ubuntu/+source/openssl:ubuntu/artful-updates

Last commit made on 2018-06-26
Get this branch:
git clone -b ubuntu/artful-updates https://git.launchpad.net/ubuntu/+source/openssl
Members of Ubuntu Server Dev import team can upload to this branch. Log in for directions.

Branch merges

Branch information

Name:
ubuntu/artful-updates
Repository:
lp:ubuntu/+source/openssl

Recent commits

c0a6afd... by Marc Deslauriers on 2018-06-20

Import patches-unapplied version 1.0.2g-1ubuntu13.6 to ubuntu/artful-security

Imported using git-ubuntu import.

Changelog parent: 17429a963fcb9125abced148e2998be19f25555c

New changelog entries:
  * SECURITY UPDATE: ECDSA key extraction side channel
    - debian/patches/CVE-2018-0495.patch: add blinding to an ECDSA
      signature in crypto/ecdsa/ecdsatest.c, crypto/ecdsa/ecs_ossl.c.
    - CVE-2018-0495
  * SECURITY UPDATE: denial of service via long prime values
    - debian/patches/CVE-2018-0732.patch: reject excessively large primes
      in DH key generation in crypto/dh/dh_key.c.
    - CVE-2018-0732
  * SECURITY UPDATE: RSA cache timing side channel attack
    (previous update was incomplete)
    - debian/patches/CVE-2018-0737-1.patch: replaced variable-time GCD in
      crypto/rsa/rsa_gen.c.
    - debian/patches/CVE-2018-0737-2.patch: used ERR set/pop mark in
      crypto/rsa/rsa_gen.c.
    - debian/patches/CVE-2018-0737-3.patch: consttime flag changed in
      crypto/rsa/rsa_gen.c.
    - debian/patches/CVE-2018-0737-4.patch: ensure BN_mod_inverse and
      BN_mod_exp_mont both get called with BN_FLG_CONSTTIME flag set in
      crypto/rsa/rsa_gen.c.
    - CVE-2018-0737

17429a9... by Leonidas S. Barbosa on 2018-04-18

Import patches-unapplied version 1.0.2g-1ubuntu13.5 to ubuntu/artful-security

Imported using git-ubuntu import.

Changelog parent: 61ef2370dc15b00c58fc8a0bda845f3c3486fd03

New changelog entries:
  * SECURITY UPDATE: Cache timing side channel
    - debian/patches/CVE-2018-0737.patch: ensure BN_mod_inverse
      and BN_mod_exp_mont get called with BN_FLG_CONSTTIME flag set
      in crypto/rsa/rsa_gen.c.
    - CVE-2018-0737

61ef237... by Marc Deslauriers on 2018-03-27

Import patches-unapplied version 1.0.2g-1ubuntu13.4 to ubuntu/artful-security

Imported using git-ubuntu import.

Changelog parent: fd2cc20351ce68b2aba579b21b61452888a24e4c

New changelog entries:
  * SECURITY UPDATE: DoS via ASN.1 types with a recursive definition
    - debian/patches/CVE-2018-0739.patch: limit stack depth in
      crypto/asn1/asn1.h, crypto/asn1/asn1_err.c, crypto/asn1/tasn_dec.c.
    - CVE-2018-0739

fd2cc20... by Marc Deslauriers on 2017-12-07

Import patches-unapplied version 1.0.2g-1ubuntu13.3 to ubuntu/artful-security

Imported using git-ubuntu import.

Changelog parent: 8c8411428bbab109cb0025c414f1fa8a4ef3fa43

New changelog entries:
  * SECURITY UPDATE: Read/write after SSL object in error state
    - debian/patches/CVE-2017-3737-pre.patch: add test/ssltestlib.*,
      add to test/Makefile.
    - debian/patches/CVE-2017-3737-1.patch: don't allow read/write after
      fatal error in ssl/ssl.h.
    - debian/patches/CVE-2017-3737-2.patch: add test to ssl/Makefile,
      ssl/fatalerrtest.c, test/Makefile.
    - CVE-2017-3737
  * SECURITY UPDATE: rsaz_1024_mul_avx2 overflow bug on x86_64
    - debian/patches/CVE-2017-3738.patch: fix digit correction bug in
      crypto/bn/asm/rsaz-avx2.pl.
    - CVE-2017-3738

8c84114... by Marc Deslauriers on 2017-11-06

Import patches-unapplied version 1.0.2g-1ubuntu13.2 to ubuntu/artful-security

Imported using git-ubuntu import.

Changelog parent: 538516883a1aebb6a92840cbce71f60bdbb19043

New changelog entries:
  * SECURITY UPDATE: Malformed X.509 IPAddressFamily could cause OOB read
    - debian/patches/CVE-2017-3735.patch: avoid out-of-bounds read in
      crypto/x509v3/v3_addr.c.
    - CVE-2017-3735
  * SECURITY UPDATE: bn_sqrx8x_internal carry bug on x86_64
    - debian/patches/CVE-2017-3736.patch: fix carry bug in
      bn_sqrx8x_internal in crypto/bn/asm/x86_64-mont5.pl.
    - CVE-2017-3736
  * debian/patches/fix_armhf_ftbfs.patch: fix build with gcc-7.2 on armhf.
    (LP: #1729850)

5385168... by William Grant on 2017-05-19

Import patches-unapplied version 1.0.2g-1ubuntu13 to ubuntu/artful-proposed

Imported using git-ubuntu import.

Changelog parent: f3cdd9f5d72668fda74a2dcb46884ffc8a376251

New changelog entries:
  * aes/asm/aesni-sha*-x86_64.pl: fix IV handling in SHAEXT paths.
    (LP: #1674399)

f3cdd9f... by Eric Desrochers on 2017-04-25

Import patches-unapplied version 1.0.2g-1ubuntu12 to ubuntu/artful-proposed

Imported using git-ubuntu import.

Changelog parent: e524a494f56c940058e0652fd42992088a93d1ca

New changelog entries:
  * crypto/x86*cpuid.pl: move extended feature detection. (LP: #1674399)
    This fix moves extended feature detection past basic feature
    detection where it belongs. 32-bit counterpart is harmonized too.

e524a49... by Marc Deslauriers on 2017-01-30

Import patches-unapplied version 1.0.2g-1ubuntu11 to ubuntu/zesty-proposed

Imported using git-ubuntu import.

Changelog parent: 98d8c30245067bdceeac22e108898093f94c5bf4

New changelog entries:
  * SECURITY UPDATE: Montgomery multiplication may produce incorrect
    results
    - debian/patches/CVE-2016-7055.patch: fix logic in
      crypto/bn/asm/x86_64-mont.pl.
    - CVE-2016-7055
  * SECURITY UPDATE: DoS via warning alerts
    - debian/patches/CVE-2016-8610.patch: don't allow too many consecutive
      warning alerts in ssl/d1_pkt.c, ssl/s3_pkt.c, ssl/ssl.h,
      ssl/ssl_locl.h.
    - debian/patches/CVE-2016-8610-2.patch: fail if an unrecognised record
      type is received in ssl/s3_pkt.c.
    - CVE-2016-8610
  * SECURITY UPDATE: Truncated packet could crash via OOB read
    - debian/patches/CVE-2017-3731.patch: harden RC4_MD5 cipher in
      crypto/evp/e_rc4_hmac_md5.c.
    - CVE-2017-3731
  * SECURITY UPDATE: BN_mod_exp may produce incorrect results on x86_64
    - debian/patches/CVE-2017-3732.patch: fix carry bug in
      bn_sqr8x_internal in crypto/bn/asm/x86_64-mont5.pl.
    - CVE-2017-3732

98d8c30... by Dimitri John Ledkov on 2016-11-10

Import patches-unapplied version 1.0.2g-1ubuntu10 to ubuntu/zesty-proposed

Imported using git-ubuntu import.

Changelog parent: 1c6db8d529e71e4f589f503db2dc5977e31cbf6a

New changelog entries:
  * Provide libssl1.0-dev metapackage to satisfy dep-waits.

1c6db8d... by Marc Deslauriers on 2016-09-23

Import patches-unapplied version 1.0.2g-1ubuntu9 to ubuntu/yakkety-proposed

Imported using git-ubuntu import.

Changelog parent: 579a024561e4adc6e476084731c798563c0b98ca

New changelog entries:
  * SECURITY UPDATE: Pointer arithmetic undefined behaviour
    - debian/patches/CVE-2016-2177.patch: avoid undefined pointer
      arithmetic in ssl/s3_srvr.c, ssl/ssl_sess.c, ssl/t1_lib.c.
    - CVE-2016-2177
  * SECURITY UPDATE: Constant time flag not preserved in DSA signing
    - debian/patches/CVE-2016-2178-*.patch: preserve BN_FLG_CONSTTIME in
      crypto/dsa/dsa_ossl.c.
    - CVE-2016-2178
  * SECURITY UPDATE: DTLS buffered message DoS
    - debian/patches/CVE-2016-2179.patch: fix queue handling in
      ssl/d1_both.c, ssl/d1_clnt.c, ssl/d1_lib.c, ssl/d1_srvr.c,
      ssl/ssl_locl.h.
    - CVE-2016-2179
  * SECURITY UPDATE: OOB read in TS_OBJ_print_bio()
    - debian/patches/CVE-2016-2180.patch: fix text handling in
      crypto/ts/ts_lib.c.
    - CVE-2016-2180
  * SECURITY UPDATE: DTLS replay protection DoS
    - debian/patches/CVE-2016-2181-1.patch: properly handle unprocessed
      records in ssl/d1_pkt.c.
    - debian/patches/CVE-2016-2181-2.patch: protect against replay attacks
      in ssl/d1_pkt.c, ssl/ssl.h, ssl/ssl_err.c.
    - debian/patches/CVE-2016-2181-3.patch: update error code in ssl/ssl.h.
    - CVE-2016-2181
  * SECURITY UPDATE: OOB write in BN_bn2dec()
    - debian/patches/CVE-2016-2182.patch: don't overflow buffer in
      crypto/bn/bn_print.c.
    - debian/patches/CVE-2016-2182-2.patch: fix off-by-one in overflow
      check in crypto/bn/bn_print.c.
    - CVE-2016-2182
  * SECURITY UPDATE: SWEET32 Mitigation
    - debian/patches/CVE-2016-2183.patch: move DES ciphersuites from HIGH
      to MEDIUM in ssl/s3_lib.c.
    - CVE-2016-2183
  * SECURITY UPDATE: Malformed SHA512 ticket DoS
    - debian/patches/CVE-2016-6302.patch: sanity check ticket length in
      ssl/t1_lib.c.
    - CVE-2016-6302
  * SECURITY UPDATE: OOB write in MDC2_Update()
    - debian/patches/CVE-2016-6303.patch: avoid overflow in
      crypto/mdc2/mdc2dgst.c.
    - CVE-2016-6303
  * SECURITY UPDATE: OCSP Status Request extension unbounded memory growth
    - debian/patches/CVE-2016-6304.patch: remove OCSP_RESPIDs from previous
      handshake in ssl/t1_lib.c.
    - CVE-2016-6304
  * SECURITY UPDATE: Certificate message OOB reads
    - debian/patches/CVE-2016-6306-1.patch: check lengths in ssl/s3_clnt.c,
      ssl/s3_srvr.c.
    - debian/patches/CVE-2016-6306-2.patch: make message buffer slightly
      larger in ssl/d1_both.c, ssl/s3_both.c.
    - CVE-2016-6306