Skip to contentSkip to conversation

openssl: security bump to version 1.0.2e

PATCH New gustavo.zacarias at free-electrons.com 3 participants 3 messages Dec 3, 2015

lore
Share & tools
lore

gustavo.zacarias at free-electrons.com

author
#0 lore raw

PATCH v2 1/1 openssl: security bump to version 1.0.2e

From: Gustavo Zacarias <[email protected]>

Fixes:
CVE-2015-3193 - BN_mod_exp may produce incorrect results on x86_64 CVE-2015-3194 - Certificate verify crash with missing PSS parameter CVE-2015-3195 - X509_ATTRIBUTE memory leak

Enable IDEA as well since otherwise the build breaks (always great upstream) - it's no longer patent encumbered.

Signed-off-by Gustavo Zacarias <[email protected]>
---
 package/openssl/openssl.hash | 4 ++--
 package/openssl/openssl.mk   | 3 +--
 2 files changed, 3 insertions(+), 4 deletions(-)
package/openssl/openssl.hash +2 -2
index 355be79..bed1c1c 100644
@@ -1,2 +1,2 @@
-# From https://www.openssl.org/source/openssl-1.0.2d.tar.gz.sha256
-sha256	671c36487785628a703374c652ad2cebea45fa920ae5681515df25d9f2c9a8c8	openssl-1.0.2d.tar.gz
+# From https://www.openssl.org/source/openssl-1.0.2e.tar.gz.sha256
+sha256	eee11def03647aa2267434a779608af6fca645023c9a194ddb82f14426835537	openssl-1.0.2e.tar.gz
package/openssl/openssl.mk +1 -2
index da492ff..1f07df1 100644
@@ -4,7 +4,7 @@
 #
 ################################################################################
 
-OPENSSL_VERSION = 1.0.2d
+OPENSSL_VERSION = 1.0.2e
 OPENSSL_SITE = http://www.openssl.org/source
 OPENSSL_LICENSE = OpenSSL or SSLeay
 OPENSSL_LICENSE_FILES = LICENSE

@@ -77,7 +77,6 @@ define OPENSSL_CONFIGURE_CMDS
 			--libdir=/lib \
 			$(if $(BR2_TOOLCHAIN_HAS_THREADS),threads,no-threads) \
 			$(if $(BR2_STATIC_LIBS),no-shared,shared) \
-			no-idea \
 			no-rc5 \
 			enable-camellia \
 			enable-mdc2 \
Signature · 1 line
2.4.10
#1 lore raw

PATCH v2 1/1 openssl: security bump to version 1.0.2e

Quoted 22 lines
Quoted 1 line
Quoted 1 line
Quoted 1 line
Quoted 1 line

"gustavo" == gustavo zacarias <[email protected]> writes:

From: Gustavo Zacarias <[email protected]> Fixes:
CVE-2015-3193 - BN_mod_exp may produce incorrect results on x86_64 CVE-2015-3194 - Certificate verify crash with missing PSS parameter CVE-2015-3195 - X509_ATTRIBUTE memory leak

Enable IDEA as well since otherwise the build breaks (always great upstream) - it's no longer patent encumbered.

Signed-off-by Gustavo Zacarias <[email protected]>
---
 package/openssl/openssl.hash | 4 ++--
 package/openssl/openssl.mk   | 3 +--
 2 files changed, 3 insertions(+), 4 deletions(-)
package/openssl/openssl.hash +0 -0
index 355be79..bed1c1c 100644

package/openssl/openssl.hash line 2

Quoted 4 lines
package/openssl/openssl.hash +2 -2
@@ -1,2 +1,2 @@
-# From https://www.openssl.org/source/openssl-1.0.2d.tar.gz.sha256
-sha256	671c36487785628a703374c652ad2cebea45fa920ae5681515df25d9f2c9a8c8	openssl-1.0.2d.tar.gz
+# From https://www.openssl.org/source/openssl-1.0.2e.tar.gz.sha256
+sha256	eee11def03647aa2267434a779608af6fca645023c9a194ddb82f14426835537	openssl-1.0.2e.tar.gz

I'm not sure if you got it wrong of if upstream changed the tarball, but that isn't the correct sha256:

curl https://www.openssl.org/source/openssl-1.0.2e.tar.gz.sha256
e23ccafdb75cfcde782da0151731aa2185195ac745eea3846133f2e05c0e0bff

curl -s https://www.openssl.org/source/openssl-1.0.2e.tar.gz | sha256sum e23ccafdb75cfcde782da0151731aa2185195ac745eea3846133f2e05c0e0bff -

Committed with that fixed, thanks. I'll also add it to the 2015.11.x branch.

Signature · 1 line
Bye, Peter Korsgaard
#2 lore raw

PATCH v2 1/1 openssl: security bump to version 1.0.2e

Quoted 13 lines · Peter Korsgaard

package/openssl/openssl.hash line 2

Quoted 10 lines
Quoted 1 line
Quoted 1 line
Quoted 1 line
Quoted 1 line

"gustavo" == gustavo zacarias <[email protected]> writes:

From: Gustavo Zacarias <[email protected]>

package/openssl/openssl.hash +2 -2
@@ -1,2 +1,2 @@
-# From https://www.openssl.org/source/openssl-1.0.2d.tar.gz.sha256
-sha256	671c36487785628a703374c652ad2cebea45fa920ae5681515df25d9f2c9a8c8	openssl-1.0.2d.tar.gz
+# From https://www.openssl.org/source/openssl-1.0.2e.tar.gz.sha256
+sha256	eee11def03647aa2267434a779608af6fca645023c9a194ddb82f14426835537	openssl-1.0.2e.tar.gz

I'm not sure if you got it wrong of if upstream changed the tarball, but that isn't the correct sha256:

upstream re-released the tarballs because they messed up the release and
didn't include a few files. so make install failed.
-mike
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: Digital signature
URL: <http://lists.busybox.net/pipermail/buildroot/attachments/20151203/6a0911fd/attachment.asc>