diff options
author | Siddharth Doshi <sdoshi@mvista.com> | 2023-02-19 19:36:30 +0100 |
---|---|---|
committer | Richard Purdie <richard.purdie@linuxfoundation.org> | 2023-02-20 15:18:30 +0000 |
commit | a19633f3c37802090740df34ee7af0766f7664dc (patch) | |
tree | 38c23e275cf8a3e2c4cebd4385334cf702974950 /meta/recipes-connectivity/openssl | |
parent | 8954cf12e22ed184e2c0e0b206ce2285efed0d1f (diff) | |
download | poky-a19633f3c37802090740df34ee7af0766f7664dc.tar.gz |
openssl: Upgrade 3.0.7 -> 3.0.8
OpenSSL 3.0.8 fixes 1 HIGH level security vulnerability and 7 MODERATE level security vulnerability [1].
Upgrade the recipe to point to 3.0.8.
CVE-2022-3996 is reported fixed in 3.0.8, so drop the patch for that as
well.
[1] https://www.openssl.org/news/vulnerabilities.html
CVEs Fixed:
https://www.openssl.org/news/secadv/20230207.txt
(From OE-Core rev: 8461466f63200a0b1c9c247b70fdf5819651544c)
Signed-off-by: Siddharth Doshi <sdoshi@mvista.com>
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Diffstat (limited to 'meta/recipes-connectivity/openssl')
-rw-r--r-- | meta/recipes-connectivity/openssl/openssl/CVE-2022-3996.patch | 43 | ||||
-rw-r--r-- | meta/recipes-connectivity/openssl/openssl_3.0.8.bb (renamed from meta/recipes-connectivity/openssl/openssl_3.0.7.bb) | 3 |
2 files changed, 1 insertions, 45 deletions
diff --git a/meta/recipes-connectivity/openssl/openssl/CVE-2022-3996.patch b/meta/recipes-connectivity/openssl/openssl/CVE-2022-3996.patch deleted file mode 100644 index 6d70b323d1..0000000000 --- a/meta/recipes-connectivity/openssl/openssl/CVE-2022-3996.patch +++ /dev/null | |||
@@ -1,43 +0,0 @@ | |||
1 | From 7725e7bfe6f2ce8146b6552b44e0d226be7638e7 Mon Sep 17 00:00:00 2001 | ||
2 | From: Pauli <pauli@openssl.org> | ||
3 | Date: Fri, 11 Nov 2022 09:40:19 +1100 | ||
4 | Subject: [PATCH] x509: fix double locking problem | ||
5 | |||
6 | This reverts commit 9aa4be691f5c73eb3c68606d824c104550c053f7 and removed the | ||
7 | redundant flag setting. | ||
8 | |||
9 | Fixes #19643 | ||
10 | |||
11 | Fixes LOW CVE-2022-3996 | ||
12 | |||
13 | Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> | ||
14 | Reviewed-by: Tomas Mraz <tomas@openssl.org> | ||
15 | (Merged from https://github.com/openssl/openssl/pull/19652) | ||
16 | |||
17 | (cherry picked from commit 4d0340a6d2f327700a059f0b8f954d6160f8eef5) | ||
18 | |||
19 | Upstream-Status: Backport [https://github.com/openssl/openssl/commit/7725e7bfe6f2ce8146b6552b44e0d226be7638e7] | ||
20 | CVE: CVE-2022-3996 | ||
21 | Signed-off-by: Vivek Kumbhar <vkumbhar@mvista.com> | ||
22 | --- | ||
23 | crypto/x509/pcy_map.c | 4 ---- | ||
24 | 1 file changed, 4 deletions(-) | ||
25 | |||
26 | diff --git a/crypto/x509/pcy_map.c b/crypto/x509/pcy_map.c | ||
27 | index 05406c6493..60dfd1e320 100644 | ||
28 | --- a/crypto/x509/pcy_map.c | ||
29 | +++ b/crypto/x509/pcy_map.c | ||
30 | @@ -73,10 +73,6 @@ int ossl_policy_cache_set_mapping(X509 *x, POLICY_MAPPINGS *maps) | ||
31 | |||
32 | ret = 1; | ||
33 | bad_mapping: | ||
34 | - if (ret == -1 && CRYPTO_THREAD_write_lock(x->lock)) { | ||
35 | - x->ex_flags |= EXFLAG_INVALID_POLICY; | ||
36 | - CRYPTO_THREAD_unlock(x->lock); | ||
37 | - } | ||
38 | sk_POLICY_MAPPING_pop_free(maps, POLICY_MAPPING_free); | ||
39 | return ret; | ||
40 | |||
41 | -- | ||
42 | 2.30.2 | ||
43 | |||
diff --git a/meta/recipes-connectivity/openssl/openssl_3.0.7.bb b/meta/recipes-connectivity/openssl/openssl_3.0.8.bb index 1842148592..8771884dda 100644 --- a/meta/recipes-connectivity/openssl/openssl_3.0.7.bb +++ b/meta/recipes-connectivity/openssl/openssl_3.0.8.bb | |||
@@ -12,14 +12,13 @@ SRC_URI = "http://www.openssl.org/source/openssl-${PV}.tar.gz \ | |||
12 | file://0001-buildinfo-strip-sysroot-and-debug-prefix-map-from-co.patch \ | 12 | file://0001-buildinfo-strip-sysroot-and-debug-prefix-map-from-co.patch \ |
13 | file://afalg.patch \ | 13 | file://afalg.patch \ |
14 | file://0001-Configure-do-not-tweak-mips-cflags.patch \ | 14 | file://0001-Configure-do-not-tweak-mips-cflags.patch \ |
15 | file://CVE-2022-3996.patch \ | ||
16 | " | 15 | " |
17 | 16 | ||
18 | SRC_URI:append:class-nativesdk = " \ | 17 | SRC_URI:append:class-nativesdk = " \ |
19 | file://environment.d-openssl.sh \ | 18 | file://environment.d-openssl.sh \ |
20 | " | 19 | " |
21 | 20 | ||
22 | SRC_URI[sha256sum] = "83049d042a260e696f62406ac5c08bf706fd84383f945cf21bd61e9ed95c396e" | 21 | SRC_URI[sha256sum] = "6c13d2bf38fdf31eac3ce2a347073673f5d63263398f1f69d0df4a41253e4b3e" |
23 | 22 | ||
24 | inherit lib_package multilib_header multilib_script ptest perlnative | 23 | inherit lib_package multilib_header multilib_script ptest perlnative |
25 | MULTILIB_SCRIPTS = "${PN}-bin:${bindir}/c_rehash" | 24 | MULTILIB_SCRIPTS = "${PN}-bin:${bindir}/c_rehash" |