openssl: security bump to version 1.0.0j
PATCH 1/1 openssl: security bump to version 1.0.0j
Bump to version 1.0.0j to fix CVE-2012-2333
--- package/openssl/openssl.mk | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-)
package/openssl/openssl.mk +1 -1
@@ -4,7 +4,7 @@ # ############################################################# -OPENSSL_VERSION = 1.0.0i +OPENSSL_VERSION = 1.0.0j OPENSSL_SITE = http://www.openssl.org/source OPENSSL_INSTALL_STAGING = YES OPENSSL_DEPENDENCIES = zlib
Signature · 1 line
1.7.3.4
PATCH 1/1 openssl: security bump to version 1.0.0j
Quoted 1 line
Quoted 1 line
Quoted 1 line
Quoted 1 line
Quoted 1 line
"Gustavo" == Gustavo Zacarias <[email protected]> writes:
Gustavo> Bump to version 1.0.0j to fix CVE-2012-2333
Committed, thanks.
Signature · 1 line
Bye, Peter Korsgaard
PATCH 1/1 openssl: security bump to version 1.0.0j
In reply to Gustavo ZacariasHello Gustavo,
Le Fri, 11 May 2012 12:45:48 -0300,
Gustavo Zacarias <[email protected]> a ?crit :
Quoted 3 lines
Bump to version 1.0.0j to fix CVE-2012-2333
Signed-off-by Gustavo Zacarias <[email protected]>
At http://patchwork.ozlabs.org/patch/148560/ we have a patch that has been sitting for a long time, which bumps the version of openssl to 1.0.1. Looking at the OpenSSL website, I see that both the 1.0.0X versions and 1.0.1X versions are maintained. Do you know what they mean, and whether we should stay at 1.0.0 or move to 1.0.1?
I simply would like to know what to do with this patch in our patchwork :)
Thanks!
Thomas
Signature · 4 lines
Thomas Petazzoni, Free Electrons Kernel, drivers, real-time and embedded Linux development, consulting, training and support. http://free-electrons.com
PATCH 1/1 openssl: security bump to version 1.0.0j
Quoted 6 lines · Thomas Petazzoni
At http://patchwork.ozlabs.org/patch/148560/ we have a patch that has been sitting for a long time, which bumps the version of openssl to 1.0.1. Looking at the OpenSSL website, I see that both the 1.0.0X versions and 1.0.1X versions are maintained. Do you know what they mean, and whether we should stay at 1.0.0 or move to 1.0.1?
Quoted 6 lines
I simply would like to know what to do with this patch in our patchwork :)
Thanks!
Thomas
1.0.1 is security-vulnerable, so it can't be bumped as-is, the target should be 1.0.1c at the moment.
The big difference between 1.0.0* and 1.0.1* is that the later has initial support for TLSv1.1 and TLSv1.2 among other minor details. Both are API compatible though not ABI (and we don't care). I can give it a test during the weekend and give it a go for -next. Regards.
PATCH 1/1 openssl: security bump to version 1.0.0j
Le Fri, 17 Aug 2012 13:55:17 -0300,
Gustavo Zacarias <[email protected]> a ?crit :
Quoted 2 lines
1.0.1 is security-vulnerable, so it can't be bumped as-is, the target should be 1.0.1c at the moment.
Yes, agreed. I was referring to 1.0.1 as a branch, not specifically to 1.0.1. The patch I mentioned did target 1.0.1 because this patch is about 6 months old.
Quoted 4 lines
The big difference between 1.0.0* and 1.0.1* is that the later has initial support for TLSv1.1 and TLSv1.2 among other minor details. Both are API compatible though not ABI (and we don't care). I can give it a test during the weekend and give it a go for -next.
Great, thanks!
Thomas
Signature · 4 lines
Thomas Petazzoni, Free Electrons Kernel, drivers, real-time and embedded Linux development, consulting, training and support. http://free-electrons.com
PATCH 1/1 openssl: security bump to version 1.0.0j
In reply to Gustavo Zacarias17.8.2012 19:55, Gustavo Zacarias kirjoitti:
Quoted 13 lines · Thomas Petazzoni
Quoted 12 lines
At http://patchwork.ozlabs.org/patch/148560/ we have a patch that has been sitting for a long time, which bumps the version of openssl to 1.0.1. Looking at the OpenSSL website, I see that both the 1.0.0X versions and 1.0.1X versions are maintained. Do you know what they mean, and whether we should stay at 1.0.0 or move to 1.0.1?
I simply would like to know what to do with this patch in our patchwork :)
Thanks!
Quoted 8 lines
Quoted 1 line
Thomas
1.0.1 is security-vulnerable, so it can't be bumped as-is, the target should be 1.0.1c at the moment.
The big difference between 1.0.0* and 1.0.1* is that the later has initial support for TLSv1.1 and TLSv1.2 among other minor details. Both are API compatible though not ABI (and we don't care). I can give it a test during the weekend and give it a go for -next. Regards.
Don't know about 1.0.1c version (or greater) but what's it worth, I have had version 1.0.1b sitting in my buildroot copy like ages and so far have not noticed anything strange in my buildroot based home distro.
Best regards
Stefan
Quoted 4 lines
_______________________________________________
buildroot mailing list
buildroot at busybox.net
http://lists.busybox.net/mailman/listinfo/buildroot