openbsd, branch OPENBSD_4_7A mirror of https://github.com/libressl/openbsd.git
https://git.lua4.win/openbsd/atom?h=OPENBSD_4_72011-02-11T03:23:39+00:00MFC:2011-02-11T03:23:39+00:00djm2011-02-11T03:23:39+00:00urn:sha1:de026953401bceeb507b84983e244639462d6598
----------------------------
revision 1.8
date: 2011/02/10 22:40:27; author: djm; state: Exp; lines: +7 -1
fix for CVE-2011-0014 "OCSP stapling vulnerability";
ok markus@ jasper@ miod@
AFAIK nothing in base uses this, though apache2 from ports may be affected.
----------------------------
Security fix for CVE-2010-4180 as mentioned in http://www.openssl.org/news/secadv_20101202.txt.2010-12-15T09:44:25+00:00jasper2010-12-15T09:44:25+00:00urn:sha1:e6411b47d6dcb44d9016266fae15f1292dfbd319
where clients could modify the stored session
cache ciphersuite and in some cases even downgrade the suite to weaker ones.
This code is not enabled by default.
ok djm@
- Apply security fix for CVE-2010-3864.2010-11-17T19:14:22+00:00jasper2010-11-17T19:14:22+00:00urn:sha1:63a39dcec5af72c8e5548c4ab6e63f53ea446965
ok djm@ deraadt@
ecurity fix for CVE-2010-07402010-03-31T12:17:41+00:00jasper2010-03-31T12:17:41+00:00urn:sha1:85441e218187c663da9c679f474a7160c85ee3f2
"In TLS connections, certain incorrectly formatted records can cause an OpenSSL
client or server to crash due to a read attempt at NULL."
http://openssl.org/news/secadv_20100324.txt
ok djm@ sthen@
This commit was manufactured by cvs2git to create branch 'OPENBSD_4_7'.2010-03-10T20:46:18+00:00cvs2svnadmin@example.com2010-03-10T20:46:18+00:00urn:sha1:b1588b57c8d7dac5211d733762cf8d4cd26aa459It's unsetenv() that doesn't like `=' in the argument, not putenv().2010-03-10T20:46:16+00:00kili2010-03-10T20:46:16+00:00urn:sha1:a7a853e149f5a2468fd738638c4641dd59d6bc31
ok millert@
cherrypick patch from OpenSSL 0.9.8m:2010-03-04T11:02:42+00:00djm2010-03-04T11:02:42+00:00urn:sha1:9f75721dec306b453d31851a26bad908e9605c4f
*) Always check bn_wexpend() return values for failure. (CVE-2009-3245)
[Martin Olsson, Neel Mehta]
Fix the atelnet() function, which was wrong in several ways.2010-02-27T00:58:56+00:00nicm2010-02-27T00:58:56+00:00urn:sha1:95900d7e9c7c406efdaf6098a2bf4193d1722156
Pointed out by obsd at happyjack.org, fix based on a diff from kili@.
ok deraadt
Fix the worst among the fatal block-nesting issues we have in our tree,2010-02-23T23:00:52+00:00schwarze2010-02-23T23:00:52+00:00urn:sha1:e1078872617912e5553bcd54683368efa7d54328
in the end simply changing Oo Xo Oo Oc Oc Xc to Oo Xo Oo Oc Xc Oc.
I tried five different variants without the Xo/Xc, because there is
no real reason why Xo/Xc should be needed here, and two additional
variants with Xo/Xc that look more pretty than what i'm now committing.
All seven alternatives work both with mandoc and groff 1.20.1, but
all seven trigger various different bugs in our old groff, and we
still need to remain compatible with our old groff right now.
ok jmc@ sobrado@
Our groff does not handle all cases of nested displays properly, so2010-02-18T13:39:21+00:00schwarze2010-02-18T13:39:21+00:00urn:sha1:00c63ab59645edbe96c6197c108e64832eacbc71
resolve the contradiction in the manual whether it's allowed or not
in favour of "not allowed" for now, shelving my diff to support
nested displays in mandoc(1) for later consideration.
Found by and unbreaking the build with mandoc(1).
Feedback and OK jmc@