Skip to contentSkip to conversation

gnutls: security bump to version 3.5.10

PATCH New Gustavo Zacarias 3 participants 3 messages Mar 6, 2017 – Mar 7, 2017

lore
Share & tools
lore

Gustavo Zacarias

author
#0 lore raw

PATCH 1/1 gnutls: security bump to version 3.5.10

Fixes:
GNUTLS-SA-2017-3A - Addressed integer overflow resulting to invalid memory write in OpenPGP certificate parsing. GNUTLS-SA-2017-3B - Addressed crashes in OpenPGP certificate parsing, related to private key parser. No longer allow OpenPGP certificates (public keys) to contain private key sub-packets. GNUTLS-SA-2017-3C - Addressed large allocation in OpenPGP certificate parsing, that could lead in out-of-memory condition.

Signed-off-by Gustavo Zacarias <[email protected]>
---
 package/gnutls/gnutls.hash | 2 +-
 package/gnutls/gnutls.mk   | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)
package/gnutls/gnutls.hash +1 -1
index 156d2aa..64b86d7 100644
@@ -1,2 +1,2 @@
 # Locally calculated after checking pgp signature
-sha256	82b10f0c4ef18f4e64ad8cef5dbaf14be732f5095a41cf366b4ecb4050382951	gnutls-3.5.9.tar.xz
+sha256	af443e86ba538d4d3e37c4732c00101a492fe4b56a55f4112ff0ab39dbe6579d	gnutls-3.5.10.tar.xz
package/gnutls/gnutls.mk +1 -1
index 932c0fa..be1cf00 100644
@@ -5,7 +5,7 @@
 ################################################################################
 
 GNUTLS_VERSION_MAJOR = 3.5
-GNUTLS_VERSION = $(GNUTLS_VERSION_MAJOR).9
+GNUTLS_VERSION = $(GNUTLS_VERSION_MAJOR).10
 GNUTLS_SOURCE = gnutls-$(GNUTLS_VERSION).tar.xz
 GNUTLS_SITE = ftp://ftp.gnutls.org/gcrypt/gnutls/v$(GNUTLS_VERSION_MAJOR)
 GNUTLS_LICENSE = LGPLv2.1+ (core library), GPLv3+ (gnutls-openssl library)
Signature · 1 line
2.10.2
Applied
#1 lore raw

PATCH 1/1 gnutls: security bump to version 3.5.10

Hello,

Quoted 9 lines · Gustavo Zacarias

Fixes:
GNUTLS-SA-2017-3A - Addressed integer overflow resulting to invalid memory write in OpenPGP certificate parsing. GNUTLS-SA-2017-3B - Addressed crashes in OpenPGP certificate parsing, related to private key parser. No longer allow OpenPGP certificates (public keys) to contain private key sub-packets. GNUTLS-SA-2017-3C - Addressed large allocation in OpenPGP certificate parsing, that could lead in out-of-memory condition.

Quoted 5 lines
Signed-off-by Gustavo Zacarias <[email protected]>
---
 package/gnutls/gnutls.hash | 2 +-
 package/gnutls/gnutls.mk   | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

Applied to master, thanks. Peter: we want this one for LTS I guess.

Thomas

Signature · 3 lines
Thomas Petazzoni, CTO, Free Electrons
Embedded Linux, Kernel and Android engineering
http://free-electrons.com
#2 lore raw

PATCH 1/1 gnutls: security bump to version 3.5.10

Quoted 13 lines
Quoted 1 line
Quoted 1 line
Quoted 1 line
Quoted 1 line

"Thomas" == Thomas Petazzoni <[email protected]> writes:

Hello,

Quoted 9 lines · Gustavo Zacarias

Fixes:
GNUTLS-SA-2017-3A - Addressed integer overflow resulting to invalid memory write in OpenPGP certificate parsing. GNUTLS-SA-2017-3B - Addressed crashes in OpenPGP certificate parsing, related to private key parser. No longer allow OpenPGP certificates (public keys) to contain private key sub-packets. GNUTLS-SA-2017-3C - Addressed large allocation in OpenPGP certificate parsing, that could lead in out-of-memory condition.

Quoted 7 lines
Quoted 5 lines
Signed-off-by Gustavo Zacarias <[email protected]>

---
package/gnutls/gnutls.hash | 2 +-
package/gnutls/gnutls.mk | 2 +-

2 files changed, 2 insertions(+), 2 deletions(-)

Applied to master, thanks. Peter: we want this one for LTS I guess.

Committed to 2017.02.x, thanks.

Signature · 1 line
Bye, Peter Korsgaard