Hello community, here is the log from the commit of package openssl-1_1 for openSUSE:Factory checked in at 2019-11-20 13:42:29 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/openssl-1_1 (Old) and /work/SRC/openSUSE:Factory/.openssl-1_1.new.26869 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "openssl-1_1" Wed Nov 20 13:42:29 2019 rev:9 rq:738529 version:1.1.1d Changes: -------- --- /work/SRC/openSUSE:Factory/openssl-1_1/openssl-1_1.changes 2019-06-18 14:51:42.281613714 +0200 +++ /work/SRC/openSUSE:Factory/.openssl-1_1.new.26869/openssl-1_1.changes 2019-11-20 13:42:39.644285832 +0100 @@ -1,0 +2,61 @@ +Mon Oct 14 18:36:37 UTC 2019 - Jason Sikes <[email protected]> + +- Merged upstream changes to allow NULL salt values in EVP_PBE_scrypt(). + * Revealed by nodejs12 during bsc#1149572. + * Modified openssl-jsc-SLE-8789-backport_KDF.patch + +------------------------------------------------------------------- +Mon Oct 14 08:45:39 UTC 2019 - Adam Majer <[email protected]> + +- openssl-jsc-SLE-8789-backport_KDF.patch: retain old behaviour + of EVP_PBE_scrypt. When key output buffer is not provided, + only check if the input parameters are in valid range and + ignore passphrase/salt fields as they are only used in + the actual calculation. + +------------------------------------------------------------------- +Wed Sep 11 09:32:16 UTC 2019 - Vítězslav Čížek <[email protected]> + +- Update to 1.1.1d (bsc#1133925, jsc#SLE-6430) + * Fixed a fork protection issue. OpenSSL 1.1.1 introduced a rewritten random + number generator (RNG). This was intended to include protection in the + event of a fork() system call in order to ensure that the parent and child + processes did not share the same RNG state. However this protection was not + being used in the default case. + (bsc#1150247, CVE-2019-1549) + * Compute ECC cofactors if not provided during EC_GROUP construction. Before + this change, EC_GROUP_set_generator would accept order and/or cofactor as + NULL. After this change, only the cofactor parameter can be NULL. + (bsc#1150003, CVE-2019-1547) + * Fixed a padding oracle in PKCS7_dataDecode and CMS_decrypt_set1_pkey. + (bsc#1150250, CVE-2019-1563) + * For built-in EC curves, ensure an EC_GROUP built from the curve name is + used even when parsing explicit parameters, when loading a serialized key + or calling EC_GROUP_new_from_ecpkparameters()/EC_GROUP_new_from_ecparameters(). + * Early start up entropy quality from the DEVRANDOM seed source has been + improved for older Linux systems. + * Changed DH_check to accept parameters with order q and 2q subgroups. + With order 2q subgroups the bit 0 of the private key is not secret + but DH_generate_key works around that by clearing bit 0 of the + private key for those. This avoids leaking bit 0 of the private key. + * Significantly reduce secure memory usage by the randomness pools. + * Revert the DEVRANDOM_WAIT feature for Linux systems +- drop 0001-build_SYS_str_reasons-Fix-a-crash-caused-by-overlong.patch (upstream) +- refresh patches + * openssl-1.1.0-no-html.patch + * openssl-jsc-SLE-8789-backport_KDF.patch + +------------------------------------------------------------------- +Tue Sep 10 19:26:34 UTC 2019 - Jason Sikes <[email protected]> + +- To avoid seperate certification of openssh server / client + move the SSH KDF (Key Derivation Function) into openssl. + * jsc#SLE-8789 + * Sourced from commit + 8d76481b189b7195ef932e0fb8f0e23ab0120771#diff-a9562bc75317360a2e6b8b0748956e34 + in openssl master (introduce the SSH KDF) + and commit 5a285addbf39f91d567f95f04b2b41764127950d + in openssl master (backport EVP/KDF API framework) + * added openssl-jsc-SLE-8789-backport_KDF.patch + +------------------------------------------------------------------- Old: ---- 0001-build_SYS_str_reasons-Fix-a-crash-caused-by-overlong.patch openssl-1.1.1c.tar.gz openssl-1.1.1c.tar.gz.asc New: ---- openssl-1.1.1d.tar.gz openssl-1.1.1d.tar.gz.asc openssl-jsc-SLE-8789-backport_KDF.patch ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ openssl-1_1.spec ++++++ --- /var/tmp/diff_new_pack.AbdpKw/_old 2019-11-20 13:42:44.492284351 +0100 +++ /var/tmp/diff_new_pack.AbdpKw/_new 2019-11-20 13:42:44.496284350 +0100 @@ -21,7 +21,7 @@ %define _rname openssl Name: openssl-1_1 # Don't forget to update the version in the "openssl" package! -Version: 1.1.1c +Version: 1.1.1d Release: 0 Summary: Secure Sockets and Transport Layer Security License: OpenSSL @@ -43,8 +43,6 @@ Patch4: openssl-DEFAULT_SUSE_cipher.patch Patch5: openssl-ppc64-config.patch Patch6: openssl-no-date.patch -# PATCH-FIX-UPSTREAM https://github.com/openssl/openssl/pull/8966 -Patch7: 0001-build_SYS_str_reasons-Fix-a-crash-caused-by-overlong.patch # PATCH-FIX-UPSTREAM jsc#SLE-6126 and jsc#SLE-6129 Patch8: 0001-s390x-assembly-pack-perlasm-support.patch Patch9: 0002-crypto-chacha-asm-chacha-s390x.pl-add-vx-code-path.patch @@ -52,6 +50,7 @@ Patch11: 0004-s390x-assembly-pack-fix-formal-interface-bug-in-chac.patch Patch12: 0005-s390x-assembly-pack-import-chacha-from-cryptogams-re.patch Patch13: 0006-s390x-assembly-pack-import-poly-from-cryptogams-repo.patch +Patch14: openssl-jsc-SLE-8789-backport_KDF.patch BuildRequires: pkgconfig Conflicts: ssl Provides: ssl ++++++ openssl-1.1.0-no-html.patch ++++++ --- /var/tmp/diff_new_pack.AbdpKw/_old 2019-11-20 13:42:44.540284336 +0100 +++ /var/tmp/diff_new_pack.AbdpKw/_new 2019-11-20 13:42:44.540284336 +0100 @@ -1,7 +1,8 @@ -diff -up openssl-1.1.0-pre5/Configurations/unix-Makefile.tmpl.nohtml openssl-1.1.0-pre5/Configurations/unix-Makefile.tmpl ---- openssl-1.1.0-pre5/Configurations/unix-Makefile.tmpl.no-html 2016-04-19 16:57:52.000000000 +0200 -+++ openssl-1.1.0-pre5/Configurations/unix-Makefile.tmpl 2016-07-18 13:58:55.060106243 +0200 -@@ -288,7 +288,7 @@ install_sw: all install_dev install_engi +Index: openssl-1.1.1d/Configurations/unix-Makefile.tmpl +=================================================================== +--- openssl-1.1.1d.orig/Configurations/unix-Makefile.tmpl 2019-09-11 15:38:17.788265421 +0200 ++++ openssl-1.1.1d/Configurations/unix-Makefile.tmpl 2019-09-11 15:38:35.640368636 +0200 +@@ -544,7 +544,7 @@ install_sw: install_dev install_engines uninstall_sw: uninstall_runtime uninstall_engines uninstall_dev @@ -9,4 +10,4 @@ +install_docs: install_man_docs uninstall_docs: uninstall_man_docs uninstall_html_docs - $(RM) -r -v $(DESTDIR)$(DOCDIR) + $(RM) -r $(DESTDIR)$(DOCDIR) ++++++ openssl-1.1.1c.tar.gz -> openssl-1.1.1d.tar.gz ++++++ /work/SRC/openSUSE:Factory/openssl-1_1/openssl-1.1.1c.tar.gz /work/SRC/openSUSE:Factory/.openssl-1_1.new.26869/openssl-1.1.1d.tar.gz differ: char 5, line 1 ++++++ openssl-jsc-SLE-8789-backport_KDF.patch ++++++ ++++ 10719 lines (skipped)
