Hello community, here is the log from the commit of package openssl for openSUSE:Factory checked in at 2015-07-12 22:51:54 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/openssl (Old) and /work/SRC/openSUSE:Factory/.openssl.new (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "openssl" Changes: -------- --- /work/SRC/openSUSE:Factory/openssl/openssl.changes 2015-06-08 08:25:59.000000000 +0200 +++ /work/SRC/openSUSE:Factory/.openssl.new/openssl.changes 2015-07-12 22:51:56.000000000 +0200 @@ -1,0 +2,63 @@ +Thu Jul 9 13:32:34 UTC 2015 - [email protected] + +- update to 1.0.2d + * fixes CVE-2015-1793 (bsc#936746) + + Alternate chains certificate forgery + + During certificate verfification, OpenSSL will attempt to find an + alternative certificate chain if the first attempt to build such a chain + fails. An error in the implementation of this logic can mean that an + attacker could cause certain checks on untrusted certificates to be + bypassed, such as the CA flag, enabling them to use a valid leaf + certificate to act as a CA and "issue" an invalid certificate. +- drop openssl-fix_invalid_manpage_name.patch (upstream) + +------------------------------------------------------------------- +Thu Jul 2 14:46:36 UTC 2015 - [email protected] + +- Workaround debugit crash on ppc64le with gcc5 + bsc936563_hack.patch (bsc#936563) + +------------------------------------------------------------------- +Wed Jul 1 09:26:26 UTC 2015 - [email protected] + +- update merge_from_0.9.8k.patch replacing __LP64__ by __LP64 + this is a change versus previous request 309611 + required to avoid build error for ppc64 + +------------------------------------------------------------------- +Fri Jun 26 00:11:20 UTC 2015 - [email protected] + +- Build with no-ssl3, for details on why this is needed read + rfc7568. Contrary to the "no-ssl2" option, this does not + require us to patch dependant packages as the relevant + functions are still available (SSLv3_(client|server)_method) + but will fail to negotiate. if removing SSL3 methods is desired + at a later time, option "no-ssl3-method" needs to be used. + +------------------------------------------------------------------- +Fri Jun 12 21:22:45 UTC 2015 - [email protected] + +- update to 1.0.2c + * Fix HMAC ABI incompatibility +- refreshed openssl-1.0.2a-fips.patch + +------------------------------------------------------------------- +Thu Jun 11 15:50:44 UTC 2015 - [email protected] + +- update to 1.0.2b + * Malformed ECParameters causes infinite loop (CVE-2015-1788) + * Exploitable out-of-bounds read in X509_cmp_time (CVE-2015-1789) + * PKCS7 crash with missing EnvelopedContent (CVE-2015-1790) + * CMS verify infinite loop with unknown hash function (CVE-2015-1792) + * Race condition handling NewSessionTicket (CVE-2015-1791) +- refreshed patches: + * 0001-Axe-builtin-printf-implementation-use-glibc-instead.patch + * 0001-libcrypto-Hide-library-private-symbols.patch + * openssl-1.0.2a-default-paths.patch + * openssl-1.0.2a-fips.patch + * compression_methods_switch.patch + * openssl-1.0.1e-add-test-suse-default-cipher-suite.patch + +------------------------------------------------------------------- Old: ---- openssl-1.0.2a.tar.gz openssl-1.0.2a.tar.gz.asc openssl-fix_invalid_manpage_name.patch New: ---- bsc936563_hack.patch openssl-1.0.2d.tar.gz openssl-1.0.2d.tar.gz.asc ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ openssl.spec ++++++ --- /var/tmp/diff_new_pack.KRnmBc/_old 2015-07-12 22:51:59.000000000 +0200 +++ /var/tmp/diff_new_pack.KRnmBc/_new 2015-07-12 22:51:59.000000000 +0200 @@ -29,7 +29,7 @@ %ifarch ppc64 Obsoletes: openssl-64bit %endif -Version: 1.0.2a +Version: 1.0.2d Release: 0 Summary: Secure Sockets and Transport Layer Security License: OpenSSL @@ -73,7 +73,7 @@ Patch35: openssl-1.0.1e-add-suse-default-cipher.patch Patch37: openssl-1.0.1e-add-test-suse-default-cipher-suite.patch Patch38: openssl-missing_FIPS_ec_group_new_by_curve_name.patch -Patch39: openssl-fix_invalid_manpage_name.patch +Patch40: bsc936563_hack.patch BuildRoot: %{_tmppath}/%{name}-%{version}-build @@ -184,12 +184,15 @@ %patch35 -p1 %patch37 -p1 %patch38 -p1 -%patch39 -p1 %if 0%{?suse_version} >= 1120 %patch3 %endif %patch8 -p1 %patch14 -p1 +#workaround https://gcc.gnu.org/bugzilla/show_bug.cgi?id=66728 +%ifarch ppc64le +%patch40 -p1 +%endif cp -p %{S:10} . cp -p %{S:11} . echo "adding/overwriting some entries in the 'table' hash in Configure" @@ -241,6 +244,7 @@ fips \ %if 0%{suse_version} > 1310 no-ssl2 \ +no-ssl3 \ enable-rfc3779 \ %endif %ifarch x86_64 aarch64 ppc64le ++++++ 0001-Axe-builtin-printf-implementation-use-glibc-instead.patch ++++++ --- /var/tmp/diff_new_pack.KRnmBc/_old 2015-07-12 22:51:59.000000000 +0200 +++ /var/tmp/diff_new_pack.KRnmBc/_new 2015-07-12 22:51:59.000000000 +0200 @@ -4,10 +4,10 @@ Subject: [PATCH] Axe builtin printf implementation, use glibc instead -Index: openssl-1.0.2a/crypto/bio/b_print.c +Index: openssl-1.0.2b/crypto/bio/b_print.c =================================================================== ---- openssl-1.0.2a.orig/crypto/bio/b_print.c 2015-05-24 13:30:38.744606756 +0200 -+++ openssl-1.0.2a/crypto/bio/b_print.c 2015-05-24 13:41:38.708200825 +0200 +--- openssl-1.0.2b.orig/crypto/bio/b_print.c 2015-06-11 15:01:06.000000000 +0200 ++++ openssl-1.0.2b/crypto/bio/b_print.c 2015-06-11 17:50:00.893823977 +0200 @@ -56,17 +56,10 @@ * [including the GNU Public Licence.] */ @@ -28,7 +28,7 @@ #include <stdio.h> #include <string.h> #include <ctype.h> -@@ -79,671 +72,6 @@ +@@ -79,668 +72,6 @@ #include <openssl/bn.h> /* To get BN_LLONG properly defined */ #include <openssl/bio.h> @@ -657,32 +657,29 @@ - /* If we haven't at least one buffer, someone has doe a big booboo */ - assert(*sbuffer != NULL || buffer != NULL); - -- if (buffer) { -- while (*currlen >= *maxlen) { -- if (*buffer == NULL) { -- if (*maxlen == 0) -- *maxlen = 1024; -- *buffer = OPENSSL_malloc(*maxlen); -- if(!*buffer) { -- /* Panic! Can't really do anything sensible. Just return */ -- return; -- } -- if (*currlen > 0) { -- assert(*sbuffer != NULL); -- memcpy(*buffer, *sbuffer, *currlen); -- } -- *sbuffer = NULL; -- } else { -- *maxlen += 1024; -- *buffer = OPENSSL_realloc(*buffer, *maxlen); -- if(!*buffer) { -- /* Panic! Can't really do anything sensible. Just return */ -- return; -- } +- /* |currlen| must always be <= |*maxlen| */ +- assert(*currlen <= *maxlen); +- +- if (buffer && *currlen == *maxlen) { +- *maxlen += 1024; +- if (*buffer == NULL) { +- *buffer = OPENSSL_malloc(*maxlen); +- if (!*buffer) { +- /* Panic! Can't really do anything sensible. Just return */ +- return; +- } +- if (*currlen > 0) { +- assert(*sbuffer != NULL); +- memcpy(*buffer, *sbuffer, *currlen); +- } +- *sbuffer = NULL; +- } else { +- *buffer = OPENSSL_realloc(*buffer, *maxlen); +- if (!*buffer) { +- /* Panic! Can't really do anything sensible. Just return */ +- return; - } - } -- /* What to do if *buffer is NULL? */ -- assert(*sbuffer != NULL || *buffer != NULL); - } - - if (*currlen < *maxlen) { @@ -700,7 +697,7 @@ int BIO_printf(BIO *bio, const char *format, ...) { va_list args; -@@ -757,28 +85,36 @@ int BIO_printf(BIO *bio, const char *for +@@ -754,28 +85,36 @@ int BIO_printf(BIO *bio, const char *for return (ret); } @@ -756,7 +753,7 @@ return (ret); } -@@ -794,28 +130,22 @@ int BIO_snprintf(char *buf, size_t n, co +@@ -791,28 +130,22 @@ int BIO_snprintf(char *buf, size_t n, co int ret; va_start(args, format); ++++++ 0001-libcrypto-Hide-library-private-symbols.patch ++++++ ++++ 751 lines (skipped) ++++ between /work/SRC/openSUSE:Factory/openssl/0001-libcrypto-Hide-library-private-symbols.patch ++++ and /work/SRC/openSUSE:Factory/.openssl.new/0001-libcrypto-Hide-library-private-symbols.patch ++++++ bsc936563_hack.patch ++++++ Index: openssl-1.0.2c/crypto/ec/Makefile =================================================================== --- openssl-1.0.2c.orig/crypto/ec/Makefile +++ openssl-1.0.2c/crypto/ec/Makefile @@ -10,7 +10,7 @@ CFLAG=-g MAKEFILE= Makefile AR= ar r -CFLAGS= $(INCLUDES) $(CFLAG) +CFLAGS= $(INCLUDES) $(CFLAG) -O0 ASFLAGS= $(INCLUDES) $(ASFLAG) AFLAGS= $(ASFLAGS) ++++++ compression_methods_switch.patch ++++++ --- /var/tmp/diff_new_pack.KRnmBc/_old 2015-07-12 22:51:59.000000000 +0200 +++ /var/tmp/diff_new_pack.KRnmBc/_new 2015-07-12 22:51:59.000000000 +0200 @@ -1,10 +1,10 @@ -Index: openssl-1.0.2a/doc/ssl/SSL_COMP_add_compression_method.pod +Index: openssl-1.0.2b/doc/ssl/SSL_COMP_add_compression_method.pod =================================================================== ---- openssl-1.0.2a.orig/doc/ssl/SSL_COMP_add_compression_method.pod 2015-04-03 22:10:19.262805732 +0200 -+++ openssl-1.0.2a/doc/ssl/SSL_COMP_add_compression_method.pod 2015-04-03 22:10:28.958939879 +0200 -@@ -41,6 +41,24 @@ of compression methods supported on a pe - The OpenSSL library has the compression methods B<COMP_rle()> and (when - especially enabled during compilation) B<COMP_zlib()> available. +--- openssl-1.0.2b.orig/doc/ssl/SSL_COMP_add_compression_method.pod 2015-06-11 20:11:49.353667505 +0200 ++++ openssl-1.0.2b/doc/ssl/SSL_COMP_add_compression_method.pod 2015-06-11 20:11:51.183689314 +0200 +@@ -47,6 +47,24 @@ of compression methods supported on a pe + If enabled during compilation, the OpenSSL library will have the + COMP_zlib() compression method available. +And, there is an environment variable to switch the compression +methods off and on. In default the compression is off to mitigate @@ -27,10 +27,10 @@ =head1 WARNINGS Once the identities of the compression methods for the TLS protocol have -Index: openssl-1.0.2a/ssl/ssl_ciph.c +Index: openssl-1.0.2b/ssl/ssl_ciph.c =================================================================== ---- openssl-1.0.2a.orig/ssl/ssl_ciph.c 2015-04-03 22:10:28.959939893 +0200 -+++ openssl-1.0.2a/ssl/ssl_ciph.c 2015-04-03 22:12:33.425662139 +0200 +--- openssl-1.0.2b.orig/ssl/ssl_ciph.c 2015-06-11 20:11:49.353667505 +0200 ++++ openssl-1.0.2b/ssl/ssl_ciph.c 2015-06-11 20:11:51.183689314 +0200 @@ -478,10 +478,16 @@ static void load_builtin_compressions(vo if (ssl_comp_methods == NULL) { ++++++ merge_from_0.9.8k.patch ++++++ --- /var/tmp/diff_new_pack.KRnmBc/_old 2015-07-12 22:51:59.000000000 +0200 +++ /var/tmp/diff_new_pack.KRnmBc/_new 2015-07-12 22:51:59.000000000 +0200 @@ -1,8 +1,13 @@ +--- + Configure | 4 ++-- + config | 23 +++++++++++++++-------- + 2 files changed, 17 insertions(+), 10 deletions(-) + Index: openssl-1.0.2a/Configure =================================================================== ---- openssl-1.0.2a.orig/Configure 2015-05-30 21:58:49.358278076 +0200 -+++ openssl-1.0.2a/Configure 2015-05-30 21:58:52.830317683 +0200 -@@ -996,7 +996,7 @@ PROCESS_ARGS: +--- openssl-1.0.2a.orig/Configure ++++ openssl-1.0.2a/Configure +@@ -978,7 +978,7 @@ PROCESS_ARGS: } else { @@ -11,7 +16,7 @@ $target=$_; } -@@ -1276,7 +1276,7 @@ if ($target =~ /linux.*\-mips/ && !$no_a +@@ -1258,7 +1258,7 @@ if ($target =~ /linux.*\-mips/ && !$no_a my $no_shared_warn=0; my $no_user_cflags=0; @@ -22,8 +27,8 @@ # Kerberos settings. The flavor must be provided from outside, either through Index: openssl-1.0.2a/config =================================================================== ---- openssl-1.0.2a.orig/config 2015-05-30 21:58:49.358278076 +0200 -+++ openssl-1.0.2a/config 2015-05-30 21:58:52.830317683 +0200 +--- openssl-1.0.2a.orig/config ++++ openssl-1.0.2a/config @@ -573,7 +573,8 @@ case "$GUESSOS" in options="$options -arch%20${MACHINE}" OUT="iphoneos-cross" ;; @@ -34,17 +39,19 @@ case ${ISA:-generic} in *[678]) OUT="linux-alpha+bwx-$CC" ;; *) OUT="linux-alpha-$CC" ;; -@@ -598,7 +599,9 @@ case "$GUESSOS" in +@@ -598,8 +599,10 @@ case "$GUESSOS" in if [ "$KERNEL_BITS" = "64" ]; then OUT="linux-ppc64" else - OUT="linux-ppc" +- (echo "__LP64__" | gcc -E -x c - 2>/dev/null | grep "^__LP64__" 2>&1 > /dev/null) || options="$options -m32" +# OUT="linux-ppc" + # we have the target and force it here + OUT="linux-ppc64" - (echo "__LP64__" | gcc -E -x c - 2>/dev/null | grep "^__LP64__" 2>&1 > /dev/null) || options="$options -m32" ++ (echo "__LP64" | gcc -E -x c - 2>/dev/null | grep "^__LP64" 2>&1 > /dev/null) || options="$options -m32" fi ;; + ppc64le-*-linux2) OUT="linux-ppc64le" ;; @@ -632,10 +635,10 @@ case "$GUESSOS" in sparc-*-linux2) KARCH=`awk '/^type/{print$3;exit(0);}' /proc/cpuinfo` ++++++ openssl-1.0.1e-add-test-suse-default-cipher-suite.patch ++++++ --- /var/tmp/diff_new_pack.KRnmBc/_old 2015-07-12 22:51:59.000000000 +0200 +++ /var/tmp/diff_new_pack.KRnmBc/_new 2015-07-12 22:51:59.000000000 +0200 @@ -1,9 +1,9 @@ -Index: openssl-1.0.2a/test/testssl +Index: openssl-1.0.2b/test/testssl =================================================================== ---- openssl-1.0.2a.orig/test/testssl 2015-03-19 14:30:36.000000000 +0100 -+++ openssl-1.0.2a/test/testssl 2015-05-24 14:06:02.038506053 +0200 -@@ -138,6 +138,25 @@ for protocol in TLSv1.2 SSLv3; do - done +--- openssl-1.0.2b.orig/test/testssl 2015-06-11 20:11:36.398513121 +0200 ++++ openssl-1.0.2b/test/testssl 2015-06-11 20:15:40.833426946 +0200 +@@ -192,6 +192,25 @@ for protocol in TLSv1.2 SSLv3; do + fi done +echo "Testing default ciphersuites" ++++++ openssl-1.0.2a-default-paths.patch ++++++ --- /var/tmp/diff_new_pack.KRnmBc/_old 2015-07-12 22:51:59.000000000 +0200 +++ /var/tmp/diff_new_pack.KRnmBc/_new 2015-07-12 22:51:59.000000000 +0200 @@ -1,25 +1,9 @@ -diff -up openssl-1.0.2a/apps/s_client.c.default-paths openssl-1.0.2a/apps/s_client.c ---- openssl-1.0.2a/apps/s_client.c.default-paths 2015-04-20 14:48:31.462166971 +0200 -+++ openssl-1.0.2a/apps/s_client.c 2015-04-20 14:52:55.125316170 +0200 -@@ -1336,19 +1336,16 @@ int MAIN(int argc, char **argv) - - SSL_CTX_set_verify(ctx, verify, verify_callback); - -- if ((!SSL_CTX_load_verify_locations(ctx, CAfile, CApath)) || -- (!SSL_CTX_set_default_verify_paths(ctx))) { -- /* -- * BIO_printf(bio_err,"error setting default verify locations\n"); -- */ -- ERR_print_errors(bio_err); -- /* goto end; */ -+ if (CAfile == NULL && CApath == NULL) { -+ if (!SSL_CTX_set_default_verify_paths(ctx)) { -+ ERR_print_errors(bio_err); -+ } -+ } else { -+ if (!SSL_CTX_load_verify_locations(ctx, CAfile, CApath)) { -+ ERR_print_errors(bio_err); -+ } +Index: openssl-1.0.2b/apps/s_client.c +=================================================================== +--- openssl-1.0.2b.orig/apps/s_client.c 2015-06-11 17:28:32.039203737 +0200 ++++ openssl-1.0.2b/apps/s_client.c 2015-06-11 17:39:40.138741521 +0200 +@@ -1346,10 +1346,6 @@ int MAIN(int argc, char **argv) + ERR_print_errors(bio_err); } - ssl_ctx_add_crls(ctx, crls, crl_download); @@ -29,10 +13,11 @@ #ifndef OPENSSL_NO_TLSEXT if (servername != NULL) { tlsextcbp.biodebug = bio_err; -diff -up openssl-1.0.2a/apps/s_server.c.default-paths openssl-1.0.2a/apps/s_server.c ---- openssl-1.0.2a/apps/s_server.c.default-paths 2015-03-19 14:30:36.000000000 +0100 -+++ openssl-1.0.2a/apps/s_server.c 2015-04-20 14:48:31.462166971 +0200 -@@ -1768,12 +1768,16 @@ int MAIN(int argc, char *argv[]) +Index: openssl-1.0.2b/apps/s_server.c +=================================================================== +--- openssl-1.0.2b.orig/apps/s_server.c 2015-06-11 17:28:04.879854931 +0200 ++++ openssl-1.0.2b/apps/s_server.c 2015-06-11 17:28:32.040203749 +0200 +@@ -1788,12 +1788,16 @@ int MAIN(int argc, char *argv[]) } #endif @@ -54,7 +39,7 @@ if (vpm) SSL_CTX_set1_param(ctx, vpm); -@@ -1830,8 +1834,10 @@ int MAIN(int argc, char *argv[]) +@@ -1850,8 +1854,10 @@ int MAIN(int argc, char *argv[]) else SSL_CTX_sess_set_cache_size(ctx2, 128); @@ -67,9 +52,10 @@ ERR_print_errors(bio_err); } if (vpm) -diff -up openssl-1.0.2a/apps/s_time.c.default-paths openssl-1.0.2a/apps/s_time.c ---- openssl-1.0.2a/apps/s_time.c.default-paths 2015-04-20 14:48:31.462166971 +0200 -+++ openssl-1.0.2a/apps/s_time.c 2015-04-20 14:55:14.232542738 +0200 +Index: openssl-1.0.2b/apps/s_time.c +=================================================================== +--- openssl-1.0.2b.orig/apps/s_time.c 2015-06-11 17:28:04.879854931 +0200 ++++ openssl-1.0.2b/apps/s_time.c 2015-06-11 17:28:32.040203749 +0200 @@ -381,13 +381,14 @@ int MAIN(int argc, char **argv) SSL_load_error_strings(); ++++++ openssl-1.0.2a-fips.patch ++++++ ++++ 1496 lines (skipped) ++++ between /work/SRC/openSUSE:Factory/openssl/openssl-1.0.2a-fips.patch ++++ and /work/SRC/openSUSE:Factory/.openssl.new/openssl-1.0.2a-fips.patch ++++++ openssl-1.0.2a.tar.gz -> openssl-1.0.2d.tar.gz ++++++ ++++ 15450 lines of diff (skipped)
