diff options
author | Alexander Kanavin <alexander.kanavin@linux.intel.com> | 2017-08-08 18:30:48 +0300 |
---|---|---|
committer | Richard Purdie <richard.purdie@linuxfoundation.org> | 2017-08-13 09:27:38 +0100 |
commit | e326733d69181a03af7a4f837ea78fce348fdf00 (patch) | |
tree | f2b049b04bf94693ad017ac68df139b4ed655c65 /meta/recipes-connectivity/openssl/openssl10/Use-SHA256-not-MD5-as-default-digest.patch | |
parent | 04891b31e62f37e692647399fa3534d3dd4ab7f9 (diff) | |
download | poky-e326733d69181a03af7a4f837ea78fce348fdf00.tar.gz |
openssl: add a 1.1 version
Existing openssl 1.0 recipe is renamed to openssl10; it will
continue to be provided for as long as upstream supports it
(and there are still several recipes which do not work with openssl
1.1 due to API differences).
A few files (such as openssl binary) are no longer installed by openssl 1.0,
because they clash with openssl 1.1.
(From OE-Core rev: da1183f9fa5e06fbe66b5b31eb3313d5d35d11e3)
Signed-off-by: Alexander Kanavin <alexander.kanavin@linux.intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Diffstat (limited to 'meta/recipes-connectivity/openssl/openssl10/Use-SHA256-not-MD5-as-default-digest.patch')
-rw-r--r-- | meta/recipes-connectivity/openssl/openssl10/Use-SHA256-not-MD5-as-default-digest.patch | 69 |
1 files changed, 69 insertions, 0 deletions
diff --git a/meta/recipes-connectivity/openssl/openssl10/Use-SHA256-not-MD5-as-default-digest.patch b/meta/recipes-connectivity/openssl/openssl10/Use-SHA256-not-MD5-as-default-digest.patch new file mode 100644 index 0000000000..58c9ee7844 --- /dev/null +++ b/meta/recipes-connectivity/openssl/openssl10/Use-SHA256-not-MD5-as-default-digest.patch | |||
@@ -0,0 +1,69 @@ | |||
1 | From d795f5f20a29adecf92c09459a3ee07ffac01a99 Mon Sep 17 00:00:00 2001 | ||
2 | From: Rich Salz <rsalz@akamai.com> | ||
3 | Date: Sat, 13 Jun 2015 17:03:39 -0400 | ||
4 | Subject: [PATCH] Use SHA256 not MD5 as default digest. | ||
5 | |||
6 | Commit f8547f62c212837dbf44fb7e2755e5774a59a57b upstream. | ||
7 | |||
8 | Upstream-Status: Backport | ||
9 | Backport from OpenSSL 2.0 to OpenSSL 1.0.2 | ||
10 | Commit f8547f62c212837dbf44fb7e2755e5774a59a57b | ||
11 | |||
12 | CVE: CVE-2004-2761 | ||
13 | |||
14 | The MD5 Message-Digest Algorithm is not collision resistant, | ||
15 | which makes it easier for context-dependent attackers to | ||
16 | conduct spoofing attacks, as demonstrated by attacks on the | ||
17 | use of MD5 in the signature algorithm of an X.509 certificate. | ||
18 | |||
19 | Reviewed-by: Viktor Dukhovni <viktor@openssl.org> | ||
20 | Signed-off-by: Zhang Xiao <xiao.zhang@windriver.com> | ||
21 | Signed-off-by: T.O. Radzy Radzykewycz <radzy@windriver.com> | ||
22 | --- | ||
23 | apps/ca.c | 2 +- | ||
24 | apps/dgst.c | 2 +- | ||
25 | apps/enc.c | 2 +- | ||
26 | 3 files changed, 3 insertions(+), 3 deletions(-) | ||
27 | |||
28 | diff --git a/apps/ca.c b/apps/ca.c | ||
29 | index 3b7336c..8f3a84b 100644 | ||
30 | --- a/apps/ca.c | ||
31 | +++ b/apps/ca.c | ||
32 | @@ -1612,7 +1612,7 @@ static int certify_cert(X509 **xret, char *infile, EVP_PKEY *pkey, X509 *x509, | ||
33 | } else | ||
34 | BIO_printf(bio_err, "Signature ok\n"); | ||
35 | |||
36 | - if ((rreq = X509_to_X509_REQ(req, NULL, EVP_md5())) == NULL) | ||
37 | + if ((rreq = X509_to_X509_REQ(req, NULL, NULL)) == NULL) | ||
38 | goto err; | ||
39 | |||
40 | ok = do_body(xret, pkey, x509, dgst, sigopts, policy, db, serial, subj, | ||
41 | diff --git a/apps/dgst.c b/apps/dgst.c | ||
42 | index 95e5fa3..0d1529f 100644 | ||
43 | --- a/apps/dgst.c | ||
44 | +++ b/apps/dgst.c | ||
45 | @@ -442,7 +442,7 @@ int MAIN(int argc, char **argv) | ||
46 | goto end; | ||
47 | } | ||
48 | if (md == NULL) | ||
49 | - md = EVP_md5(); | ||
50 | + md = EVP_sha256(); | ||
51 | if (!EVP_DigestInit_ex(mctx, md, impl)) { | ||
52 | BIO_printf(bio_err, "Error setting digest %s\n", pname); | ||
53 | ERR_print_errors(bio_err); | ||
54 | diff --git a/apps/enc.c b/apps/enc.c | ||
55 | index 7b7c70b..a7d944c 100644 | ||
56 | --- a/apps/enc.c | ||
57 | +++ b/apps/enc.c | ||
58 | @@ -344,7 +344,7 @@ int MAIN(int argc, char **argv) | ||
59 | } | ||
60 | |||
61 | if (dgst == NULL) { | ||
62 | - dgst = EVP_md5(); | ||
63 | + dgst = EVP_sha256(); | ||
64 | } | ||
65 | |||
66 | if (bufsize != NULL) { | ||
67 | -- | ||
68 | 1.9.1 | ||
69 | |||