lp:ubuntu/precise/openssl

Branch merges

Propose for merging

1 branch proposed for merging into this one.

No branches dependent on this one.

Related source package recipes

No recipes using this branch. (?)

Create packaging recipe

Related snap packages

Related bugs

Related blueprints

77. By Jamie Strandboge on 2012-04-19

* SECURITY UPDATE: fix various overflows
  - debian/patches/CVE-2012-2110.patch: adjust crypto/a_d2i_fp.c,
    crypto/buffer.c and crypto/mem.c to verify size of lengths
  - CVE-2012-2110

76. By Colin Watson on 2012-04-18

* Backport more upstream patches to work around TLS 1.2 failures
  (LP #965371):
  - Do not use record version number > TLS 1.0 in initial client hello:
    some (but not all) hanging servers will now work.
  - Truncate the number of ciphers sent in the client hello to 50. Most
    broken servers should now work.
  - Don't allow TLS 1.2 SHA-256 ciphersuites in TLS 1.0, 1.1 connections.
* Don't re-enable TLS 1.2 client support by default yet, since more of the
  sites listed in the above bug and its duplicates still fail if I do that
  versus leaving it disabled.

75. By Colin Watson on 2012-04-18

releasing version 1.0.1-4ubuntu1

74. By Colin Watson on 2012-04-10

merge fixes LP: #968753

73. By Colin Watson on 2012-04-10

merge from Debian 1.0.1-4

72. By Colin Watson on 2012-03-30

releasing version 1.0.1-2ubuntu4

71. By Colin Watson on 2012-03-30

Pass cross-compiling options to 'make install' as well, since apparently
it likes to rebuild fips_premain_dso.

70. By Colin Watson on 2012-03-30

add .pc/tls12_workarounds.patch/Configure to deconfuse package importer

69. By Colin Watson on 2012-03-30

releasing version 1.0.1-2ubuntu3

68. By Colin Watson on 2012-03-30

* Temporarily work around TLS 1.2 failures as suggested by upstream
  (LP #965371):
  - Use client version when deciding whether to send supported signature
    algorithms extension.
  - Experimental workaround to large client hello issue: if
    OPENSSL_NO_TLS1_2_CLIENT is set then TLS v1.2 is disabled for clients
    only.
  - Compile with -DOPENSSL_NO_TLS1_2_CLIENT.
  This fixes most of the reported problems, but does not fix the case of
  servers that reject version numbers they don't support rather than
  trying to negotiate a lower version (e.g. www.mediafire.com).