Skip to content

OpenSSL CVE fixes for the dora branch

Paul Eggleton openembedded-core 1 version In review

Get series with b4
b4 am [email protected]

Versions newest first

  1. v1 Latest4 patches 1 replyIn review

Patches in v1 No applies recorded yet

#Subject and filesSizeRepliesApplied
1/4Security Advisory - openssl - CVE-2013-4353meta/recipes-connectivity/openssl/openssl-1.0.1e/0001-Fix-for-TLS-record-tampering-bug-CVE-2013-4353.patch meta/recipes-connectivity/openssl/openssl_1.0.1e.bb+32 -00 replies
2/4Security Advisory - openssl - CVE-2013-6450meta/recipes-connectivity/openssl/openssl-1.0.1e/0001-Fix-DTLS-retransmission-from-previous-session.patch meta/recipes-connectivity/openssl/openssl_1.0.1e.bb+82 -00 replies
3/4Security Advisory - openssl - CVE-2013-6449meta/recipes-connectivity/openssl/openssl-1.0.1e/0001-Use-version-in-SSL_METHOD-not-SSL-structure.patch meta/recipes-connectivity/openssl/openssl_1.0.1e.bb+34 -00 replies
4/4openssl: backport fix for CVE-2014-0160meta/recipes-connectivity/openssl/openssl-1.0.1e/CVE-2014-0160.patch meta/recipes-connectivity/openssl/openssl_1.0.1e.bb+119 -00 replies

Reviews trailers per patch

No Reviewed-by, Acked-by or Tested-by trailers for v1 yet.

Read the v1 thread

Cover letter [dora][PATCH 0/4] OpenSSL CVE fixes for the dora branch

Three backports for CVE fixes from master, plus one new fix for the latest CVE (CVE-2014-0160). The latter is not needed for master with Cristiana's upgrade to version 1.0.1g sent out today.

The following changes since commit 590c2135858bb5d0cfc375c0d82ca610550ccd4a:

Revert "buildhistory_analysis: fix error when comparing image contents" (2014-04-04 16:16:39 +0100)

are available in the git repository at:

git://git.openembedded.org/openembedded-core-contrib paule/openssl-cves
http://cgit.openembedded.org/cgit.cgi/openembedded-core-contrib/log/?h=paule/openssl-cves

Paul Eggleton (1):
openssl: backport fix for CVE-2014-0160

Yue Tao (3):
Security Advisory - openssl - CVE-2013-4353
Security Advisory - openssl - CVE-2013-6450
Security Advisory - openssl - CVE-2013-6449

 ...DTLS-retransmission-from-previous-session.patch |  81 ++++++++++++++
 ...or-TLS-record-tampering-bug-CVE-2013-4353.patch |  31 ++++++
 ...e-version-in-SSL_METHOD-not-SSL-structure.patch |  33 ++++++
 .../openssl/openssl-1.0.1e/CVE-2014-0160.patch     | 118 +++++++++++++++++++++
 .../recipes-connectivity/openssl/openssl_1.0.1e.bb |   4 +
 5 files changed, 267 insertions(+)
 create mode 100644 meta/recipes-connectivity/openssl/openssl-1.0.1e/0001-Fix-DTLS-retransmission-from-previous-session.patch
 create mode 100644 meta/recipes-connectivity/openssl/openssl-1.0.1e/0001-Fix-for-TLS-record-tampering-bug-CVE-2013-4353.patch
 create mode 100644 meta/recipes-connectivity/openssl/openssl-1.0.1e/0001-Use-version-in-SSL_METHOD-not-SSL-structure.patch
 create mode 100644 meta/recipes-connectivity/openssl/openssl-1.0.1e/CVE-2014-0160.patch
Signature · 1 line
1.9.0

Read the cover letter in its thread