* OpenSSL security updates
@ 2016-09-26 17:01 Leo Famulari
2016-09-26 18:31 ` Efraim Flashner
2016-10-05 23:46 ` Leo Famulari
0 siblings, 2 replies; 6+ messages in thread
From: Leo Famulari @ 2016-09-26 17:01 UTC (permalink / raw)
To: guix-devel
[-- Attachment #1.1: Type: text/plain, Size: 2175 bytes --]
There is a new round of OpenSSL security updates [0]. Patches are
attached to this message.
[0]
https://www.openssl.org/news/secadv/20160926.txt
Quoted from the link above:
OpenSSL Security Advisory [26 Sep 2016]
========================================
This security update addresses issues that were caused by patches
included in our previous security update, released on 22nd September
2016. Given the Critical severity of one of these flaws we have
chosen to release this advisory immediately to prevent upgrades to the
affected version, rather than delaying in order to provide our usual
public pre-notification.
Fix Use After Free for large message sizes (CVE-2016-6309)
==========================================================
Severity: Critical
This issue only affects OpenSSL 1.1.0a, released on 22nd September 2016.
The patch applied to address CVE-2016-6307 resulted in an issue where if a
message larger than approx 16k is received then the underlying buffer to store
the incoming message is reallocated and moved. Unfortunately a dangling pointer
to the old location is left which results in an attempt to write to the
previously freed location. This is likely to result in a crash, however it
could potentially lead to execution of arbitrary code.
OpenSSL 1.1.0 users should upgrade to 1.1.0b
This issue was reported to OpenSSL on 23rd September 2016 by Robert
Święcki (Google Security Team), and was found using honggfuzz. The fix
was developed by Matt Caswell of the OpenSSL development team.
Missing CRL sanity check (CVE-2016-7052)
========================================
Severity: Moderate
This issue only affects OpenSSL 1.0.2i, released on 22nd September 2016.
A bug fix which included a CRL sanity check was added to OpenSSL 1.1.0
but was omitted from OpenSSL 1.0.2i. As a result any attempt to use
CRLs in OpenSSL 1.0.2i will crash with a null pointer exception.
OpenSSL 1.0.2i users should upgrade to 1.0.2j
The issue was reported to OpenSSL on 22nd September 2016 by Bruce Stephens and
Thomas Jakobi. The fix was developed by Matt Caswell of the OpenSSL development
team.
[-- Attachment #1.2: 0001-gnu-openssl-next-Update-to-1.1.0b-fixes-CVE-2016-630.patch --]
[-- Type: text/plain, Size: 1280 bytes --]
From 0f38dcc4f37853c831d11c5291b1c099ba36ea99 Mon Sep 17 00:00:00 2001
From: Leo Famulari <leo@famulari.name>
Date: Mon, 26 Sep 2016 12:53:00 -0400
Subject: [PATCH] gnu: openssl-next: Update to 1.1.0b [fixes CVE-2016-6309].
* gnu/packages/tls.scm (openssl-next): Update to 1.1.0b.
---
gnu/packages/tls.scm | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/gnu/packages/tls.scm b/gnu/packages/tls.scm
index 93c78ae..9d91f15 100644
--- a/gnu/packages/tls.scm
+++ b/gnu/packages/tls.scm
@@ -391,7 +391,7 @@ required structures.")
(inherit openssl)
(name "openssl")
(replacement #f)
- (version "1.1.0a")
+ (version "1.1.0b")
(source (origin
(method url-fetch)
(uri (list (string-append "ftp://ftp.openssl.org/source/"
@@ -402,7 +402,7 @@ required structures.")
(patches (search-patches "openssl-1.1.0-c-rehash-in.patch"))
(sha256
(base32
- "0as40a1lipl9qfax7495jc1xfb049ygavkaxxk4y5kcn8birdrn2"))))
+ "1xznrqvb1dbngv2k2nb6da6fdw00c01sy2i36yjdxr4vpxrf0pd4"))))
(outputs '("out"
"doc" ;1.3MiB of man3 pages
"static")) ; 5.5MiB of .a files
--
2.10.0
[-- Attachment #1.3: 0001-gnu-openssl-Update-replacement-to-1.0.2j-fixes-CVE-2.patch --]
[-- Type: text/plain, Size: 1753 bytes --]
From 0006affb67ef6513e8b8923824ca0cee37ea839b Mon Sep 17 00:00:00 2001
From: Leo Famulari <leo@famulari.name>
Date: Mon, 26 Sep 2016 12:51:39 -0400
Subject: [PATCH] gnu: openssl: Update replacement to 1.0.2j [fixes
CVE-2016-7052].
* gnu/packages/tls.scm (openssl): Update replacement to 1.0.2j.
(openssl-1.0.2i): Replace with...
(openssl-1.0.2j): ... new variable.
---
gnu/packages/tls.scm | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/gnu/packages/tls.scm b/gnu/packages/tls.scm
index 15e3e43..93c78ae 100644
--- a/gnu/packages/tls.scm
+++ b/gnu/packages/tls.scm
@@ -229,7 +229,7 @@ required structures.")
(define-public openssl
(package
(name "openssl")
- (replacement openssl-1.0.2i)
+ (replacement openssl-1.0.2j)
(version "1.0.2h")
(source (origin
(method url-fetch)
@@ -368,11 +368,11 @@ required structures.")
(license license:openssl)
(home-page "http://www.openssl.org/")))
-(define openssl-1.0.2i
+(define openssl-1.0.2j
(package (inherit openssl)
(source
(let ((name "openssl")
- (version "1.0.2i"))
+ (version "1.0.2j"))
(origin
(method url-fetch)
(uri (list (string-append "ftp://ftp.openssl.org/source/"
@@ -382,7 +382,7 @@ required structures.")
"/" name "-" version ".tar.gz")))
(sha256
(base32
- "0vyy038676cv3m2523fi9ll9nkjxadqdnz18zdp5nm6925yli1wj"))
+ "0cf4ar97ijfc7mg35zdgpad6x8ivkdx9qii6mz35khi1ps9g5bz7"))
(patches (search-patches "openssl-runpath.patch"
"openssl-c-rehash-in.patch")))))))
--
2.10.0
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 819 bytes --]
^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: OpenSSL security updates
2016-09-26 17:01 OpenSSL security updates Leo Famulari
@ 2016-09-26 18:31 ` Efraim Flashner
2016-09-26 21:10 ` Leo Famulari
2016-10-05 23:46 ` Leo Famulari
1 sibling, 1 reply; 6+ messages in thread
From: Efraim Flashner @ 2016-09-26 18:31 UTC (permalink / raw)
To: Leo Famulari; +Cc: guix-devel
[-- Attachment #1: Type: text/plain, Size: 5813 bytes --]
On Mon, Sep 26, 2016 at 01:01:38PM -0400, Leo Famulari wrote:
> There is a new round of OpenSSL security updates [0]. Patches are
> attached to this message.
>
> [0]
> https://www.openssl.org/news/secadv/20160926.txt
>
> Quoted from the link above:
>
> OpenSSL Security Advisory [26 Sep 2016]
> ========================================
>
> This security update addresses issues that were caused by patches
> included in our previous security update, released on 22nd September
> 2016. Given the Critical severity of one of these flaws we have
> chosen to release this advisory immediately to prevent upgrades to the
> affected version, rather than delaying in order to provide our usual
> public pre-notification.
>
>
> Fix Use After Free for large message sizes (CVE-2016-6309)
> ==========================================================
>
> Severity: Critical
>
> This issue only affects OpenSSL 1.1.0a, released on 22nd September 2016.
>
> The patch applied to address CVE-2016-6307 resulted in an issue where if a
> message larger than approx 16k is received then the underlying buffer to store
> the incoming message is reallocated and moved. Unfortunately a dangling pointer
> to the old location is left which results in an attempt to write to the
> previously freed location. This is likely to result in a crash, however it
> could potentially lead to execution of arbitrary code.
>
> OpenSSL 1.1.0 users should upgrade to 1.1.0b
>
> This issue was reported to OpenSSL on 23rd September 2016 by Robert
> Święcki (Google Security Team), and was found using honggfuzz. The fix
> was developed by Matt Caswell of the OpenSSL development team.
>
> Missing CRL sanity check (CVE-2016-7052)
> ========================================
>
> Severity: Moderate
>
> This issue only affects OpenSSL 1.0.2i, released on 22nd September 2016.
>
> A bug fix which included a CRL sanity check was added to OpenSSL 1.1.0
> but was omitted from OpenSSL 1.0.2i. As a result any attempt to use
> CRLs in OpenSSL 1.0.2i will crash with a null pointer exception.
>
> OpenSSL 1.0.2i users should upgrade to 1.0.2j
>
> The issue was reported to OpenSSL on 22nd September 2016 by Bruce Stephens and
> Thomas Jakobi. The fix was developed by Matt Caswell of the OpenSSL development
> team.
> From 0f38dcc4f37853c831d11c5291b1c099ba36ea99 Mon Sep 17 00:00:00 2001
> From: Leo Famulari <leo@famulari.name>
> Date: Mon, 26 Sep 2016 12:53:00 -0400
> Subject: [PATCH] gnu: openssl-next: Update to 1.1.0b [fixes CVE-2016-6309].
>
> * gnu/packages/tls.scm (openssl-next): Update to 1.1.0b.
> ---
> gnu/packages/tls.scm | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/gnu/packages/tls.scm b/gnu/packages/tls.scm
> index 93c78ae..9d91f15 100644
> --- a/gnu/packages/tls.scm
> +++ b/gnu/packages/tls.scm
> @@ -391,7 +391,7 @@ required structures.")
> (inherit openssl)
> (name "openssl")
> (replacement #f)
> - (version "1.1.0a")
> + (version "1.1.0b")
> (source (origin
> (method url-fetch)
> (uri (list (string-append "ftp://ftp.openssl.org/source/"
> @@ -402,7 +402,7 @@ required structures.")
> (patches (search-patches "openssl-1.1.0-c-rehash-in.patch"))
> (sha256
> (base32
> - "0as40a1lipl9qfax7495jc1xfb049ygavkaxxk4y5kcn8birdrn2"))))
> + "1xznrqvb1dbngv2k2nb6da6fdw00c01sy2i36yjdxr4vpxrf0pd4"))))
> (outputs '("out"
> "doc" ;1.3MiB of man3 pages
> "static")) ; 5.5MiB of .a files
> --
> 2.10.0
>
> From 0006affb67ef6513e8b8923824ca0cee37ea839b Mon Sep 17 00:00:00 2001
> From: Leo Famulari <leo@famulari.name>
> Date: Mon, 26 Sep 2016 12:51:39 -0400
> Subject: [PATCH] gnu: openssl: Update replacement to 1.0.2j [fixes
> CVE-2016-7052].
>
> * gnu/packages/tls.scm (openssl): Update replacement to 1.0.2j.
> (openssl-1.0.2i): Replace with...
> (openssl-1.0.2j): ... new variable.
> ---
> gnu/packages/tls.scm | 8 ++++----
> 1 file changed, 4 insertions(+), 4 deletions(-)
>
> diff --git a/gnu/packages/tls.scm b/gnu/packages/tls.scm
> index 15e3e43..93c78ae 100644
> --- a/gnu/packages/tls.scm
> +++ b/gnu/packages/tls.scm
> @@ -229,7 +229,7 @@ required structures.")
> (define-public openssl
> (package
> (name "openssl")
> - (replacement openssl-1.0.2i)
> + (replacement openssl-1.0.2j)
> (version "1.0.2h")
> (source (origin
> (method url-fetch)
> @@ -368,11 +368,11 @@ required structures.")
> (license license:openssl)
> (home-page "http://www.openssl.org/")))
>
> -(define openssl-1.0.2i
> +(define openssl-1.0.2j
> (package (inherit openssl)
> (source
> (let ((name "openssl")
> - (version "1.0.2i"))
> + (version "1.0.2j"))
> (origin
> (method url-fetch)
> (uri (list (string-append "ftp://ftp.openssl.org/source/"
> @@ -382,7 +382,7 @@ required structures.")
> "/" name "-" version ".tar.gz")))
> (sha256
> (base32
> - "0vyy038676cv3m2523fi9ll9nkjxadqdnz18zdp5nm6925yli1wj"))
> + "0cf4ar97ijfc7mg35zdgpad6x8ivkdx9qii6mz35khi1ps9g5bz7"))
> (patches (search-patches "openssl-runpath.patch"
> "openssl-c-rehash-in.patch")))))))
>
> --
> 2.10.0
>
This looks pretty straight-forward.
--
Efraim Flashner <efraim@flashner.co.il> אפרים פלשנר
GPG key = A28B F40C 3E55 1372 662D 14F7 41AA E7DC CA3D 8351
Confidentiality cannot be guaranteed on emails sent or received unencrypted
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 819 bytes --]
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: OpenSSL security updates
2016-09-26 18:31 ` Efraim Flashner
@ 2016-09-26 21:10 ` Leo Famulari
0 siblings, 0 replies; 6+ messages in thread
From: Leo Famulari @ 2016-09-26 21:10 UTC (permalink / raw)
To: Efraim Flashner; +Cc: guix-devel
[-- Attachment #1: Type: text/plain, Size: 917 bytes --]
On Mon, Sep 26, 2016 at 09:31:51PM +0300, Efraim Flashner wrote:
> On Mon, Sep 26, 2016 at 01:01:38PM -0400, Leo Famulari wrote:
> > From 0f38dcc4f37853c831d11c5291b1c099ba36ea99 Mon Sep 17 00:00:00 2001
> > From: Leo Famulari <leo@famulari.name>
> > Date: Mon, 26 Sep 2016 12:53:00 -0400
> > Subject: [PATCH] gnu: openssl-next: Update to 1.1.0b [fixes CVE-2016-6309].
> >
> > * gnu/packages/tls.scm (openssl-next): Update to 1.1.0b.
> > From 0006affb67ef6513e8b8923824ca0cee37ea839b Mon Sep 17 00:00:00 2001
> > From: Leo Famulari <leo@famulari.name>
> > Date: Mon, 26 Sep 2016 12:51:39 -0400
> > Subject: [PATCH] gnu: openssl: Update replacement to 1.0.2j [fixes
> > CVE-2016-7052].
> >
> > * gnu/packages/tls.scm (openssl): Update replacement to 1.0.2j.
> > (openssl-1.0.2i): Replace with...
> > (openssl-1.0.2j): ... new variable.
>
> This looks pretty straight-forward.
Okay, pushed!
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 819 bytes --]
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: OpenSSL security updates
2016-09-26 17:01 OpenSSL security updates Leo Famulari
2016-09-26 18:31 ` Efraim Flashner
@ 2016-10-05 23:46 ` Leo Famulari
2016-10-06 19:53 ` Ludovic Courtès
1 sibling, 1 reply; 6+ messages in thread
From: Leo Famulari @ 2016-10-05 23:46 UTC (permalink / raw)
To: guix-devel
On Mon, Sep 26, 2016 at 01:01:38PM -0400, Leo Famulari wrote:
> Subject: [PATCH] gnu: openssl: Update replacement to 1.0.2j [fixes
> CVE-2016-7052].
>
> * gnu/packages/tls.scm (openssl): Update replacement to 1.0.2j.
> (openssl-1.0.2i): Replace with...
> (openssl-1.0.2j): ... new variable.
Ludo, you mentioned you were using this graft as a test case for
improvements to `guix lint`. Let us know if you are done with it so it
can be ungrafted on the core-updates branch.
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: OpenSSL security updates
2016-10-05 23:46 ` Leo Famulari
@ 2016-10-06 19:53 ` Ludovic Courtès
2016-10-06 21:51 ` Leo Famulari
0 siblings, 1 reply; 6+ messages in thread
From: Ludovic Courtès @ 2016-10-06 19:53 UTC (permalink / raw)
To: Leo Famulari; +Cc: guix-devel
Leo Famulari <leo@famulari.name> skribis:
> On Mon, Sep 26, 2016 at 01:01:38PM -0400, Leo Famulari wrote:
>> Subject: [PATCH] gnu: openssl: Update replacement to 1.0.2j [fixes
>> CVE-2016-7052].
>>
>> * gnu/packages/tls.scm (openssl): Update replacement to 1.0.2j.
>> (openssl-1.0.2i): Replace with...
>> (openssl-1.0.2j): ... new variable.
>
> Ludo, you mentioned you were using this graft as a test case for
> improvements to `guix lint`. Let us know if you are done with it so it
> can be ungrafted on the core-updates branch.
Go ahead, I’m done!
What I meant by “test case” is just commit
8389e6f06efde73ebb849a82e0967eb6afec8c39: now the replacement is called
“1.0.2j”, not “1.0.2h”.
Ludo’.
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: OpenSSL security updates
2016-10-06 19:53 ` Ludovic Courtès
@ 2016-10-06 21:51 ` Leo Famulari
0 siblings, 0 replies; 6+ messages in thread
From: Leo Famulari @ 2016-10-06 21:51 UTC (permalink / raw)
To: Ludovic Courtès; +Cc: guix-devel
On Thu, Oct 06, 2016 at 09:53:47PM +0200, Ludovic Courtès wrote:
> Leo Famulari <leo@famulari.name> skribis:
>
> > On Mon, Sep 26, 2016 at 01:01:38PM -0400, Leo Famulari wrote:
> >> Subject: [PATCH] gnu: openssl: Update replacement to 1.0.2j [fixes
> >> CVE-2016-7052].
> >>
> >> * gnu/packages/tls.scm (openssl): Update replacement to 1.0.2j.
> >> (openssl-1.0.2i): Replace with...
> >> (openssl-1.0.2j): ... new variable.
> >
> > Ludo, you mentioned you were using this graft as a test case for
> > improvements to `guix lint`. Let us know if you are done with it so it
> > can be ungrafted on the core-updates branch.
>
> Go ahead, I’m done!
>
> What I meant by “test case” is just commit
> 8389e6f06efde73ebb849a82e0967eb6afec8c39: now the replacement is called
> “1.0.2j”, not “1.0.2h”.
Ungrafted with 1d8de185b80958cbb0c10621e1dd790aa327064b !
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2016-10-06 21:51 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2016-09-26 17:01 OpenSSL security updates Leo Famulari
2016-09-26 18:31 ` Efraim Flashner
2016-09-26 21:10 ` Leo Famulari
2016-10-05 23:46 ` Leo Famulari
2016-10-06 19:53 ` Ludovic Courtès
2016-10-06 21:51 ` Leo Famulari
Code repositories for project(s) associated with this public inbox
https://git.savannah.gnu.org/cgit/guix.git
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).