Hello community, here is the log from the commit of package openssl for openSUSE:Factory checked in at Tue Mar 15 09:28:50 CET 2011.
-------- --- openssl/openssl.changes 2011-01-15 21:02:09.000000000 +0100 +++ /mounts/work_src_done/STABLE/openssl/openssl.changes 2011-02-10 08:45:42.000000000 +0100 @@ -1,0 +2,6 @@ +Thu Feb 10 07:42:01 UTC 2011 - g...@novell.com + +- fix bug [bnc#670526] + CVE-2011-0014,OCSP stapling vulnerability + +------------------------------------------------------------------- calling whatdependson for head-i586 New: ---- CVE-2011-0014.patch ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ openssl.spec ++++++ --- /var/tmp/diff_new_pack.N472WH/_old 2011-03-15 09:28:46.000000000 +0100 +++ /var/tmp/diff_new_pack.N472WH/_new 2011-03-15 09:28:46.000000000 +0100 @@ -33,7 +33,7 @@ # #Version: 1.0.0 Version: 1.0.0c -Release: 3 +Release: 20 Summary: Secure Sockets and Transport Layer Security Url: http://www.openssl.org/ Source: http://www.%{name}.org/source/%{name}-%{version}.tar.bz2 @@ -49,6 +49,7 @@ #Patch5: CVE-2010-2939.patch #Patch6: CVE-2010-3864.patch Patch7: openssl-1.0.0b-aesni.patch +Patch8: CVE-2011-0014.patch BuildRoot: %{_tmppath}/%{name}-%{version}-build %description @@ -183,6 +184,7 @@ #%patch5 -p1 #%patch6 -p1 %patch7 -p1 +%patch8 -p1 cp -p %{S:10} . echo "adding/overwriting some entries in the 'table' hash in Configure" # $dso_scheme:$shared_target:$shared_cflag:$shared_ldflag:$shared_extension:$ranlib:$arflags ++++++ CVE-2011-0014.patch ++++++ Index: openssl-1.0.0c/ssl/t1_lib.c =================================================================== --- openssl-1.0.0c.orig/ssl/t1_lib.c +++ openssl-1.0.0c/ssl/t1_lib.c @@ -917,6 +917,7 @@ int ssl_parse_clienthello_tlsext(SSL *s, } n2s(data, idsize); dsize -= 2 + idsize; + size -= 2 + idsize; if (dsize < 0) { *al = SSL_AD_DECODE_ERROR; @@ -955,9 +956,14 @@ int ssl_parse_clienthello_tlsext(SSL *s, } /* Read in request_extensions */ + if (size < 2) + { + *al = SSL_AD_DECODE_ERROR; + return 0; + } n2s(data,dsize); size -= 2; - if (dsize > size) + if (dsize != size) { *al = SSL_AD_DECODE_ERROR; return 0; ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Remember to have fun... -- To unsubscribe, e-mail: opensuse-commit+unsubscr...@opensuse.org For additional commands, e-mail: opensuse-commit+h...@opensuse.org
