openssl security upgrade
cover openssl security upgrade
Hello,
This upgrade to the openssl recipe addresses a security vulnerability, CVE-2012-0884. I would like to ensure it gets included in our upcoming 1.2 release.
This upgrade has been build-tested on all 5 of our qemu architectures, and I have inspected the image and package output to ensure there were no significant differences between the output of this recipe upgrade and the last version of openssl we were using.
Scott
The following changes since commit 5d404fdb36b0535ce758d98408b02134cdbce4ee:
xserver-kdrive: compile xserver without dtrace support (2012-03-20 15:21:18 +0000)
are available in the git repository at:
git://git.pokylinux.org/poky-contrib sgarman/openssl-upgrade-oe
http://git.pokylinux.org/cgit.cgi/poky-contrib/log/?h=sgarman/openssl-upgrade-oe
Scott Garman (1):
openssl: upgrade to 1.0.0.h
.../openssl/openssl-1.0.0g/debian/pkg-config.patch | 36 --------------------
.../configure-targets.patch | 0
.../debian/c_rehash-compat.patch | 0
.../debian/ca.patch | 0
.../debian/debian-targets.patch | 0
.../debian/make-targets.patch | 0
.../debian/man-dir.patch | 0
.../debian/man-section.patch | 0
.../debian/no-rpath.patch | 0
.../debian/no-symbolic.patch | 0
.../debian/pic.patch | 0
.../debian/version-script.patch | 0
.../engines-install-in-libdir-ssl.patch | 0
.../oe-ldflags.patch | 0
.../openssl-fix-link.patch | 0
.../openssl_fix_for_x32.patch | 0
.../shared-libs.patch | 0
.../{openssl_1.0.0g.bb => openssl_1.0.0h.bb} | 5 +--
18 files changed, 2 insertions(+), 39 deletions(-)
delete mode 100644 meta/recipes-connectivity/openssl/openssl-1.0.0g/debian/pkg-config.patch
rename meta/recipes-connectivity/openssl/{openssl-1.0.0g => openssl-1.0.0h}/configure-targets.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl-1.0.0g => openssl-1.0.0h}/debian/c_rehash-compat.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl-1.0.0g => openssl-1.0.0h}/debian/ca.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl-1.0.0g => openssl-1.0.0h}/debian/debian-targets.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl-1.0.0g => openssl-1.0.0h}/debian/make-targets.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl-1.0.0g => openssl-1.0.0h}/debian/man-dir.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl-1.0.0g => openssl-1.0.0h}/debian/man-section.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl-1.0.0g => openssl-1.0.0h}/debian/no-rpath.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl-1.0.0g => openssl-1.0.0h}/debian/no-symbolic.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl-1.0.0g => openssl-1.0.0h}/debian/pic.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl-1.0.0g => openssl-1.0.0h}/debian/version-script.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl-1.0.0g => openssl-1.0.0h}/engines-install-in-libdir-ssl.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl-1.0.0g => openssl-1.0.0h}/oe-ldflags.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl-1.0.0g => openssl-1.0.0h}/openssl-fix-link.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl-1.0.0g => openssl-1.0.0h}/openssl_fix_for_x32.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl-1.0.0g => openssl-1.0.0h}/shared-libs.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl_1.0.0g.bb => openssl_1.0.0h.bb} (87%)Signature · 1 line
1.7.5.4
PATCH 1/1 openssl: upgrade to 1.0.0.h
Removed pkg-config.patch, which was incorporated upstream.
Addresses CVE-2012-0884.
Fixes bug [YOCTO #2139].
Signed-off-by Scott Garman <[email protected]>
---
.../openssl/openssl-1.0.0g/debian/pkg-config.patch | 36 --------------------
.../configure-targets.patch | 0
.../debian/c_rehash-compat.patch | 0
.../debian/ca.patch | 0
.../debian/debian-targets.patch | 0
.../debian/make-targets.patch | 0
.../debian/man-dir.patch | 0
.../debian/man-section.patch | 0
.../debian/no-rpath.patch | 0
.../debian/no-symbolic.patch | 0
.../debian/pic.patch | 0
.../debian/version-script.patch | 0
.../engines-install-in-libdir-ssl.patch | 0
.../oe-ldflags.patch | 0
.../openssl-fix-link.patch | 0
.../openssl_fix_for_x32.patch | 0
.../shared-libs.patch | 0
.../{openssl_1.0.0g.bb => openssl_1.0.0h.bb} | 5 +--
18 files changed, 2 insertions(+), 39 deletions(-)
delete mode 100644 meta/recipes-connectivity/openssl/openssl-1.0.0g/debian/pkg-config.patch
rename meta/recipes-connectivity/openssl/{openssl-1.0.0g => openssl-1.0.0h}/configure-targets.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl-1.0.0g => openssl-1.0.0h}/debian/c_rehash-compat.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl-1.0.0g => openssl-1.0.0h}/debian/ca.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl-1.0.0g => openssl-1.0.0h}/debian/debian-targets.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl-1.0.0g => openssl-1.0.0h}/debian/make-targets.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl-1.0.0g => openssl-1.0.0h}/debian/man-dir.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl-1.0.0g => openssl-1.0.0h}/debian/man-section.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl-1.0.0g => openssl-1.0.0h}/debian/no-rpath.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl-1.0.0g => openssl-1.0.0h}/debian/no-symbolic.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl-1.0.0g => openssl-1.0.0h}/debian/pic.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl-1.0.0g => openssl-1.0.0h}/debian/version-script.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl-1.0.0g => openssl-1.0.0h}/engines-install-in-libdir-ssl.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl-1.0.0g => openssl-1.0.0h}/oe-ldflags.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl-1.0.0g => openssl-1.0.0h}/openssl-fix-link.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl-1.0.0g => openssl-1.0.0h}/openssl_fix_for_x32.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl-1.0.0g => openssl-1.0.0h}/shared-libs.patch (100%)
rename meta/recipes-connectivity/openssl/{openssl_1.0.0g.bb => openssl_1.0.0h.bb} (87%)meta/recipes-connectivity/openssl/openssl-1.0.0g/debian/pkg-config.patch deleted +0 -36
@@ -1,36 +0,0 @@ -Upstream-Status: Backport [debian] - -Index: openssl-1.0.0c/Makefile.org -=================================================================== ---- openssl-1.0.0c.orig/Makefile.org 2010-12-12 16:13:28.000000000 +0100 -+++ openssl-1.0.0c/Makefile.org 2010-12-12 17:01:49.000000000 +0100 -@@ -323,7 +323,8 @@ - echo 'Description: OpenSSL cryptography library'; \ - echo 'Version: '$(VERSION); \ - echo 'Requires: '; \ -- echo 'Libs: -L$${libdir} -lcrypto $(EX_LIBS)'; \ -+ echo 'Libs: -L$${libdir} -lcrypto'; \ -+ echo 'Libs.private: $(EX_LIBS)'; \ - echo 'Cflags: -I$${includedir} $(KRB5_INCLUDES)' ) > libcrypto.pc - - libssl.pc: Makefile -@@ -336,7 +337,8 @@ - echo 'Description: Secure Sockets Layer and cryptography libraries'; \ - echo 'Version: '$(VERSION); \ - echo 'Requires: '; \ -- echo 'Libs: -L$${libdir} -lssl -lcrypto $(EX_LIBS)'; \ -+ echo 'Libs: -L$${libdir} -lssl'; \ -+ echo 'Libs.private: -lcrypto $(EX_LIBS)'; \ - echo 'Cflags: -I$${includedir} $(KRB5_INCLUDES)' ) > libssl.pc - - openssl.pc: Makefile -@@ -349,7 +351,8 @@ - echo 'Description: Secure Sockets Layer and cryptography libraries and tools'; \ - echo 'Version: '$(VERSION); \ - echo 'Requires: '; \ -- echo 'Libs: -L$${libdir} -lssl -lcrypto $(EX_LIBS)'; \ -+ echo 'Libs: -L$${libdir} -lssl -lcrypto'; \ -+ echo 'Libs.private: $(EX_LIBS)'; \ - echo 'Cflags: -I$${includedir} $(KRB5_INCLUDES)' ) > openssl.pc - - Makefile: Makefile.org Configure config
meta/recipes-connectivity/openssl/openssl-1.0.0h/configure-targets.patch renamed from meta/recipes-connectivity/openssl/openssl-1.0.0g/configure-targets.patch +0 -0
meta/recipes-connectivity/openssl/openssl-1.0.0h/debian/c_rehash-compat.patch renamed from meta/recipes-connectivity/openssl/openssl-1.0.0g/debian/c_rehash-compat.patch +0 -0
meta/recipes-connectivity/openssl/openssl-1.0.0h/debian/ca.patch renamed from meta/recipes-connectivity/openssl/openssl-1.0.0g/debian/ca.patch +0 -0
meta/recipes-connectivity/openssl/openssl-1.0.0h/debian/debian-targets.patch renamed from meta/recipes-connectivity/openssl/openssl-1.0.0g/debian/debian-targets.patch +0 -0
meta/recipes-connectivity/openssl/openssl-1.0.0h/debian/make-targets.patch renamed from meta/recipes-connectivity/openssl/openssl-1.0.0g/debian/make-targets.patch +0 -0
meta/recipes-connectivity/openssl/openssl-1.0.0h/debian/man-dir.patch renamed from meta/recipes-connectivity/openssl/openssl-1.0.0g/debian/man-dir.patch +0 -0
meta/recipes-connectivity/openssl/openssl-1.0.0h/debian/man-section.patch renamed from meta/recipes-connectivity/openssl/openssl-1.0.0g/debian/man-section.patch +0 -0
meta/recipes-connectivity/openssl/openssl-1.0.0h/debian/no-rpath.patch renamed from meta/recipes-connectivity/openssl/openssl-1.0.0g/debian/no-rpath.patch +0 -0
meta/recipes-connectivity/openssl/openssl-1.0.0h/debian/no-symbolic.patch renamed from meta/recipes-connectivity/openssl/openssl-1.0.0g/debian/no-symbolic.patch +0 -0
meta/recipes-connectivity/openssl/openssl-1.0.0h/debian/pic.patch renamed from meta/recipes-connectivity/openssl/openssl-1.0.0g/debian/pic.patch +0 -0
meta/recipes-connectivity/openssl/openssl-1.0.0h/debian/version-script.patch renamed from meta/recipes-connectivity/openssl/openssl-1.0.0g/debian/version-script.patch +0 -0
meta/recipes-connectivity/openssl/openssl-1.0.0h/engines-install-in-libdir-ssl.patch renamed from meta/recipes-connectivity/openssl/openssl-1.0.0g/engines-install-in-libdir-ssl.patch +0 -0
meta/recipes-connectivity/openssl/openssl-1.0.0h/oe-ldflags.patch renamed from meta/recipes-connectivity/openssl/openssl-1.0.0g/oe-ldflags.patch +0 -0
meta/recipes-connectivity/openssl/openssl-1.0.0h/openssl-fix-link.patch renamed from meta/recipes-connectivity/openssl/openssl-1.0.0g/openssl-fix-link.patch +0 -0
meta/recipes-connectivity/openssl/openssl-1.0.0h/openssl_fix_for_x32.patch renamed from meta/recipes-connectivity/openssl/openssl-1.0.0g/openssl_fix_for_x32.patch +0 -0
meta/recipes-connectivity/openssl/openssl-1.0.0h/shared-libs.patch renamed from meta/recipes-connectivity/openssl/openssl-1.0.0g/shared-libs.patch +0 -0
meta/recipes-connectivity/openssl/openssl_1.0.0h.bb renamed from meta/recipes-connectivity/openssl/openssl_1.0.0g.bb +2 -3
@@ -26,14 +26,13 @@ SRC_URI += "file://configure-targets.patch \ file://debian/no-rpath.patch \ file://debian/man-dir.patch \ file://debian/man-section.patch \ - file://debian/pkg-config.patch \ file://debian/no-symbolic.patch \ file://debian/debian-targets.patch \ file://openssl_fix_for_x32.patch \ " -SRC_URI[md5sum] = "07ecbe4324f140d157478637d6beccf1" -SRC_URI[sha256sum] = "905106a1505e7d9f7c36ee81408d3aa3d41aac291a9603d0c290c9530c92fc2c" +SRC_URI[md5sum] = "a5bc483c570f2ac3758ce5c19b667fab" +SRC_URI[sha256sum] = "7e3dfc21aa57ed33ea673170053d1921322803b8a6a624a4f0d2e4c308bd418d" PACKAGES =+ " \ ${PN}-engines \
Signature · 1 line
1.7.5.4
Quoted 10 lines · Scott Garman
Hello,
This upgrade to the openssl recipe addresses a security vulnerability, CVE-2012-0884. I would like to ensure it gets included in our upcoming 1.2 release.
This upgrade has been build-tested on all 5 of our qemu architectures, and I have inspected the image and package output to ensure there were no significant differences between the output of this recipe upgrade and the last version of openssl we were using.
I had forgotten to update the distro_tracking fields with this pull request - so I've pushed a commit onto this branch to do so.
Scott
Signature · 3 lines
Scott Garman Embedded Linux Engineer - Yocto Project Intel Open Source Technology Center
Richard Purdie
AppliedQuoted 8 lines · Scott Garman
This upgrade to the openssl recipe addresses a security vulnerability, CVE-2012-0884. I would like to ensure it gets included in our upcoming 1.2 release.
This upgrade has been build-tested on all 5 of our qemu architectures, and I have inspected the image and package output to ensure there were no significant differences between the output of this recipe upgrade and the last version of openssl we were using.
Merged to master, thanks.
Richard