Hello community, here is the log from the commit of package mbedtls for openSUSE:Factory checked in at 2018-04-07 20:53:14 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/mbedtls (Old) and /work/SRC/openSUSE:Factory/.mbedtls.new (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "mbedtls" Sat Apr 7 20:53:14 2018 rev:16 rq:593915 version:2.8.0 Changes: -------- --- /work/SRC/openSUSE:Factory/mbedtls/mbedtls.changes 2018-03-12 12:07:47.291913106 +0100 +++ /work/SRC/openSUSE:Factory/.mbedtls.new/mbedtls.changes 2018-04-07 20:53:20.246468241 +0200 @@ -1,0 +2,31 @@ +Fri Apr 6 08:17:46 UTC 2018 - [email protected] + +- Update to version 2.8.0: + * Security: + + Defend against Bellcore glitch attacks by verifying the results of RSA private key operations. + + Fix implementation of the truncated HMAC extension. The previous implementation allowed an offline 2^80 brute force attack on the HMAC key of a single, uninterrupted connection (with no resumption of the session). + + Reject CRLs containing unsupported critical extensions. Found by Falko Strenzke and Evangelos Karatsiolis. + + Fix a buffer overread in ssl_parse_server_key_exchange() that could cause a crash on invalid input. + + Fix a buffer overread in ssl_parse_server_psk_hint() that could cause a crash on invalid input. + * Features: + + Enable reading encrypted PEM files produced by software that uses PBKDF2-SHA2, such as OpenSSL 1.1. Submitted by Antonio Quartulli, OpenVPN Inc. Fixes #1339 + + Support public keys encoded in PKCS#1 format. #1122 + * New deprecations: + + Compression and crypto don't mix. We don't recommend using compression and cryptography, and have deprecated support for record compression (configuration option MBEDTLS_ZLIB_SUPPORT). + * Bugfix: + + Fix mbedtls_x509_crt_profile_suiteb, which used to reject all certificates with flag MBEDTLS_X509_BADCERT_BAD_PK even when the key type was correct. In the context of SSL, this resulted in handshake failure. Reported by daniel in the Mbed TLS forum. #1351 + + Fix setting version TLSv1 as minimal version, even if TLS 1 is not enabled. Set MBEDTLS_SSL_MIN_MAJOR_VERSION and MBEDTLS_SSL_MIN_MINOR_VERSION instead of MBEDTLS_SSL_MAJOR_VERSION_3 and MBEDTLS_SSL_MINOR_VERSION_1. #664 + + Fix compilation error on Mingw32 when _TRUNCATE is defined. Use _TRUNCATE only if __MINGW32__ is not defined. Fix suggested by Thomas Glanzmann and Nick Wilson on issue #355 + + Fix memory allocation corner cases in memory_buffer_alloc.c module. Found by Guido Vranken. #639 + + Don't accept an invalid tag when parsing X.509 subject alternative names in some circumstances. + + Fix a possible arithmetic overflow in ssl_parse_server_key_exchange() that could cause a key exchange to fail on valid data. + + Fix a possible arithmetic overflow in ssl_parse_server_psk_hint() that could cause a key exchange to fail on valid data. + + Fix a 1-byte heap buffer overflow (read-only) during private key parsing. Found through fuzz testing. + * Changes + + Fix tag lengths and value ranges in the documentation of CCM encryption. Contributed by Mathieu Briand. + + Fix a typo in a comment in ctr_drbg.c. Contributed by Paul Sokolovsky. + + Remove support for the library reference configuration for picocoin. + + MD functions deprecated in 2.7.0 are no longer inline, to provide a migration path for those depending on the library's ABI. + + Use (void) when defining functions with no parameters. Contributed by Joris Aerts. #678 + +------------------------------------------------------------------- Old: ---- mbedtls-2.7.0-apache.tgz New: ---- mbedtls-2.8.0-apache.tgz ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ mbedtls.spec ++++++ --- /var/tmp/diff_new_pack.xbbaXQ/_old 2018-04-07 20:53:20.842446671 +0200 +++ /var/tmp/diff_new_pack.xbbaXQ/_new 2018-04-07 20:53:20.850446381 +0200 @@ -20,7 +20,7 @@ %define lib_crypto libmbedcrypto1 %define lib_x509 libmbedx509-0 Name: mbedtls -Version: 2.7.0 +Version: 2.8.0 Release: 0 Summary: Libraries for crypto and SSL/TLS protocols License: Apache-2.0 @@ -86,7 +86,7 @@ SSL/TLS protocol suite. %prep -%setup -q +%autosetup sed -i 's|//\(#define MBEDTLS_ZLIB_SUPPORT\)|\1|' include/mbedtls/config.h sed -i 's|//\(#define MBEDTLS_HAVEGE_C\)|\1|' include/mbedtls/config.h sed -i 's|//\(#define MBEDTLS_THREADING_C\)|\1|' include/mbedtls/config.h ++++++ mbedtls-2.7.0-apache.tgz -> mbedtls-2.8.0-apache.tgz ++++++ ++++ 7924 lines of diff (skipped)
