Created by James Westby on 2010-10-07 and last modified on 2012-02-09
Get this branch:
bzr branch lp:ubuntu/maverick-security/openssl
Members of Ubuntu branches can upload to this branch. Log in for directions.

Branch merges

Related bugs

Related blueprints

Branch information

Ubuntu branches
Review team:
Ubuntu Development Team

Recent revisions

53. By Steve Beattie on 2012-01-31

* SECURITY UPDATE: ECDSA private key timing attack
  - debian/patches/CVE-2011-1945.patch: compute with fixed scalar
  - CVE-2011-1945
* SECURITY UPDATE: ECDH ciphersuite denial of service
  - debian/patches/CVE-2011-3210.patch: fix memory usage for thread
  - CVE-2011-3210
* SECURITY UPDATE: DTLS plaintext recovery attack
  - debian/patches/CVE-2011-4108.patch: perform all computations
    before discarding messages
  - CVE-2011-4108
* SECURITY UPDATE: policy check double free vulnerability
  - debian/patches/CVE-2011-4019.patch: only free domain policyin
    one location
  - CVE-2011-4019
* SECURITY UPDATE: SSL 3.0 block padding exposure
  - debian/patches/CVE-2011-4576.patch: clear bytes used for block
    padding of SSL 3.0 records.
  - CVE-2011-4576
* SECURITY UPDATE: malformed RFC 3779 data denial of service attack
  - debian/patches/CVE-2011-4577.patch: prevent malformed RFC3779
    data from triggering an assertion failure
  - CVE-2011-4577
* SECURITY UPDATE: Server Gated Cryptography (SGC) denial of service
  - debian/patches/CVE-2011-4619.patch: Only allow one SGC handshake
    restart for SSL/TLS.
  - CVE-2011-4619
* SECURITY UPDATE: fix for CVE-2011-4108 denial of service attack
  - debian/patches/CVE-2012-0050.patch: improve handling of DTLS MAC
  - CVE-2012-0050
* debian/patches/openssl-fix_ECDSA_tests.patch: fix ECDSA tests
* debian/libssl0.9.8.postinst: Only issue the reboot notification for
  servers by testing that the X server is not running (LP: #244250)

52. By Steve Beattie on 2011-02-09

* SECURITY UPDATE: OCSP stapling vulnerability
  - debian/patched/openssl-CVE-2011-0014-secadv_20110208.patch:
    stricter parsing of ClientHello message in ssl/t1_lib.c
  - CVE-2011-0014

51. By Steve Beattie on 2010-12-02

* SECURITY UPDATE: ciphersuite downgrade vulnerability
  - openssl-CVE-2010-4180-secadv_20101202-0.9.8.patch:
    disable workaround for Netscape cipher suite bug in ssl/s3_clnt.c
    and ssl/s3_srvr.c
  - CVE-2010-4180

50. By Steve Beattie on 2010-11-16

* SECURITY UPDATE: TLS race condition leading to a buffer overflow and
  possible code execution. (LP: #676243)
  - patches/debian/openssl-CVE-2010-3864-secadv_20101116-0.9.8.patch:
    stricter NULL/not-NULL checking in ssl/t1_lib.c
  - CVE-2010-3864

49. By Marc Deslauriers on 2010-10-06

* SECURITY UPDATE: denial of service and possible code execution via
  crafted private key with an invalid prime.
  - debian/patches/CVE-2010-2939.patch: set bn_ctx to NULL after freeing
    it in ssl/s3_clnt.c.
  - CVE-2010-2939

48. By Colin Watson on 2010-09-24

releasing version 0.9.8o-1ubuntu4

47. By Colin Watson on 2010-09-24

Update AES-NI patch to openssl-0.9.8-aesni-modes-perlasm-win32-v4.patch
from http://rt.openssl.org/Ticket/Display.html?id=2067, fixing segfault
on engine initialisation (LP: #590639).

46. By Kees Cook on 2010-07-20

debian/patches/no-sslv2.patch: disable SSLv2 to match NSS and GnuTLS.
The protocol is unsafe and extremely deprecated. (Debian bug 589706)

45. By Matthias Klose on 2010-07-19

* Don't build anymore for processors not supported anymore in maverick:
  - i486, i586 (on i386).
  - v8 (on sparc).

44. By Marc Deslauriers on 2010-06-14

* Merge from debian unstable, remaining changes (LP: #581167):
  - debian/patches/Bsymbolic-functions.patch: Link using
  - Ship documentation in openssl-doc, suggested by the package.
  - Use a different priority for libssl0.9.8/restart-services
    depending on whether a desktop, or server dist-upgrade is being
  - Display a system restart required notification bubble on libssl0.9.8
  - Replace duplicate files in the doc directory with symlinks.
  - Move runtime libraries to /lib, for the benefit of wpasupplicant
  - Use host compiler when cross-building (patch from Neil Williams in
    Debian #465248).
  - Don't run 'make test' when cross-building.
  - Create libssl0.9.8-udeb, for the benefit of wget-udeb (LP: #503339).
  - debian/patches/aesni.patch: Backport Intel AES-NI support from
    http://rt.openssl.org/Ticket/Display.html?id=2067 (LP: #485518).
  - debian/patches/perlpath-quilt.patch: Don't change perl #! paths
    under .pc.
* Dropped patches, now upstream:
  - debian/patches/CVE-2009-3245.patch
  - debian/patches/CVE-2010-0740.patch
  - debian/patches/dtls-compatibility.patch
  - debian/patches/CVE-2009-4355.patch
* Dropped "Add support for lpia".
* Dropped "Disable SSLv2 during compile" as this had never actually
  disabled SSLv2.
* Don't disable CVE-2009-3555.patch for Maverick.

Branch metadata

Branch format:
Branch format 7
Repository format:
Bazaar repository format 2a (needs bzr 1.16 or later)
Stacked on:
This branch contains Public information 
Everyone can see this information.