Last commit made on 2017-05-19
Get this branch:
git clone -b ubuntu/xenial-proposed https://git.launchpad.net/ubuntu/+source/openssl
Members of Ubuntu Server Dev import team can upload to this branch. Log in for directions.

Branch merges

Branch information


Recent commits

0ece36a... by William Grant on 2017-05-19

Import patches-unapplied version 1.0.2g-1ubuntu4.8 to ubuntu/xenial-proposed

Imported using git-ubuntu import.

Changelog parent: 2a85a4b041f42290f2106ca9a4f25c833a1f9c1b

New changelog entries:
  * aes/asm/aesni-sha*-x86_64.pl: fix IV handling in SHAEXT paths.
    (LP: #1674399)

2a85a4b... by Eric Desrochers on 2017-04-26

Import patches-unapplied version 1.0.2g-1ubuntu4.7 to ubuntu/xenial-proposed

Imported using git-ubuntu import.

Changelog parent: 1032d8539dfaa5f8039093fa7faa4899faaedcb0

New changelog entries:
  * crypto/x86*cpuid.pl: move extended feature detection. (LP: #1674399)
    This fix moves extended feature detection past basic feature
    detection where it belongs. 32-bit counterpart is harmonized too.

1032d85... by Marc Deslauriers on 2017-01-30

Import patches-unapplied version 1.0.2g-1ubuntu4.6 to ubuntu/xenial-security

Imported using git-ubuntu import.

Changelog parent: a0646a86573f359922893fc6aea2d2fb26f71abb

New changelog entries:
  * SECURITY UPDATE: Montgomery multiplication may produce incorrect
    - debian/patches/CVE-2016-7055.patch: fix logic in
    - CVE-2016-7055
  * SECURITY UPDATE: DoS via warning alerts
    - debian/patches/CVE-2016-8610.patch: don't allow too many consecutive
      warning alerts in ssl/d1_pkt.c, ssl/s3_pkt.c, ssl/ssl.h,
    - debian/patches/CVE-2016-8610-2.patch: fail if an unrecognised record
      type is received in ssl/s3_pkt.c.
    - CVE-2016-8610
  * SECURITY UPDATE: Truncated packet could crash via OOB read
    - debian/patches/CVE-2017-3731.patch: harden RC4_MD5 cipher in
    - CVE-2017-3731
  * SECURITY UPDATE: BN_mod_exp may produce incorrect results on x86_64
    - debian/patches/CVE-2017-3732.patch: fix carry bug in
      bn_sqr8x_internal in crypto/bn/asm/x86_64-mont5.pl.
    - CVE-2017-3732

a0646a8... by Marc Deslauriers on 2016-09-23

Import patches-unapplied version 1.0.2g-1ubuntu4.5 to ubuntu/xenial-security

Imported using git-ubuntu import.

Changelog parent: 5233746f3e301e1eff68b8a4fcaa9dd13791c99b

New changelog entries:
  * SECURITY REGRESSION: incomplete fix for CVE-2016-2182 (LP: #1626883)
    - debian/patches/CVE-2016-2182-2.patch: fix off-by-one in overflow
      check in crypto/bn/bn_print.c.

5233746... by Marc Deslauriers on 2016-09-22

Import patches-unapplied version 1.0.2g-1ubuntu4.4 to ubuntu/xenial-security

Imported using git-ubuntu import.

Changelog parent: 9591674059e59bab01557bec32460f904ff8397c

New changelog entries:
  * SECURITY UPDATE: Pointer arithmetic undefined behaviour
    - debian/patches/CVE-2016-2177.patch: avoid undefined pointer
      arithmetic in ssl/s3_srvr.c, ssl/ssl_sess.c, ssl/t1_lib.c.
    - CVE-2016-2177
  * SECURITY UPDATE: Constant time flag not preserved in DSA signing
    - debian/patches/CVE-2016-2178-*.patch: preserve BN_FLG_CONSTTIME in
    - CVE-2016-2178
  * SECURITY UPDATE: DTLS buffered message DoS
    - debian/patches/CVE-2016-2179.patch: fix queue handling in
      ssl/d1_both.c, ssl/d1_clnt.c, ssl/d1_lib.c, ssl/d1_srvr.c,
    - CVE-2016-2179
  * SECURITY UPDATE: OOB read in TS_OBJ_print_bio()
    - debian/patches/CVE-2016-2180.patch: fix text handling in
    - CVE-2016-2180
  * SECURITY UPDATE: DTLS replay protection DoS
    - debian/patches/CVE-2016-2181-1.patch: properly handle unprocessed
      records in ssl/d1_pkt.c.
    - debian/patches/CVE-2016-2181-2.patch: protect against replay attacks
      in ssl/d1_pkt.c, ssl/ssl.h, ssl/ssl_err.c.
    - debian/patches/CVE-2016-2181-3.patch: update error code in ssl/ssl.h.
    - CVE-2016-2181
  * SECURITY UPDATE: OOB write in BN_bn2dec()
    - debian/patches/CVE-2016-2182.patch: don't overflow buffer in
    - CVE-2016-2182
    - debian/patches/CVE-2016-2183.patch: move DES ciphersuites from HIGH
      to MEDIUM in ssl/s3_lib.c.
    - CVE-2016-2183
  * SECURITY UPDATE: Malformed SHA512 ticket DoS
    - debian/patches/CVE-2016-6302.patch: sanity check ticket length in
    - CVE-2016-6302
  * SECURITY UPDATE: OOB write in MDC2_Update()
    - debian/patches/CVE-2016-6303.patch: avoid overflow in
    - CVE-2016-6303
  * SECURITY UPDATE: OCSP Status Request extension unbounded memory growth
    - debian/patches/CVE-2016-6304.patch: remove OCSP_RESPIDs from previous
      handshake in ssl/t1_lib.c.
    - CVE-2016-6304
  * SECURITY UPDATE: Certificate message OOB reads
    - debian/patches/CVE-2016-6306-1.patch: check lengths in ssl/s3_clnt.c,
    - debian/patches/CVE-2016-6306-2.patch: make message buffer slightly
      larger in ssl/d1_both.c, ssl/s3_both.c.
    - CVE-2016-6306

9591674... by Marc Deslauriers on 2016-08-19

Import patches-unapplied version 1.0.2g-1ubuntu4.3 to ubuntu/xenial-proposed

Imported using git-ubuntu import.

Changelog parent: 37d236504223c9d61bf09cdfce897dd45dbd2fb6

New changelog entries:
  * Remove incomplete FIPS patches for now. (LP: #1614210)
    (related bugs: LP: #1594748, LP: #1593953, LP: #1591797, LP: #1588524)
    - debian/patches/*fips*.patch: removed.
    - debian/rules: removed fips from CONFARGS.

37d2365... by Dimitri John Ledkov on 2016-07-28

Import patches-unapplied version 1.0.2g-1ubuntu4.2 to ubuntu/xenial-proposed

Imported using git-ubuntu import.

Changelog parent: 3acc728bd8e76ff22110c705fd2379f942f89066

New changelog entries:
  * Cherry-pick s390x assembly pack bugfix to cache capability query
    results for improved performance. LP: #1601836.
  * Enable asm optimisations on s390x. LP: #1602655.

3acc728... by Marc Deslauriers on 2016-04-28

Import patches-unapplied version 1.0.2g-1ubuntu4.1 to ubuntu/xenial-security

Imported using git-ubuntu import.

Changelog parent: 14fa24544e1b6a0db385ce7ff35acd6b062374ed

New changelog entries:
  * SECURITY UPDATE: EVP_EncodeUpdate overflow
    - debian/patches/CVE-2016-2105.patch: properly check lengths in
      crypto/evp/encode.c, add documentation to
      doc/crypto/EVP_EncodeInit.pod, doc/crypto/evp.pod.
    - CVE-2016-2105
  * SECURITY UPDATE: EVP_EncryptUpdate overflow
    - debian/patches/CVE-2016-2106.patch: fix overflow in
    - CVE-2016-2106
  * SECURITY UPDATE: Padding oracle in AES-NI CBC MAC check
    - debian/patches/CVE-2016-2107.patch: check that there are enough
      padding characters in crypto/evp/e_aes_cbc_hmac_sha1.c,
    - CVE-2016-2107
  * SECURITY UPDATE: Memory corruption in the ASN.1 encoder
    - debian/patches/CVE-2016-2108.patch: fix ASN1_INTEGER handling in
      crypto/asn1/a_type.c, crypto/asn1/asn1.h, crypto/asn1/tasn_dec.c,
    - CVE-2016-2108
  * SECURITY UPDATE: ASN.1 BIO excessive memory allocation
    - debian/patches/CVE-2016-2109.patch: properly handle large amounts of
      data in crypto/asn1/a_d2i_fp.c.
    - CVE-2016-2109

14fa245... by Joy Latten on 2016-04-15

Import patches-unapplied version 1.0.2g-1ubuntu4 to ubuntu/xenial-proposed

Imported using git-ubuntu import.

Changelog parent: 9b2692b08da4c3020f767d2b1aba1ba2253486b0

New changelog entries:
  * Rename Fedora-imported FIPS patches to the names they have in Fedora, add
    correct "Origin:" tags, and move Ubuntu modifications in them into

9b2692b... by Joy Latten on 2016-04-12

Import patches-unapplied version 1.0.2g-1ubuntu3 to ubuntu/xenial-proposed

Imported using git-ubuntu import.

Changelog parent: 1e163a288c9b5f03084c6dc376adef27f98eed31

New changelog entries:
  * Add fips support to openssl, LP: #1553309
    - debian/patches/openssl-1.0.2g-fips.patch: [PATCH 1/6] Add selftest, fips
      support, crypto compliance and define OPENSSL_FIPS.
    - debian/patches/openssl-1.0.2g-fips-ec.patch: [PATCH 2/6] Add fips compliance
      for EC curves.
    - debian/patches/openssl-1.0.2g-fips-md5-allow.patch: [PATCH 3/6] Allow md5 in
      fips mode.
    - debian/patches/openssl-1.0.2g-fips-ctor.patch: [PATCH 4/6] Re-factor integrity
      check for fips mode.
    - debian/patches/openssl-1.0.2g-new-fips-reqs.patch: [PATCH 5/6] New fips
    - debian/patches/openssl-1.0.2g-ubuntu-fips-cleanup.patch: [PATCH 6/6] Cleanup
      compiler warnings, use upstream error codes, DSA, DSA2, fips_utl.h; add
      additional upstream tests to fips_test_suite; allow all EC curves.