[bug#56403] OpenSSL security updates

[bug#56403] OpenSSL security updates

[Leo Famulari]

[-- Attachment #1: Type: text/plain, Size: 102 bytes --]

Here are patches updating both OpenSSL series to fix CVE-2022-2097 and
(for OpenSSL 3) CVE-2022-2274.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

[bug#56403] [PATCH 1/2] gnu: OpenSSL: Update to 1.1.1q [fixes CVE-2022-2097].

[Leo Famulari]

https://www.cve.org/CVERecord?id=CVE-2022-2097

* gnu/packages/tls.scm (openssl/fixed): Update to 1.1.1q.
---
 gnu/packages/tls.scm | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/gnu/packages/tls.scm b/gnu/packages/tls.scm
index 9e52225d52..f65ae63379 100644
--- a/gnu/packages/tls.scm
+++ b/gnu/packages/tls.scm
@@ -507,7 +507,7 @@ (define openssl/fixed
   (package
     (inherit openssl)
     (name "openssl")
-    (version "1.1.1p")
+    (version "1.1.1q")
     (source (origin
               (method url-fetch)
               (uri (list (string-append "https://www.openssl.org/source/openssl-"
@@ -520,7 +520,7 @@ (define openssl/fixed
               (patches (search-patches "openssl-1.1-c-rehash-in.patch"))
               (sha256
                (base32
-                "0vyfibydji26wk1fmm0piz0810mfr7j4vaa2k5iwgiv6m8mbcqdz"))))))
+                "1jhhzp4gh6ymidxm1ckjk948l583awp0w3y2nvqdz7022kk9r4yp"))))))
 
 (define-public openssl-3.0
   (package
-- 
2.36.1

[bug#56403] [PATCH 2/2] gnu: OpenSSL 3.0.0: Update to 3.0.5 [fixes CVE-2022-2097 and CVE-2022-2274].

[Leo Famulari]

https://www.cve.org/CVERecord?id=CVE-2022-2097
https://www.cve.org/CVERecord?id=CVE-2022-2274

* gnu/packages/tls.scm (openssl-3.0): Update to 3.0.5.
---
 gnu/packages/tls.scm | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/gnu/packages/tls.scm b/gnu/packages/tls.scm
index f65ae63379..1ee5400a9c 100644
--- a/gnu/packages/tls.scm
+++ b/gnu/packages/tls.scm
@@ -525,7 +525,7 @@ (define openssl/fixed
 (define-public openssl-3.0
   (package
     (inherit openssl)
-    (version "3.0.4")
+    (version "3.0.5")
     (source (origin
               (method url-fetch)
               (uri (list (string-append "https://www.openssl.org/source/openssl-"
@@ -538,7 +538,7 @@ (define-public openssl-3.0
               (patches (search-patches "openssl-3.0-c-rehash-in.patch"))
               (sha256
                (base32
-                "03y0q2pzpkpgfgf74x4pf8gyar9d7pb0l0p7g2s0m2k6k8z88c98"))))
+                "0yja085lygkdxbf4k4rckkj9r24p8dgix8avqljnbbbixydqszda"))))
     (arguments
      (substitute-keyword-arguments (package-arguments openssl)
        ((#:phases phases '%standard-phases)
-- 
2.36.1

bug#56403: [PATCH 1/2] gnu: OpenSSL: Update to 1.1.1q [fixes CVE-2022-2097].

[Leo Famulari]

On Tue, Jul 05, 2022 at 12:56:08PM -0400, Leo Famulari wrote:
> https://www.cve.org/CVERecord?id=CVE-2022-2097
> 
> * gnu/packages/tls.scm (openssl/fixed): Update to 1.1.1q.

I pushed these patches as fe24e0c29cfe69d0c1aec819ce1a7e96362bafe6