ubuntu/+source/openssl:applied/ubuntu/natty-devel

Last commit made on 2012-05-24
Get this branch:
git clone -b applied/ubuntu/natty-devel https://git.launchpad.net/ubuntu/+source/openssl
Members of Ubuntu Server Dev import team can upload to this branch. Log in for directions.

Branch merges

Branch information

Name:
applied/ubuntu/natty-devel
Repository:
lp:ubuntu/+source/openssl

Recent commits

09ded27... by Steve Beattie on 2012-05-22

Import patches-applied version 0.9.8o-5ubuntu1.7 to applied/ubuntu/natty-security

Imported using git-ubuntu import.

Changelog parent: a93ed605fb1d8ca39d478a27b0d3a45cb98eb8b0
Unapplied parent: df195b28d14f31d3c94663e8a468f17163def238

New changelog entries:
  * SECURITY UPDATE: denial of service attack in DTLS implementation
    - debian/patches/CVE_2012-2333.patch: guard for integer overflow
      before skipping explicit IV
    - CVE-2012-2333
  * SECURITY UPDATE: million message attack (MMA) in CMS and PKCS #7
    - debian/patches/CVE-2012-0884.patch: use a random key if RSA
      decryption fails to avoid leaking timing information
    - CVE-2012-0884
  * debian/patches/CVE-2012-0884-extra.patch: detect symmetric crypto
    errors in PKCS7_decrypt and initialize tkeylen properly when
    encrypting CMS messages.

df195b2... by Steve Beattie on 2012-05-22

Detect symmetric crypto errors in PKCS7_decrypt and initialise

Gbp-Pq: CVE-2012-0884-extra.patch.

126b597... by Steve Beattie on 2012-05-22

If RSA decryption fails use a random key and continue with

Gbp-Pq: CVE-2012-0884.patch.

9dfa2e7... by Steve Beattie on 2012-05-22

Sanity check record length before skipping explicit IV in

Gbp-Pq: CVE-2012-2333.patch.

6cc4c83... by Steve Beattie on 2012-05-22

The fix for CVE-2012-2110 did not take into account that the 'len'

Gbp-Pq: CVE-2012-2131.patch.

0b3c128... by Steve Beattie on 2012-05-22

Use correct error code in BUF_MEM_grow_clean()

Gbp-Pq: CVE-2012-2110b.patch.

4f02e9d... by Steve Beattie on 2012-05-22

Check for potentially exploitable overflows in asn1_d2i_read_bio

Gbp-Pq: CVE-2012-2110.patch.

2b11a00... by Steve Beattie on 2012-05-22

disallow SSLv2 initialization, and force it disabled even in

Gbp-Pq: no-sslv2.patch.

7e56117... by Steve Beattie on 2012-05-22

Bsymbolic-functions.patch

No DEP3 Subject or Description header found

Gbp-Pq: Bsymbolic-functions.patch.

478f772... by Steve Beattie on 2012-05-22

perlpath-quilt.patch

No DEP3 Subject or Description header found

Gbp-Pq: perlpath-quilt.patch.