openbsd/src/lib/libssl, branch libressl-v2.0.6 A mirror of https://github.com/libressl/openbsd.git https://git.lua4.win/openbsd/atom?h=libressl-v2.0.6 2015-10-15T02:23:06+00:00 pull up fixes for leak and overrun 2015-10-15T02:23:06+00:00 tedu 2015-10-15T02:23:06+00:00 urn:sha1:61fc5ede295ff4dded0a54dfe30d3a7a0dff1150 MFC: Fix several defects from OpenSSL. 2015-06-11T16:11:03+00:00 jsing 2015-06-11T16:11:03+00:00 urn:sha1:f77fa3f4f2e16ea7b0708d4c55651c03688897d6 These include: CVE-2015-1788 - Malformed ECParameters causes infinite loop CVE-2015-1789 - Exploitable out-of-bounds read in X509_cmp_time CVE-2015-1792 - CMS verify infinite loop with unknown hash function Fix several crash causing defects from OpenSSL. 2015-03-19T14:02:30+00:00 tedu 2015-03-19T14:02:30+00:00 urn:sha1:0c64b73d516a83e3b8fcec4d3cfe069fc26e3a9f These include: CVE-2015-0209 - Use After Free following d2i_ECPrivatekey error CVE-2015-0286 - Segmentation fault in ASN1_TYPE_cmp CVE-2015-0287 - ASN.1 structure reuse memory corruption CVE-2015-0288 - X509_to_X509_REQ NULL pointer deref CVE-2015-0289 - PKCS7 NULL pointer dereferences Several other issues did not apply or were already fixed. Refer to https://www.openssl.org/news/secadv_20150319.txt joint work with beck, doug, guenther, jsing, miod backport fixes to prevent connections from being downgraded to weak keys. 2015-03-11T19:52:41+00:00 tedu 2015-03-11T19:52:41+00:00 urn:sha1:42143ecdee76b07d30e60289dfff61b5d249ceb4 ok bluhm miod disable SSLv3 by default. all agreed. 2014-10-20T21:24:06+00:00 tedu 2014-10-20T21:24:06+00:00 urn:sha1:c42e84c4aa9a4a05220069f4d4fa1c86db7767ec This commit was manufactured by cvs2git to create branch 'OPENBSD_5_6'. 2014-08-08T05:06:58+00:00 cvs2svn admin@example.com 2014-08-08T05:06:58+00:00 urn:sha1:9033820a64c84908dee3f9261ad212f6b6c3449a Fix CVE-2014-3507, avoid allocating and then leaking a fresh fragment 2014-08-08T05:06:56+00:00 guenther 2014-08-08T05:06:56+00:00 urn:sha1:d4e460a24e2f9d4fe391e756145c2fdf4de7b218 structure when a zero-length fragment is received. Based on https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=d0a4b7d1a2948fce38515b8d862f43e7ba0ebf74 diff by miod@, ok guenther@ bcook@ deraadt@ Fix CVE-2014-3508, pretty printing and OID validation: 2014-08-08T04:53:43+00:00 guenther 2014-08-08T04:53:43+00:00 urn:sha1:39cb4488ec5412e0f592f7fabdb5ab22cded5edc - make sure the output buffer is always NUL terminated if buf_len was initially greater than zero. - reject OIDs that are too long, too short, or not in proper base-127 Based on https://git.openssl.org/gitweb/?p=openssl.git;a=commit;h=0042fb5fd1c9d257d713b15a1f45da05cf5c1c87 ok bcook@ Correct test reversed during merge of fix for CVE-2014-3509 2014-08-07T22:27:28+00:00 guenther 2014-08-07T22:27:28+00:00 urn:sha1:799e1b07f7a6a3c12b4d9bcb834487ad22b1f33b pointed out by Watson Ladd (watson (at) matasano.com) ok deraadt@ Fix CVE-2014-3506, DTLS handshake message size checks. From 2014-08-07T20:24:12+00:00 guenther 2014-08-07T20:24:12+00:00 urn:sha1:986fbb43f48b0f41d3a014d235f9443f69592f5f https://git.openssl.org/gitweb/?p=openssl.git;a=commit;h=1250f12613b61758675848f6600ebd914ccd7636 with comment/whitespace style tweaks ok bcook@ miod@