linux/poky.git/meta/recipes-connectivity/openssl, branch yocto-5.0.9

openssl: rewrite ptest installation

2025-04-19T21:42:10+00:00

Rewrite (again) the openssl test suite installation. Depend on and reuse already installed libraries and modules instead of installing them twice. Be more selective when installing from the build tree so we don't install intermediate .c .d .o files. This further reduces the size of openssl-dbg from ~120MB to ~18MB. (From OE-Core rev: 8baa0ce7eae65026cb3a784adaf3a4fc724ce9c9) Upstream-Status: Backport[https://git.yoctoproject.org/poky/commit/?id=76212866402edb947f745f837e3c3b98b3056e58] (From OE-Core rev: b3cd05f123625c4c301fee925cdbb9641bc73412) Signed-off-by: Ross Burton Signed-off-by: Richard Purdie (cherry picked from commit 76212866402edb947f745f837e3c3b98b3056e58) Signed-off-by: Vishwas Udupa Change-Id: Ifc0e3a019c2abe5142d0f1e359ae5aa33dae1608 Signed-off-by: Steve Sakoman

openssl: upgrade 3.2.3 -> 3.2.4

2025-02-21T14:25:06+00:00

Release information: https://github.com/openssl/openssl/blob/openssl-3.2/NEWS.md#major-changes-between-openssl-323-and-openssl-324-11-feb-2025 Handles CVE-2024-12797 in addition to already patched CVEs. Refresh patches and remove CVE patches included in the new version. (From OE-Core rev: b051c16980f67541866253f0d7eb2dc39847fb83) Signed-off-by: Peter Marko Signed-off-by: Steve Sakoman

openssl: patch CVE-2024-13176

2025-02-03T14:13:13+00:00

Picked [1] per link in [2] [1] https://github.com/openssl/openssl/commit/4b1cb94a734a7d4ec363ac0a215a25c181e11f65 [2] https://nvd.nist.gov/vuln/detail/CVE-2024-13176 (From OE-Core rev: 7f9bb49394185fea268397db4fc7d96afae53f28) Signed-off-by: Peter Marko Signed-off-by: Steve Sakoman

openssl: patch CVE-2024-9143

2024-10-30T15:30:00+00:00

Pick patch from branch openssl-3.2. (From OE-Core rev: df9cd27e23f051fb02391ca62d29f152f36f76fe) Signed-off-by: Peter Marko Signed-off-by: Steve Sakoman

openssl: Upgrade 3.2.2 -> 3.2.3

2024-09-25T12:07:47+00:00

Updated SRC_URI link and format due to change in openssl website. CVE's Fixed by upgrade: CVE-2024-5535: Fixed possible buffer overread in SSL_select_next_proto(). CVE-2024-6119: Fixed possible denial of service in X.509 name checks - Removed backports of CVE-2024-5535 as it is already fixed. - Removed first hunk of 0001-Added-handshake-history-reporting-when-test-fails.patch as the copyright years are already updated in test/helpers/handshake.c file Detailed Information: https://github.com/openssl/openssl/blob/openssl-3.2/CHANGES.md#changes-between-322-and-323-3-sep-2024 (From OE-Core rev: 2155e3016a98ae0db28488dcc5176437e6f8b24a) Signed-off-by: Siddharth Doshi Signed-off-by: Steve Sakoman

OpenSSL: Security fix for CVE-2024-5535

2024-07-09T13:02:55+00:00

Upstream-Status: Backport from [https://github.com/openssl/openssl/commit/99fb785a5f85315b95288921a321a935ea29a51e] CVE's Fixed: CVE-2024-5535 openssl: SSL_select_next_proto buffer overread (From OE-Core rev: 7d270bfe23cb5a543851ff6d3c9e273732a30865) Signed-off-by: Siddharth Doshi Signed-off-by: Steve Sakoman

openssl: Upgrade 3.2.1 -> 3.2.2

2024-06-14T12:19:22+00:00

CVE's Fixed by upgrade: CVE-2024-4741: Fixed potential use after free after SSL_free_buffers() is called CVE-2024-4603: Fixed an issue where checking excessively long DSA keys or parameters may be very slow CVE-2024-2511: Fixed unbounded memory growth with session handling in TLSv1.3 Bugs Fixed by upgrade: #23560: Fixed bug where SSL_export_keying_material() could not be used with QUIC connections Removed backports of CVE-2024-2511, CVE-2024-4603 and bti.patch as they are already fixed. Detailed Information: https://github.com/openssl/openssl/blob/openssl-3.2/CHANGES.md#changes-between-321-and-322-4-jun-2024 (From OE-Core rev: f99c9346c225b862cc26923e823c35484beb797f) Signed-off-by: Siddharth Doshi Signed-off-by: Steve Sakoman

openssl: patch CVE-2024-4603

2024-05-23T15:55:01+00:00

Advisory: https://github.com/advisories/GHSA-85xr-ghj6-6m46 (From OE-Core rev: bd6a6733c9a7af90ef86ef9316ff31bc996250b5) Signed-off-by: Peter Marko Signed-off-by: Steve Sakoman

openssl: openssl: patch CVE-2024-2511

2024-04-16T06:33:19+00:00

Patch: https://github.com/openssl/openssl/commit/e9d7083e241670332e0443da0f0d4ffb52829f08 News: https://github.com/openssl/openssl/commit/b7acb6731a96b073d6150465bd090e2052a595c2 (From OE-Core rev: b439d1c9e5a115bbb5193a2df25e84291cc07bec) Signed-off-by: Peter Marko Signed-off-by: Richard Purdie

openssl: fix crash on aarch64 if BTI is enabled but no Crypto instructions

2024-03-30T22:22:19+00:00

On aarch64, if the processor doesn't have the Crypto instructions then OpenSSL will fall back onto the "bit-sliced" assembler routines. When branch protection (BTI) was enabled in OpenSSL these routines were missed, so if BTI is available libssl will immediately abort when it enters this assembler. Backport a patch submitted upstream to add the required call target annotations so that BTI doesn't believe the code is being exploited. (From OE-Core rev: 438a390e8e1811bc2d3820c1cd2b8e099e70064a) Signed-off-by: Ross Burton Signed-off-by: Richard Purdie