gz +%%MAN3%%man/man3/BUF_MEM_free.3.gz %%MAN3%%man/man3/BUF_MEM_grow.3.gz %%MAN3%%man/man3/BUF_MEM_grow_clean.3.gz -%%MAN3%%man/man3/BUF_MEM_free.3.gz %%MAN3%%man/man3/BUF_MEM_new.3.gz %%MAN3%%man/man3/BUF_MEM_new_ex.3.gz %%MAN3%%man/man3/BUF_reverse.3.gz @@ -978,7 +978,6 @@ man/man1/x509.1.gz %%MAN3%%man/man3/EC_KEY_get_enc_flags.3.gz %%MAN3%%man/man3/EC_KEY_get_ex_data.3.gz %%MAN3%%man/man3/EC_KEY_get_ex_new_index.3.gz -%%MAN3%%man/man3/EC_KEY_set_ex_data.3.gz %%MAN3%%man/man3/EC_KEY_get_flags.3.gz %%MAN3%%man/man3/EC_KEY_get_method.3.gz %%MAN3%%man/man3/EC_KEY_key2buf.3.gz @@ -992,6 +991,7 @@ man/man1/x509.1.gz %%MAN3%%man/man3/EC_KEY_set_asn1_flag.3.gz %%MAN3%%man/man3/EC_KEY_set_conv_form.3.gz %%MAN3%%man/man3/EC_KEY_set_enc_flags.3.gz +%%MAN3%%man/man3/EC_KEY_set_ex_data.3.gz %%MAN3%%man/man3/EC_KEY_set_flags.3.gz %%MAN3%%man/man3/EC_KEY_set_group.3.gz %%MAN3%%man/man3/EC_KEY_set_method.3.gz @@ -1270,13 +1270,17 @@ man/man1/x509.1.gz %%MAN3%%man/man3/EVP_EncryptInit_ex.3.gz %%MAN3%%man/man3/EVP_EncryptUpdate.3.gz %%MAN3%%man/man3/EVP_MD_CTX_block_size.3.gz +%%MAN3%%man/man3/EVP_MD_CTX_clear_flags.3.gz %%MAN3%%man/man3/EVP_MD_CTX_copy.3.gz %%MAN3%%man/man3/EVP_MD_CTX_copy_ex.3.gz %%MAN3%%man/man3/EVP_MD_CTX_free.3.gz %%MAN3%%man/man3/EVP_MD_CTX_md.3.gz +%%MAN3%%man/man3/EVP_MD_CTX_md_data.3.gz %%MAN3%%man/man3/EVP_MD_CTX_new.3.gz %%MAN3%%man/man3/EVP_MD_CTX_reset.3.gz +%%MAN3%%man/man3/EVP_MD_CTX_set_flags.3.gz %%MAN3%%man/man3/EVP_MD_CTX_size.3.gz +%%MAN3%%man/man3/EVP_MD_CTX_test_flags.3.gz %%MAN3%%man/man3/EVP_MD_CTX_type.3.gz %%MAN3%%man/man3/EVP_MD_block_size.3.gz %%MAN3%%man/man3/EVP_MD_meth_dup.3.gz @@ -1449,8 +1453,8 @@ man/man1/x509.1.gz %%MAN3%%man/man3/EVP_cast5_cfb.3.gz %%MAN3%%man/man3/EVP_cast5_ecb.3.gz %%MAN3%%man/man3/EVP_cast5_ofb.3.gz -%%MAN3%%man/man3/EVP_chacha20_poly1305.3.gz %%MAN3%%man/man3/EVP_chacha20.3.gz +%%MAN3%%man/man3/EVP_chacha20_poly1305.3.gz %%MAN3%%man/man3/EVP_cleanup.3.gz %%MAN3%%man/man3/EVP_des_cbc.3.gz %%MAN3%%man/man3/EVP_des_cfb.3.gz @@ -1613,6 +1617,7 @@ man/man1/x509.1.gz %%MAN3%%man/man3/OCSP_SINGLERESP_free.3.gz %%MAN3%%man/man3/OCSP_SINGLERESP_new.3.gz %%MAN3%%man/man3/OCSP_basic_add1_nonce.3.gz +%%MAN3%%man/man3/OCSP_basic_verify.3.gz %%MAN3%%man/man3/OCSP_cert_id_new.3.gz %%MAN3%%man/man3/OCSP_cert_to_id.3.gz %%MAN3%%man/man3/OCSP_check_nonce.3.gz @@ -2349,6 +2354,7 @@ man/man1/x509.1.gz %%MAN3%%man/man3/SSL_get_selected_srtp_profile.3.gz %%MAN3%%man/man3/SSL_get_server_random.3.gz %%MAN3%%man/man3/SSL_get_session.3.gz +%%MAN3%%man/man3/SSL_get_shared_ciphers.3.gz %%MAN3%%man/man3/SSL_get_shared_curve.3.gz %%MAN3%%man/man3/SSL_get_shared_sigalgs.3.gz %%MAN3%%man/man3/SSL_get_shutdown.3.gz @@ -2636,8 +2642,36 @@ man/man1/x509.1.gz %%MAN3%%man/man3/X509_EXTENSION_set_critical.3.gz %%MAN3%%man/man3/X509_EXTENSION_set_data.3.gz %%MAN3%%man/man3/X509_EXTENSION_set_object.3.gz +%%MAN3%%man/man3/X509_LOOKUP_ctrl_fn.3.gz %%MAN3%%man/man3/X509_LOOKUP_file.3.gz +%%MAN3%%man/man3/X509_LOOKUP_get_by_alias_fn.3.gz +%%MAN3%%man/man3/X509_LOOKUP_get_by_fingerprint_fn.3.gz +%%MAN3%%man/man3/X509_LOOKUP_get_by_issuer_serial_fn.3.gz +%%MAN3%%man/man3/X509_LOOKUP_get_by_subject_fn.3.gz +%%MAN3%%man/man3/X509_LOOKUP_get_method_data.3.gz +%%MAN3%%man/man3/X509_LOOKUP_get_store.3.gz %%MAN3%%man/man3/X509_LOOKUP_hash_dir.3.gz +%%MAN3%%man/man3/X509_LOOKUP_meth_free.3.gz +%%MAN3%%man/man3/X509_LOOKUP_meth_get_ctrl.3.gz +%%MAN3%%man/man3/X509_LOOKUP_meth_get_free.3.gz +%%MAN3%%man/man3/X509_LOOKUP_meth_get_get_by_alias.3.gz +%%MAN3%%man/man3/X509_LOOKUP_meth_get_get_by_fingerprint.3.gz +%%MAN3%%man/man3/X509_LOOKUP_meth_get_get_by_issuer_serial.3.gz +%%MAN3%%man/man3/X509_LOOKUP_meth_get_get_by_subject.3.gz +%%MAN3%%man/man3/X509_LOOKUP_meth_get_init.3.gz +%%MAN3%%man/man3/X509_LOOKUP_meth_get_new_item.3.gz +%%MAN3%%man/man3/X509_LOOKUP_meth_get_shutdown.3.gz +%%MAN3%%man/man3/X509_LOOKUP_meth_new.3.gz +%%MAN3%%man/man3/X509_LOOKUP_meth_set_ctrl.3.gz +%%MAN3%%man/man3/X509_LOOKUP_meth_set_free.3.gz +%%MAN3%%man/man3/X509_LOOKUP_meth_set_get_by_alias.3.gz +%%MAN3%%man/man3/X509_LOOKUP_meth_set_get_by_fingerprint.3.gz +%%MAN3%%man/man3/X509_LOOKUP_meth_set_get_by_issuer_serial.3.gz +%%MAN3%%man/man3/X509_LOOKUP_meth_set_get_by_subject.3.gz +%%MAN3%%man/man3/X509_LOOKUP_meth_set_init.3.gz +%%MAN3%%man/man3/X509_LOOKUP_meth_set_new_item.3.gz +%%MAN3%%man/man3/X509_LOOKUP_meth_set_shutdown.3.gz +%%MAN3%%man/man3/X509_LOOKUP_set_method_data.3.gz %%MAN3%%man/man3/X509_NAME_ENTRY_create_by_NID.3.gz %%MAN3%%man/man3/X509_NAME_ENTRY_create_by_OBJ.3.gz %%MAN3%%man/man3/X509_NAME_ENTRY_create_by_txt.3.gz @@ -2668,6 +2702,8 @@ man/man1/x509.1.gz %%MAN3%%man/man3/X509_NAME_print.3.gz %%MAN3%%man/man3/X509_NAME_print_ex.3.gz %%MAN3%%man/man3/X509_NAME_print_ex_fp.3.gz +%%MAN3%%man/man3/X509_OBJECT_set1_X509.3.gz +%%MAN3%%man/man3/X509_OBJECT_set1_X509_CRL.3.gz %%MAN3%%man/man3/X509_PUBKEY_free.3.gz %%MAN3%%man/man3/X509_PUBKEY_get.3.gz %%MAN3%%man/man3/X509_PUBKEY_get0.3.gz @@ -2813,6 +2849,7 @@ man/man1/x509.1.gz %%MAN3%%man/man3/X509_VERIFY_PARAM_get_auth_level.3.gz %%MAN3%%man/man3/X509_VERIFY_PARAM_get_depth.3.gz %%MAN3%%man/man3/X509_VERIFY_PARAM_get_flags.3.gz +%%MAN3%%man/man3/X509_VERIFY_PARAM_get_hostflags.3.gz %%MAN3%%man/man3/X509_VERIFY_PARAM_get_inh_flags.3.gz %%MAN3%%man/man3/X509_VERIFY_PARAM_get_time.3.gz %%MAN3%%man/man3/X509_VERIFY_PARAM_set1_email.3.gz @@ -2837,6 +2874,7 @@ man/man1/x509.1.gz %%MAN3%%man/man3/X509_check_ip.3.gz %%MAN3%%man/man3/X509_check_ip_asc.3.gz %%MAN3%%man/man3/X509_check_issued.3.gz +%%MAN3%%man/man3/X509_cmp_time.3.gz %%MAN3%%man/man3/X509_delete_ext.3.gz %%MAN3%%man/man3/X509_digest.3.gz %%MAN3%%man/man3/X509_dup.3.gz