Thanks, applied as a650ae7f2756701a6df837b2a8f57de57a30f871. Michael
[sent from post-receive hook] On Fri, 09 Feb 2024 17:11:26 +0100, Christian Melki <[email protected]> wrote: > Minor release, security bugfixes. All low severity. > https://www.openssl.org/news/cl32.txt > > Plugs CVEs: > CVE-2024-0727: Fixed PKCS12 Decoding crashes > CVE-2023-6237: Fixed excessive time spent checking invalid RSA public keys > CVE-2023-6129: Fixed POLY1305 MAC implementation corrupting vector registers > on PowerPC CPUs which support PowerISA 2.07. > > * Remove one patch. Code was added to the release. > > Signed-off-by: Christian Melki <[email protected]> > Message-Id: <[email protected]> > Signed-off-by: Michael Olbrich <[email protected]> > > diff --git > a/patches/openssl-3.2.0/0100-Don-t-apply-max_frag_len-checking-if-no-Max-Fragment.patch > > b/patches/openssl-3.2.0/0100-Don-t-apply-max_frag_len-checking-if-no-Max-Fragment.patch > deleted file mode 100644 > index 814bd07bec63..000000000000 > --- > a/patches/openssl-3.2.0/0100-Don-t-apply-max_frag_len-checking-if-no-Max-Fragment.patch > +++ /dev/null > @@ -1,41 +0,0 @@ > -From: Matt Caswell <[email protected]> > -Date: Tue, 2 Jan 2024 16:48:43 +0000 > -Subject: [PATCH] Don't apply max_frag_len checking if no Max Fragment Length > - extension > - > -Don't check the Max Fragment Length if the it hasn't been negotiated. We > -were checking it anyway, and using the default value > -(SSL3_RT_MAX_PLAIN_LENGTH). This works in most cases but KTLS can cause the > -record length to actually exceed this in some cases. > - > -Fixes #23169 > ---- > - ssl/record/methods/tls_common.c | 14 ++++++++++---- > - 1 file changed, 10 insertions(+), 4 deletions(-) > - > -diff --git a/ssl/record/methods/tls_common.c > b/ssl/record/methods/tls_common.c > -index 423777c18dd4..1a9320ae74de 100644 > ---- a/ssl/record/methods/tls_common.c > -+++ b/ssl/record/methods/tls_common.c > -@@ -910,11 +910,17 @@ int tls_get_more_records(OSSL_RECORD_LAYER *rl) > - } > - > - /* > -- * Check if the received packet overflows the current > -- * Max Fragment Length setting. > -- * Note: rl->max_frag_len > 0 and KTLS are mutually exclusive. > -+ * Record overflow checking (e.g. checking if > -+ * thisrr->length > SSL3_RT_MAX_PLAIN_LENGTH) is the responsibility > of > -+ * the post_process_record() function above. However we check here > if > -+ * the received packet overflows the current Max Fragment Length > setting > -+ * if there is one. > -+ * Note: rl->max_frag_len != SSL3_RT_MAX_PLAIN_LENGTH and KTLS are > -+ * mutually exclusive. Also note that with KTLS thisrr->length can > -+ * be > SSL3_RT_MAX_PLAIN_LENGTH (and rl->max_frag_len must be > ignored) > - */ > -- if (thisrr->length > rl->max_frag_len) { > -+ if (rl->max_frag_len != SSL3_RT_MAX_PLAIN_LENGTH > -+ && thisrr->length > rl->max_frag_len) { > - RLAYERfatal(rl, SSL_AD_RECORD_OVERFLOW, > SSL_R_DATA_LENGTH_TOO_LONG); > - goto end; > - } > diff --git a/patches/openssl-3.2.0/0001-debian-targets.patch > b/patches/openssl-3.2.1/0001-debian-targets.patch > similarity index 100% > rename from patches/openssl-3.2.0/0001-debian-targets.patch > rename to patches/openssl-3.2.1/0001-debian-targets.patch > diff --git a/patches/openssl-3.2.0/0002-pic.patch > b/patches/openssl-3.2.1/0002-pic.patch > similarity index 100% > rename from patches/openssl-3.2.0/0002-pic.patch > rename to patches/openssl-3.2.1/0002-pic.patch > diff --git > a/patches/openssl-3.2.0/0003-Configure-allow-to-enable-ktls-if-target-does-not-st.patch > > b/patches/openssl-3.2.1/0003-Configure-allow-to-enable-ktls-if-target-does-not-st.patch > similarity index 96% > rename from > patches/openssl-3.2.0/0003-Configure-allow-to-enable-ktls-if-target-does-not-st.patch > rename to > patches/openssl-3.2.1/0003-Configure-allow-to-enable-ktls-if-target-does-not-st.patch > index 6275de7089d7..6b518ef22d49 100644 > --- > a/patches/openssl-3.2.0/0003-Configure-allow-to-enable-ktls-if-target-does-not-st.patch > +++ > b/patches/openssl-3.2.1/0003-Configure-allow-to-enable-ktls-if-target-does-not-st.patch > @@ -28,7 +28,7 @@ Signed-off-by: Michael Olbrich <[email protected]> > 2 files changed, 2 insertions(+), 2 deletions(-) > > diff --git a/Configurations/10-main.conf b/Configurations/10-main.conf > -index d1a15a115274..d15d28499a21 100644 > +index 2a047caa7d4a..aa2685be93b9 100644 > --- a/Configurations/10-main.conf > +++ b/Configurations/10-main.conf > @@ -693,7 +693,7 @@ my %targets = ( > @@ -41,7 +41,7 @@ index d1a15a115274..d15d28499a21 100644 > "linux-latomic" => { > inherit_from => [ "linux-generic32" ], > diff --git a/Configure b/Configure > -index cbba1749b5a3..a69068121949 100755 > +index cca1ac8d162e..c9bbcbbed3e6 100755 > --- a/Configure > +++ b/Configure > @@ -1765,7 +1765,7 @@ unless ($disabled{devcryptoeng}) { > diff --git > a/patches/openssl-3.2.0/0004-conf-Serialize-allocation-free-of-ssl_names.patch > > b/patches/openssl-3.2.1/0004-conf-Serialize-allocation-free-of-ssl_names.patch > similarity index 100% > rename from > patches/openssl-3.2.0/0004-conf-Serialize-allocation-free-of-ssl_names.patch > rename to > patches/openssl-3.2.1/0004-conf-Serialize-allocation-free-of-ssl_names.patch > diff --git > a/patches/openssl-3.2.0/0005-Configure-drop-fzero-call-used-regs-used-gpr-from-De.patch > > b/patches/openssl-3.2.1/0005-Configure-drop-fzero-call-used-regs-used-gpr-from-De.patch > similarity index 100% > rename from > patches/openssl-3.2.0/0005-Configure-drop-fzero-call-used-regs-used-gpr-from-De.patch > rename to > patches/openssl-3.2.1/0005-Configure-drop-fzero-call-used-regs-used-gpr-from-De.patch > diff --git a/patches/openssl-3.2.0/series b/patches/openssl-3.2.1/series > similarity index 73% > rename from patches/openssl-3.2.0/series > rename to patches/openssl-3.2.1/series > index 309ec1465b5e..cd66cc21a112 100644 > --- a/patches/openssl-3.2.0/series > +++ b/patches/openssl-3.2.1/series > @@ -7,5 +7,4 @@ > 0004-conf-Serialize-allocation-free-of-ssl_names.patch > 0005-Configure-drop-fzero-call-used-regs-used-gpr-from-De.patch > #tag:upstream --start-number 100 > -0100-Don-t-apply-max_frag_len-checking-if-no-Max-Fragment.patch > -# d6f307e5d2ef578b08c895257daa6fbc - git-ptx-patches magic > +# ab24a399a1a602376760e385c08ab320 - git-ptx-patches magic > diff --git a/rules/openssl.make b/rules/openssl.make > index bc1322725260..7080bd50ba55 100644 > --- a/rules/openssl.make > +++ b/rules/openssl.make > @@ -16,8 +16,8 @@ PACKAGES-$(PTXCONF_OPENSSL) += openssl > # > # Paths and names > # > -OPENSSL_VERSION := 3.2.0 > -OPENSSL_MD5 := 7903549a14abebc5c323ce4e85f2cbb2 > +OPENSSL_VERSION := 3.2.1 > +OPENSSL_MD5 := c239213887804ba00654884918b37441 > OPENSSL := openssl-$(OPENSSL_VERSION) > OPENSSL_SUFFIX := tar.gz > OPENSSL_URL := \
