Skip to contentSkip to conversation

polarssl: security bump to version 1.2.17

PATCH New Gustavo Zacarias 3 participants 3 messages Oct 16, 2015

lore
Share & tools
lore

Gustavo Zacarias

author
#0 lore raw

PATCH 1/1 polarssl: security bump to version 1.2.17

Fixes:
CVE-2015-5291 - Remote attack on clients using session tickets or SNI

Also includes countermeasures against Lenstra's RSA-CRT attach for PKCS#1 v1.5 signatures (1.2.16) and the Logjam attack (1.2.15).

Signed-off-by Gustavo Zacarias <[email protected]>
---
 package/polarssl/polarssl.hash | 4 ++--
 package/polarssl/polarssl.mk   | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)
package/polarssl/polarssl.hash +2 -2
index e7883fd..c203392 100644
@@ -1,2 +1,2 @@
-# From https://polarssl.org/tech-updates/releases/polarssl-1.2.14-released
-sha256	d7cbd8314aa3a5441f6282d13d07df610f49b4bc678088b04188adf093d17d37	polarssl-1.2.14-gpl.tgz
+# From https://tls.mbed.org/tech-updates/releases/mbedtls-2.1.2-and-1.3.14-and-polarssl-1.2.17-released
+sha256	9301d4ebec3eb45bc9f28f2d79bfdb0c3dd351c386aa6cc66643e1b2be274d52	polarssl-1.2.17-gpl.tgz
package/polarssl/polarssl.mk +1 -1
index 289a28d..aaa6759 100644
@@ -5,7 +5,7 @@
 ################################################################################
 
 POLARSSL_SITE = https://tls.mbed.org/code/releases
-POLARSSL_VERSION = 1.2.14
+POLARSSL_VERSION = 1.2.17
 POLARSSL_SOURCE = polarssl-$(POLARSSL_VERSION)-gpl.tgz
 POLARSSL_CONF_OPTS = \
 	-DENABLE_PROGRAMS=$(if $(BR2_PACKAGE_POLARSSL_PROGRAMS),ON,OFF)
Signature · 1 line
2.4.9
#1 lore raw

PATCH 1/1 polarssl: security bump to version 1.2.17

Dear Gustavo Zacarias,

Quoted 7 lines · Gustavo Zacarias

Fixes:
CVE-2015-5291 - Remote attack on clients using session tickets or SNI

Also includes countermeasures against Lenstra's RSA-CRT attach for PKCS#1 v1.5 signatures (1.2.16) and the Logjam attack (1.2.15).

Signed-off-by Gustavo Zacarias <[email protected]>
Reviewed-by Vicente Olivert Riera <[email protected]>
Tested-by Vicente Olivert Riera <[email protected]>

Build test for MIPS architecture:

$ grep -E ^POLARSSL_VERSION package/polarssl/polarssl.mk
POLARSSL_VERSION = 1.2.17
$ file output/target/usr/lib/libpolarssl.so.1.2.17
output/target/usr/lib/libpolarssl.so.1.2.17: ELF 32-bit MSB shared
object, MIPS, MIPS32 rel2 version 1 (SYSV), dynamically linked, with
unknown capability 0x41000000 = 0xf676e75, with unknown capability
0x10000 = 0x70401, stripped

Regards,

Vincent.

#2 lore raw

PATCH 1/1 polarssl: security bump to version 1.2.17

In reply to Gustavo Zacarias
Quoted 9 lines
Quoted 1 line
Quoted 1 line
Quoted 1 line
Quoted 1 line

"Gustavo" == Gustavo Zacarias <[email protected]> writes:

Fixes:
CVE-2015-5291 - Remote attack on clients using session tickets or SNI

Also includes countermeasures against Lenstra's RSA-CRT attach for PKCS#1 v1.5 signatures (1.2.16) and the Logjam attack (1.2.15).

Signed-off-by Gustavo Zacarias <[email protected]>

Committed, thanks.

Signature · 1 line
Bye, Peter Korsgaard