openbsd/src/lib/libssl, branch OPENBSD_4_5 A mirror of https://github.com/libressl/openbsd.git https://git.lua4.win/openbsd/atom?h=OPENBSD_4_5 2010-03-31T12:16:44+00:00 Security fix for CVE-2010-0740 2010-03-31T12:16:44+00:00 jasper 2010-03-31T12:16:44+00:00 urn:sha1:2ee55d26ee7a373bc8d7e0cd1e4532884ada8fa0 "In TLS connections, certain incorrectly formatted records can cause an OpenSSL client or server to crash due to a read attempt at NULL." http://openssl.org/news/secadv_20100324.txt ok djm@ sthen@ MFC, original commit by djm@: 2010-03-12T13:26:41+00:00 jasper 2010-03-12T13:26:41+00:00 urn:sha1:5876608ee68cc67de9b401842a171c25c54031c2 --------------------------- cherrypick patch from OpenSSL 0.9.8m: *) Always check bn_wexpend() return values for failure. (CVE-2009-3245) [Martin Olsson, Neel Mehta] --------------------------- ok sthen@ Pull Ben Lauries blind prefix injection fix for CVE-2009-3555 from 2009-11-17T14:34:41+00:00 sthen 2009-11-17T14:34:41+00:00 urn:sha1:990837b47cd7f41d299b338edf67d7771c204288 openssl 0.9.8l. As suggested by markus@, for -stable the header change is being restricted to a private file, so the minor version is not cranked here. Discussed with markus, djm, deraadt. MFC: fixes for OpenSSL ASN.1 invalid memory accesses (CVE-2009-0590 and 2009-04-08T02:30:30+00:00 djm 2009-04-08T02:30:30+00:00 urn:sha1:90917d997a66b5127abae66212a5ff788b40772b CVE-2009-0789). This commit was manufactured by cvs2git to create branch 'OPENBSD_4_5'. 2009-02-18T15:24:57+00:00 cvs2svn admin@example.com 2009-02-18T15:24:57+00:00 urn:sha1:ba772f784ace9fbd80465f5d6c91340dda14ca7e missing ssl_sock_init() call in init_client() (used by 2009-01-30T03:58:35+00:00 djm 2009-01-30T03:58:35+00:00 urn:sha1:26ebb297ae136c0b5d1a4200bd9aeac375f078b6 "openssl s_client"), fix an unlikely memory leak remove some gratuitous changes that do nothing other than inrease 2009-01-30T03:56:05+00:00 djm 2009-01-30T03:56:05+00:00 urn:sha1:d7efac454212a21310500b6c840e8aa88706f48d the size of the diff against openssl mainline convert a strdup (into a purpose-allocated buffer) in libcrypto to a 2009-01-12T07:57:43+00:00 djm 2009-01-12T07:57:43+00:00 urn:sha1:ee0b5fae7a537ef1e11c2882c414209b8f533e58 memcpy to avoid linker deprecation warnings; pointed out by dkrause@ openssl-0.9.8j enables RFC3546 TLS extensions by default (e.g. the very 2009-01-09T12:32:25+00:00 djm 2009-01-09T12:32:25+00:00 urn:sha1:2b0ae02b5f47fd5617da3480ef1ade14bc86155f useful "server name indication" that allows multihomed TLS server), so remove the #define to disable it here adjust Makefile and crank major for openssl-0.9.8j 2009-01-09T12:16:58+00:00 djm 2009-01-09T12:16:58+00:00 urn:sha1:4e44f026fb3097b0f0c5c69d32f49ea214a4518f