diff options
author | Sona Sarmadi <sona.sarmadi@enea.com> | 2017-03-16 10:54:31 +0100 |
---|---|---|
committer | Adrian Dudau <adrian.dudau@enea.com> | 2017-03-21 11:29:21 +0100 |
commit | 7e14191bb3bf457907727f3125e5cbc846d39b9f (patch) | |
tree | 9770da8380271fe318845b69262590263ee0ebe9 /meta/recipes-connectivity/openssl/openssl/Use-SHA256-not-MD5-as-default-digest.patch | |
parent | dfde5b94e82264ea16a189252d615d67366e3d98 (diff) | |
download | poky-7e14191bb3bf457907727f3125e5cbc846d39b9f.tar.gz |
openssl: upgrade to 1.0.2k
Following vulnerabilities have been solved between 1.0.2h and
1.0.2k releases:
Vulnerabilities detected in 1.0.2h and fixed in 1.0.2i
======================================================
Ref: https://www.openssl.org/news/secadv/20160922.txt
CVE-2016-6304 (High): OCSP Status Request extension unbounded memory growth
CVE-2016-2183 (Low): SWEET32 Mitigation
CVE-2016-6303 (Low): OOB write in MDC2_Update()
CVE-2016-6302 (Low): Malformed SHA512 ticket DoS
CVE-2016-2182 (Low): OOB write in BN_bn2dec()
CVE-2016-2180 (Low): OOB read in TS_OBJ_print_bio()
CVE-2016-2177 (Low): Pointer arithmetic undefined behaviour
CVE-2016-2178 (Low): Constant time flag not preserved in DSA signing
CVE-2016-2179 (Low): DTLS buffered message DoS
CVE-2016-2181 (Low): DTLS replay protection DoS
CVE-2016-6306 (Low): Certificate message OOB reads
Vulnerabilities detected in 1.0.ih and fixed in 1.0.2j
======================================================
https://www.openssl.org/news/secadv/20160926.txt
CVE-2016-7052 (Moderate): This issue only affects OpenSSL 1.0.2i
1.0.2j - 1.0.2k
Vulnerabilities detected in 1.0.2j and fixed in 1.0.2k
======================================================
CVE-2017-3731 (Moderate): For Openssl 1.0.2, the crash can be triggered when using
RC4-MD5; users who have not disabled that algorithm should update to 1.0.2k
CVE-2017-3732 (Moderate): BN_mod_exp may produce incorrect results on x86_64
CVE-2016-7055 (Low): Montgomery multiplication may produce incorrect results
References:
https://www.openssl.org/news/secadv/20160922.txt
https://www.openssl.org/news/secadv/20160926.txt
https://www.openssl.org/news/secadv/20170126.txt
Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com>
Signed-off-by: Adrian Dudau <adrian.dudau@enea.com>
Diffstat (limited to 'meta/recipes-connectivity/openssl/openssl/Use-SHA256-not-MD5-as-default-digest.patch')
-rw-r--r-- | meta/recipes-connectivity/openssl/openssl/Use-SHA256-not-MD5-as-default-digest.patch | 69 |
1 files changed, 69 insertions, 0 deletions
diff --git a/meta/recipes-connectivity/openssl/openssl/Use-SHA256-not-MD5-as-default-digest.patch b/meta/recipes-connectivity/openssl/openssl/Use-SHA256-not-MD5-as-default-digest.patch new file mode 100644 index 0000000000..e6e297e47f --- /dev/null +++ b/meta/recipes-connectivity/openssl/openssl/Use-SHA256-not-MD5-as-default-digest.patch | |||
@@ -0,0 +1,69 @@ | |||
1 | From d795f5f20a29adecf92c09459a3ee07ffac01a99 Mon Sep 17 00:00:00 2001 | ||
2 | From: Rich Salz <rsalz@akamai.com> | ||
3 | Date: Sat, 13 Jun 2015 17:03:39 -0400 | ||
4 | Subject: [PATCH] Use SHA256 not MD5 as default digest. | ||
5 | |||
6 | Commit f8547f62c212837dbf44fb7e2755e5774a59a57b upstream. | ||
7 | |||
8 | Upstream-Status: Backport | ||
9 | Backport from OpenSSL 2.0 to OpenSSL 1.0.2 | ||
10 | Commit f8547f62c212837dbf44fb7e2755e5774a59a57b | ||
11 | |||
12 | CVE: CVE-2004-2761 | ||
13 | |||
14 | The MD5 Message-Digest Algorithm is not collision resistant, | ||
15 | which makes it easier for context-dependent attackers to | ||
16 | conduct spoofing attacks, as demonstrated by attacks on the | ||
17 | use of MD5 in the signature algorithm of an X.509 certificate. | ||
18 | |||
19 | Reviewed-by: Viktor Dukhovni <viktor@openssl.org> | ||
20 | Signed-off-by: Zhang Xiao <xiao.zhang@windriver.com> | ||
21 | Signed-off-by: T.O. Radzy Radzykewycz <radzy@windriver.com> | ||
22 | --- | ||
23 | apps/ca.c | 2 +- | ||
24 | apps/dgst.c | 2 +- | ||
25 | apps/enc.c | 2 +- | ||
26 | 3 files changed, 3 insertions(+), 3 deletions(-) | ||
27 | |||
28 | diff --git a/apps/ca.c b/apps/ca.c | ||
29 | index 3b7336c..8f3a84b 100644 | ||
30 | --- a/apps/ca.c | ||
31 | +++ b/apps/ca.c | ||
32 | @@ -1612,7 +1612,7 @@ static int certify_cert(X509 **xret, char *infile, EVP_PKEY *pkey, X509 *x509, | ||
33 | } else | ||
34 | BIO_printf(bio_err, "Signature ok\n"); | ||
35 | |||
36 | - if ((rreq = X509_to_X509_REQ(req, NULL, EVP_md5())) == NULL) | ||
37 | + if ((rreq = X509_to_X509_REQ(req, NULL, NULL)) == NULL) | ||
38 | goto err; | ||
39 | |||
40 | ok = do_body(xret, pkey, x509, dgst, sigopts, policy, db, serial, subj, | ||
41 | diff --git a/apps/dgst.c b/apps/dgst.c | ||
42 | index 95e5fa3..0d1529f 100644 | ||
43 | --- a/apps/dgst.c | ||
44 | +++ b/apps/dgst.c | ||
45 | @@ -442,7 +442,7 @@ int MAIN(int argc, char **argv) | ||
46 | goto end; | ||
47 | } | ||
48 | if (md == NULL) | ||
49 | - md = EVP_md5(); | ||
50 | + md = EVP_sha256(); | ||
51 | if (!EVP_DigestInit_ex(mctx, md, impl)) { | ||
52 | BIO_printf(bio_err, "Error setting digest %s\n", pname); | ||
53 | ERR_print_errors(bio_err); | ||
54 | diff --git a/apps/enc.c b/apps/enc.c | ||
55 | index 7b7c70b..a7d944c 100644 | ||
56 | --- a/apps/enc.c | ||
57 | +++ b/apps/enc.c | ||
58 | @@ -344,7 +344,7 @@ int MAIN(int argc, char **argv) | ||
59 | } | ||
60 | |||
61 | if (dgst == NULL) { | ||
62 | - dgst = EVP_md5(); | ||
63 | + dgst = EVP_sha256(); | ||
64 | } | ||
65 | |||
66 | if (bufsize != NULL) { | ||
67 | -- | ||
68 | 1.9.1 | ||
69 | |||