linux/poky.git/meta/recipes-connectivity/openssl, branch mickledore-next

OpenSSL: Security fix for CVE-2023-0464

2023-03-26T17:50:17+00:00

Upstream-Status: Backport from [https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=2017771e2db3e2b96f89bbe8766c3209f6a99545] (From OE-Core rev: 20ae485ef65bef2ddbffe05fd29cc7d411c38448) Signed-off-by: Siddharth Doshi Signed-off-by: Alexandre Belloni Signed-off-by: Richard Purdie

openssl: Fix reproducibility issue

2023-03-16T17:49:38+00:00

Fix an issue introduced in the new openssl version where an assembler file isn't generated in a reproducible way by seeding the perl random number generator consistently. It has no crypto impact, it is just used to avoid function name clashes. (From OE-Core rev: 448df3e1c02fe224d62f59a236fdcd47ea7e695f) Signed-off-by: Richard Purdie

openssl: update from 3.0.8 to 3.1.0

2023-03-16T17:49:38+00:00

>From the NEWS.md file: ### Major changes between OpenSSL 3.0 and OpenSSL 3.1.0 [14 Mar 2023] * SSL 3, TLS 1.0, TLS 1.1, and DTLS 1.0 only work at security level 0. * Performance enhancements and new platform support including new assembler code algorithm implementations. * Deprecated LHASH statistics functions. * FIPS 140-3 compliance changes. Drop the upstreamed afalg.patch: c425e365f4 Configure: don't try to be clever when configuring afalgeng (From OE-Core rev: 71c763ed4fbbea22a6a0b145e4e29436c7e59625) Signed-off-by: Randy MacLeod Signed-off-by: Richard Purdie

openssl: Upgrade 3.0.7 -> 3.0.8

2023-02-20T15:18:30+00:00

OpenSSL 3.0.8 fixes 1 HIGH level security vulnerability and 7 MODERATE level security vulnerability [1]. Upgrade the recipe to point to 3.0.8. CVE-2022-3996 is reported fixed in 3.0.8, so drop the patch for that as well. [1] https://www.openssl.org/news/vulnerabilities.html CVEs Fixed: https://www.openssl.org/news/secadv/20230207.txt (From OE-Core rev: 8461466f63200a0b1c9c247b70fdf5819651544c) Signed-off-by: Siddharth Doshi Signed-off-by: Martin Jansa Signed-off-by: Richard Purdie

openssl: fix CVE-2022-3996 double locking leads to denial of service

2023-02-01T14:05:15+00:00

(From OE-Core rev: c20b7b864dc6726a2ed4a40cf5a30661ad28c6e0) Signed-off-by: Vivek Kumbhar Signed-off-by: Richard Purdie

openssl: Upgrade 3.0.5 -> 3.0.7

2022-11-02T09:21:28+00:00

OpenSSL 3.0.5 includes a HIGH level security vulnerability [1]. Upgrade the recipe to point to 3.0.7. CVE-2022-3358 is reported fixed in 3.0.6, so drop the patch for that as well. [1] https://www.openssl.org/news/vulnerabilities.html Fixes CVE-2022-3786 and CVE-2022-3602: X.509 Email Address Buffer Overflows https://www.openssl.org/blog/blog/2022/11/01/email-address-overflows/ (From OE-Core rev: a69ea1f7db96ec8b853573bd581438edd42ad6e0) Signed-off-by: Ed Tanous Signed-off-by: Richard Purdie

openssl: Fix SSL_CERT_FILE to match ca-certs location

2022-10-26T22:01:01+00:00

In OE-Core d6b15d1e70b99185cf245d829ada5b6fb99ec1af, "openssl: export necessary env vars in SDK", the value added for SSL_CERT_FILE was in conflict with the value used elsewhere, such as in buildtools. This makes them match and fixes buildtools testsdk failures. (From OE-Core rev: 7d383a7fc6da666c80f2fc037af5f49a3388eb2b) Signed-off-by: Richard Purdie

openssl: CVE-2022-3358 Using a Custom Cipher with NID_undef may lead to NULL encryption

2022-10-26T11:28:39+00:00

Upstream-Status: Backport from https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=5485c56679d7c49b96e8fc8ca708b0b7e7c03c4b] Description: CVE-2022-3358 openssl: Using a Custom Cipher with NID_undef may lead to NULL encryption. Affects "openssl < 3.0.6" (From OE-Core rev: f98b2273c6f03f8f6029a7a409600ce290817e27) Signed-off-by: Hitendra Prajapati Signed-off-by: Alexandre Belloni Signed-off-by: Richard Purdie

openssl: export necessary env vars in SDK

2022-10-25T12:42:03+00:00

In current SDK, when running the following command in python shell, we get an error. $ python3 >>> from cryptography.hazmat.backends import openssl The error message is as below: cryptography.exceptions.InternalError: Unknown OpenSSL error. We could set OPENSSL_MODULES explicitly in nativesdk-openssl package so that when SDK is set up, it's in environment and we can get rid of the above error. Also, there are other env vars that need to be exported. And we export all of them to keep sync with openssl-native.bbclass. (From OE-Core rev: d6b15d1e70b99185cf245d829ada5b6fb99ec1af) Signed-off-by: Chen Qi Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

openssl: Move microblaze to linux-latomic config

2022-07-28T10:07:33+00:00

When building with the previous a number of atomic functions come back as undefined. Switching to linux-latomic fixes this. (From OE-Core rev: 88d5bf78ffb1d120df48139b1ed3c2e3fa8310d0) Signed-off-by: Mark Hatle Signed-off-by: Mark Hatle Signed-off-by: Luca Ceresoli Signed-off-by: Richard Purdie