Skip to content

Commit aa3b4b4

Browse files
indutnyindutny
committed
deps: update openssl to v1.0.1i
1 parent 63a4268 commit aa3b4b4

178 files changed

Lines changed: 3475 additions & 6032 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎deps/openssl/openssl/CHANGES‎

Lines changed: 86 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,92 @@
22
OpenSSL CHANGES
33
_______________
44

5+
Changes between 1.0.1h and 1.0.1i [6 Aug 2014]
6+
7+
*) Fix SRP buffer overrun vulnerability. Invalid parameters passed to the
8+
SRP code can be overrun an internal buffer. Add sanity check that
9+
g, A, B < N to SRP code.
10+
11+
Thanks to Sean Devlin and Watson Ladd of Cryptography Services, NCC
12+
Group for discovering this issue.
13+
(CVE-2014-3512)
14+
[Steve Henson]
15+
16+
*) A flaw in the OpenSSL SSL/TLS server code causes the server to negotiate
17+
TLS 1.0 instead of higher protocol versions when the ClientHello message
18+
is badly fragmented. This allows a man-in-the-middle attacker to force a
19+
downgrade to TLS 1.0 even if both the server and the client support a
20+
higher protocol version, by modifying the client's TLS records.
21+
22+
Thanks to David Benjamin and Adam Langley (Google) for discovering and
23+
researching this issue.
24+
(CVE-2014-3511)
25+
[David Benjamin]
26+
27+
*) OpenSSL DTLS clients enabling anonymous (EC)DH ciphersuites are subject
28+
to a denial of service attack. A malicious server can crash the client
29+
with a null pointer dereference (read) by specifying an anonymous (EC)DH
30+
ciphersuite and sending carefully crafted handshake messages.
31+
32+
Thanks to Felix Gr�bert (Google) for discovering and researching this
33+
issue.
34+
(CVE-2014-3510)
35+
[Emilia K�sper]
36+
37+
*) By sending carefully crafted DTLS packets an attacker could cause openssl
38+
to leak memory. This can be exploited through a Denial of Service attack.
39+
Thanks to Adam Langley for discovering and researching this issue.
40+
(CVE-2014-3507)
41+
[Adam Langley]
42+
43+
*) An attacker can force openssl to consume large amounts of memory whilst
44+
processing DTLS handshake messages. This can be exploited through a
45+
Denial of Service attack.
46+
Thanks to Adam Langley for discovering and researching this issue.
47+
(CVE-2014-3506)
48+
[Adam Langley]
49+
50+
*) An attacker can force an error condition which causes openssl to crash
51+
whilst processing DTLS packets due to memory being freed twice. This
52+
can be exploited through a Denial of Service attack.
53+
Thanks to Adam Langley and Wan-Teh Chang for discovering and researching
54+
this issue.
55+
(CVE-2014-3505)
56+
[Adam Langley]
57+
58+
*) If a multithreaded client connects to a malicious server using a resumed
59+
session and the server sends an ec point format extension it could write
60+
up to 255 bytes to freed memory.
61+
62+
Thanks to Gabor Tyukasz (LogMeIn Inc) for discovering and researching this
63+
issue.
64+
(CVE-2014-3509)
65+
[Gabor Tyukasz]
66+
67+
*) A malicious server can crash an OpenSSL client with a null pointer
68+
dereference (read) by specifying an SRP ciphersuite even though it was not
69+
properly negotiated with the client. This can be exploited through a
70+
Denial of Service attack.
71+
72+
Thanks to Joonas Kuorilehto and Riku Hietam�ki (Codenomicon) for
73+
discovering and researching this issue.
74+
(CVE-2014-5139)
75+
[Steve Henson]
76+
77+
*) A flaw in OBJ_obj2txt may cause pretty printing functions such as
78+
X509_name_oneline, X509_name_print_ex et al. to leak some information
79+
from the stack. Applications may be affected if they echo pretty printing
80+
output to the attacker.
81+
82+
Thanks to Ivan Fratric (Google) for discovering this issue.
83+
(CVE-2014-3508)
84+
[Emilia K�sper, and Steve Henson]
85+
86+
*) Fix ec_GFp_simple_points_make_affine (thus, EC_POINTs_mul etc.)
87+
for corner cases. (Certain input points at infinity could lead to
88+
bogus results, with non-infinity inputs mapped to infinity too.)
89+
[Bodo Moeller]
90+
591
Changes between 1.0.1g and 1.0.1h [5 Jun 2014]
692

793
*) Fix for SSL/TLS MITM flaw. An attacker using a carefully crafted

‎deps/openssl/openssl/Configure‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -720,14 +720,15 @@ my %disabled = ( # "what" => "comment" [or special keyword "experimental
720720
"sctp" => "default",
721721
"shared" => "default",
722722
"store" => "experimental",
723+
"unit-test" => "default",
723724
"zlib" => "default",
724725
"zlib-dynamic" => "default"
725726
);
726727
my @experimental = ();
727728

728729
# This is what $depflags will look like with the above defaults
729730
# (we need this to see if we should advise the user to run "make depend"):
730-
my $default_depflags = " -DOPENSSL_NO_EC_NISTP_64_GCC_128 -DOPENSSL_NO_GMP -DOPENSSL_NO_JPAKE -DOPENSSL_NO_MD2 -DOPENSSL_NO_RC5 -DOPENSSL_NO_RFC3779 -DOPENSSL_NO_SCTP -DOPENSSL_NO_STORE";
731+
my $default_depflags = " -DOPENSSL_NO_EC_NISTP_64_GCC_128 -DOPENSSL_NO_GMP -DOPENSSL_NO_JPAKE -DOPENSSL_NO_MD2 -DOPENSSL_NO_RC5 -DOPENSSL_NO_RFC3779 -DOPENSSL_NO_SCTP -DOPENSSL_NO_STORE -DOPENSSL_NO_UNIT_TEST";
731732

732733
# Explicit "no-..." options will be collected in %disabled along with the defaults.
733734
# To remove something from %disabled, use "enable-foo" (unless it's experimental).

‎deps/openssl/openssl/FAQ‎

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -113,11 +113,6 @@ that came with the version of OpenSSL you are using. The pod format
113113
documentation is included in each OpenSSL distribution under the docs
114114
directory.
115115

116-
For information on parts of libcrypto that are not yet documented, you
117-
might want to read Ariel Glenn's documentation on SSLeay 0.9, OpenSSL's
118-
predecessor, at <URL: http://www.columbia.edu/~ariel/ssleay/>. Much
119-
of this still applies to OpenSSL.
120-
121116
There is some documentation about certificate extensions and PKCS#12
122117
in doc/openssl.txt
123118

‎deps/openssl/openssl/Makefile‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44
## Makefile for OpenSSL
55
##
66

7-
VERSION=1.0.1h
7+
VERSION=1.0.1i
88
MAJOR=1
99
MINOR=0.1
1010
SHLIB_VERSION_NUMBER=1.0.0
@@ -13,7 +13,7 @@ SHLIB_MAJOR=1
1313
SHLIB_MINOR=0.0
1414
SHLIB_EXT=
1515
PLATFORM=dist
16-
OPTIONS= no-ec_nistp_64_gcc_128 no-gmp no-jpake no-krb5 no-md2 no-rc5 no-rfc3779 no-sctp no-shared no-store no-zlib no-zlib-dynamic static-engine
16+
OPTIONS= no-ec_nistp_64_gcc_128 no-gmp no-jpake no-krb5 no-md2 no-rc5 no-rfc3779 no-sctp no-shared no-store no-unit-test no-zlib no-zlib-dynamic static-engine
1717
CONFIGURE_ARGS=dist
1818
SHLIB_TARGET=
1919

@@ -61,7 +61,7 @@ OPENSSLDIR=/usr/local/ssl
6161

6262
CC= cc
6363
CFLAG= -O
64-
DEPFLAG= -DOPENSSL_NO_EC_NISTP_64_GCC_128 -DOPENSSL_NO_GMP -DOPENSSL_NO_JPAKE -DOPENSSL_NO_MD2 -DOPENSSL_NO_RC5 -DOPENSSL_NO_RFC3779 -DOPENSSL_NO_SCTP -DOPENSSL_NO_STORE
64+
DEPFLAG= -DOPENSSL_NO_EC_NISTP_64_GCC_128 -DOPENSSL_NO_GMP -DOPENSSL_NO_JPAKE -DOPENSSL_NO_MD2 -DOPENSSL_NO_RC5 -DOPENSSL_NO_RFC3779 -DOPENSSL_NO_SCTP -DOPENSSL_NO_STORE -DOPENSSL_NO_UNIT_TEST
6565
PEX_LIBS=
6666
EX_LIBS=
6767
EXE_EXT=

‎deps/openssl/openssl/Makefile.bak‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44
## Makefile for OpenSSL
55
##
66

7-
VERSION=1.0.1h-dev
7+
VERSION=1.0.1i-dev
88
MAJOR=1
99
MINOR=0.1
1010
SHLIB_VERSION_NUMBER=1.0.0
@@ -13,7 +13,7 @@ SHLIB_MAJOR=1
1313
SHLIB_MINOR=0.0
1414
SHLIB_EXT=
1515
PLATFORM=gcc
16-
OPTIONS= no-ec_nistp_64_gcc_128 no-gmp no-jpake no-krb5 no-md2 no-rc5 no-rfc3779 no-sctp no-shared no-store no-zlib no-zlib-dynamic static-engine
16+
OPTIONS= no-ec_nistp_64_gcc_128 no-gmp no-jpake no-krb5 no-md2 no-rc5 no-rfc3779 no-sctp no-shared no-store no-unit-test no-zlib no-zlib-dynamic static-engine
1717
CONFIGURE_ARGS=gcc
1818
SHLIB_TARGET=
1919

@@ -61,7 +61,7 @@ OPENSSLDIR=/usr/local/ssl
6161

6262
CC= gcc
6363
CFLAG= -O3
64-
DEPFLAG= -DOPENSSL_NO_EC_NISTP_64_GCC_128 -DOPENSSL_NO_GMP -DOPENSSL_NO_JPAKE -DOPENSSL_NO_MD2 -DOPENSSL_NO_RC5 -DOPENSSL_NO_RFC3779 -DOPENSSL_NO_SCTP -DOPENSSL_NO_STORE
64+
DEPFLAG= -DOPENSSL_NO_EC_NISTP_64_GCC_128 -DOPENSSL_NO_GMP -DOPENSSL_NO_JPAKE -DOPENSSL_NO_MD2 -DOPENSSL_NO_RC5 -DOPENSSL_NO_RFC3779 -DOPENSSL_NO_SCTP -DOPENSSL_NO_STORE -DOPENSSL_NO_UNIT_TEST
6565
PEX_LIBS=
6666
EX_LIBS=
6767
EXE_EXT=

‎deps/openssl/openssl/NEWS‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,10 +5,23 @@
55
This file gives a brief overview of the major changes between each OpenSSL
66
release. For more details please read the CHANGES file.
77

8+
Major changes between OpenSSL 1.0.1h and OpenSSL 1.0.1i [6 Aug 2014]
9+
10+
o Fix for CVE-2014-3512
11+
o Fix for CVE-2014-3511
12+
o Fix for CVE-2014-3510
13+
o Fix for CVE-2014-3507
14+
o Fix for CVE-2014-3506
15+
o Fix for CVE-2014-3505
16+
o Fix for CVE-2014-3509
17+
o Fix for CVE-2014-5139
18+
o Fix for CVE-2014-3508
19+
820
Major changes between OpenSSL 1.0.1g and OpenSSL 1.0.1h [5 Jun 2014]
921

1022
o Fix for CVE-2014-0224
1123
o Fix for CVE-2014-0221
24+
o Fix for CVE-2014-0198
1225
o Fix for CVE-2014-0195
1326
o Fix for CVE-2014-3470
1427
o Fix for CVE-2010-5298

‎deps/openssl/openssl/README‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11

2-
OpenSSL 1.0.1h 5 Jun 2014
2+
OpenSSL 1.0.1i 6 Aug 2014
33

44
Copyright (c) 1998-2011 The OpenSSL Project
55
Copyright (c) 1995-1998 Eric A. Young, Tim J. Hudson

‎deps/openssl/openssl/apps/apps.c‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -390,6 +390,8 @@ int chopup_args(ARGS *arg, char *buf, int *argc, char **argv[])
390390
{
391391
arg->count=20;
392392
arg->data=(char **)OPENSSL_malloc(sizeof(char *)*arg->count);
393+
if (arg->data == NULL)
394+
return 0;
393395
}
394396
for (i=0; i<arg->count; i++)
395397
arg->data[i]=NULL;
@@ -1542,6 +1544,8 @@ char *make_config_name()
15421544

15431545
len=strlen(t)+strlen(OPENSSL_CONF)+2;
15441546
p=OPENSSL_malloc(len);
1547+
if (p == NULL)
1548+
return NULL;
15451549
BUF_strlcpy(p,t,len);
15461550
#ifndef OPENSSL_SYS_VMS
15471551
BUF_strlcat(p,"/",len);

‎deps/openssl/openssl/apps/ca.c‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1620,12 +1620,14 @@ static int certify(X509 **xret, char *infile, EVP_PKEY *pkey, X509 *x509,
16201620
{
16211621
ok=0;
16221622
BIO_printf(bio_err,"Signature verification problems....\n");
1623+
ERR_print_errors(bio_err);
16231624
goto err;
16241625
}
16251626
if (i == 0)
16261627
{
16271628
ok=0;
16281629
BIO_printf(bio_err,"Signature did not match the certificate request\n");
1630+
ERR_print_errors(bio_err);
16291631
goto err;
16301632
}
16311633
else
@@ -2777,6 +2779,9 @@ char *make_revocation_str(int rev_type, char *rev_arg)
27772779

27782780
revtm = X509_gmtime_adj(NULL, 0);
27792781

2782+
if (!revtm)
2783+
return NULL;
2784+
27802785
i = revtm->length + 1;
27812786

27822787
if (reason) i += strlen(reason) + 1;

‎deps/openssl/openssl/apps/ciphers.c‎

Lines changed: 0 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -96,13 +96,7 @@ int MAIN(int argc, char **argv)
9696
char buf[512];
9797
BIO *STDout=NULL;
9898

99-
#if !defined(OPENSSL_NO_SSL2) && !defined(OPENSSL_NO_SSL3)
10099
meth=SSLv23_server_method();
101-
#elif !defined(OPENSSL_NO_SSL3)
102-
meth=SSLv3_server_method();
103-
#elif !defined(OPENSSL_NO_SSL2)
104-
meth=SSLv2_server_method();
105-
#endif
106100

107101
apps_startup();
108102

0 commit comments

Comments
 (0)