ubuntu/+source/openssl:ubuntu/xenial-updates

Last commit made on 2019-02-27
Get this branch:
git clone -b ubuntu/xenial-updates https://git.launchpad.net/ubuntu/+source/openssl
Members of Ubuntu Server Dev import team can upload to this branch. Log in for directions.

Branch merges

Branch information

Name:
ubuntu/xenial-updates
Repository:
lp:ubuntu/+source/openssl

Recent commits

5c2d844... by Marc Deslauriers on 2019-02-26

Import patches-unapplied version 1.0.2g-1ubuntu4.15 to ubuntu/xenial-security

Imported using git-ubuntu import.

Changelog parent: 4f5ecf626e184aa5cef3ec4e57ed838129d1f2cd

New changelog entries:
  * SECURITY UPDATE: 0-byte record padding oracle
    - debian/patches/CVE-2019-1559.patch: go into the error state if a
      fatal alert is sent or received in ssl/d1_pkt.c, ssl/s3_pkt.c.
    - CVE-2019-1559

4f5ecf6... by Marc Deslauriers on 2018-12-04

Import patches-unapplied version 1.0.2g-1ubuntu4.14 to ubuntu/xenial-security

Imported using git-ubuntu import.

Changelog parent: 707d8c89df85e7455bea9fb5d350267d5beb1bfb

New changelog entries:
  * SECURITY UPDATE: PortSmash side channel attack
    - debian/patches/CVE-2018-5407.patch: fix timing vulnerability in
      crypto/bn/bn_lib.c, crypto/ec/ec_mult.c.
    - CVE-2018-5407
  * SECURITY UPDATE: timing side channel attack in DSA
    - debian/patches/CVE-2018-0734-pre1.patch: address a timing side
      channel in crypto/dsa/dsa_ossl.c.
    - debian/patches/CVE-2018-0734-1.patch: fix timing vulnerability in
      crypto/dsa/dsa_ossl.c.
    - debian/patches/CVE-2018-0734-2.patch: fix mod inverse in
      crypto/dsa/dsa_ossl.c.
    - debian/patches/CVE-2018-0734-3.patch: add a constant time flag in
      crypto/dsa/dsa_ossl.c.
    - CVE-2018-0734

707d8c8... by Marc Deslauriers on 2018-06-20

Import patches-unapplied version 1.0.2g-1ubuntu4.13 to ubuntu/xenial-security

Imported using git-ubuntu import.

Changelog parent: 4237557256f1f1491a9abf8cf1fa05178003fe6d

New changelog entries:
  * SECURITY UPDATE: ECDSA key extraction side channel
    - debian/patches/CVE-2018-0495.patch: add blinding to an ECDSA
      signature in crypto/ecdsa/ecdsatest.c, crypto/ecdsa/ecs_ossl.c.
    - CVE-2018-0495
  * SECURITY UPDATE: denial of service via long prime values
    - debian/patches/CVE-2018-0732.patch: reject excessively large primes
      in DH key generation in crypto/dh/dh_key.c.
    - CVE-2018-0732
  * SECURITY UPDATE: RSA cache timing side channel attack
    (previous update was incomplete)
    - debian/patches/CVE-2018-0737-1.patch: replaced variable-time GCD in
      crypto/rsa/rsa_gen.c.
    - debian/patches/CVE-2018-0737-2.patch: used ERR set/pop mark in
      crypto/rsa/rsa_gen.c.
    - debian/patches/CVE-2018-0737-3.patch: consttime flag changed in
      crypto/rsa/rsa_gen.c.
    - debian/patches/CVE-2018-0737-4.patch: ensure BN_mod_inverse and
      BN_mod_exp_mont both get called with BN_FLG_CONSTTIME flag set in
      crypto/rsa/rsa_gen.c.
    - CVE-2018-0737

4237557... by Leonidas S. Barbosa on 2018-04-18

Import patches-unapplied version 1.0.2g-1ubuntu4.12 to ubuntu/xenial-security

Imported using git-ubuntu import.

Changelog parent: bf26ab7d51bfafe6dab4761a1e6346f32688597e

New changelog entries:
  * SECURITY UPDATE: Cache timing side channel
    - debian/patches/CVE-2018-0737.patch: ensure BN_mod_inverse
      and BN_mod_exp_mont get called with BN_FLG_CONSTTIME flag set
      in crypto/rsa/rsa_gen.c.
    - CVE-2018-0737

bf26ab7... by Marc Deslauriers on 2018-03-27

Import patches-unapplied version 1.0.2g-1ubuntu4.11 to ubuntu/xenial-security

Imported using git-ubuntu import.

Changelog parent: 1ac129a8816d72815a0b2a5522d886b62b4a0d2d

New changelog entries:
  * SECURITY UPDATE: DoS via ASN.1 types with a recursive definition
    - debian/patches/CVE-2018-0739.patch: limit stack depth in
      crypto/asn1/asn1.h, crypto/asn1/asn1_err.c, crypto/asn1/tasn_dec.c.
    - CVE-2018-0739

1ac129a... by Marc Deslauriers on 2017-12-07

Import patches-unapplied version 1.0.2g-1ubuntu4.10 to ubuntu/xenial-security

Imported using git-ubuntu import.

Changelog parent: 17e0e5b0f418639a196f5989e97094501e7b73d2

New changelog entries:
  * SECURITY UPDATE: Read/write after SSL object in error state
    - debian/patches/CVE-2017-3737-pre.patch: add test/ssltestlib.*,
      add to test/Makefile.
    - debian/patches/CVE-2017-3737-1.patch: don't allow read/write after
      fatal error in ssl/ssl.h.
    - debian/patches/CVE-2017-3737-2.patch: add test to ssl/Makefile,
      ssl/fatalerrtest.c, test/Makefile.
    - CVE-2017-3737
  * SECURITY UPDATE: rsaz_1024_mul_avx2 overflow bug on x86_64
    - debian/patches/CVE-2017-3738.patch: fix digit correction bug in
      crypto/bn/asm/rsaz-avx2.pl.
    - CVE-2017-3738

17e0e5b... by Marc Deslauriers on 2017-11-02

Import patches-unapplied version 1.0.2g-1ubuntu4.9 to ubuntu/xenial-security

Imported using git-ubuntu import.

Changelog parent: 0ece36ad547a8902a6c31f99e0b07ad712f71ce1

New changelog entries:
  * SECURITY UPDATE: Malformed X.509 IPAddressFamily could cause OOB read
    - debian/patches/CVE-2017-3735.patch: avoid out-of-bounds read in
      crypto/x509v3/v3_addr.c.
    - CVE-2017-3735
  * SECURITY UPDATE: bn_sqrx8x_internal carry bug on x86_64
    - debian/patches/CVE-2017-3736.patch: fix carry bug in
      bn_sqrx8x_internal in crypto/bn/asm/x86_64-mont5.pl.
    - CVE-2017-3736

0ece36a... by William Grant on 2017-05-19

Import patches-unapplied version 1.0.2g-1ubuntu4.8 to ubuntu/xenial-proposed

Imported using git-ubuntu import.

Changelog parent: 2a85a4b041f42290f2106ca9a4f25c833a1f9c1b

New changelog entries:
  * aes/asm/aesni-sha*-x86_64.pl: fix IV handling in SHAEXT paths.
    (LP: #1674399)

2a85a4b... by Eric Desrochers on 2017-04-26

Import patches-unapplied version 1.0.2g-1ubuntu4.7 to ubuntu/xenial-proposed

Imported using git-ubuntu import.

Changelog parent: 1032d8539dfaa5f8039093fa7faa4899faaedcb0

New changelog entries:
  * crypto/x86*cpuid.pl: move extended feature detection. (LP: #1674399)
    This fix moves extended feature detection past basic feature
    detection where it belongs. 32-bit counterpart is harmonized too.

1032d85... by Marc Deslauriers on 2017-01-30

Import patches-unapplied version 1.0.2g-1ubuntu4.6 to ubuntu/xenial-security

Imported using git-ubuntu import.

Changelog parent: a0646a86573f359922893fc6aea2d2fb26f71abb

New changelog entries:
  * SECURITY UPDATE: Montgomery multiplication may produce incorrect
    results
    - debian/patches/CVE-2016-7055.patch: fix logic in
      crypto/bn/asm/x86_64-mont.pl.
    - CVE-2016-7055
  * SECURITY UPDATE: DoS via warning alerts
    - debian/patches/CVE-2016-8610.patch: don't allow too many consecutive
      warning alerts in ssl/d1_pkt.c, ssl/s3_pkt.c, ssl/ssl.h,
      ssl/ssl_locl.h.
    - debian/patches/CVE-2016-8610-2.patch: fail if an unrecognised record
      type is received in ssl/s3_pkt.c.
    - CVE-2016-8610
  * SECURITY UPDATE: Truncated packet could crash via OOB read
    - debian/patches/CVE-2017-3731.patch: harden RC4_MD5 cipher in
      crypto/evp/e_rc4_hmac_md5.c.
    - CVE-2017-3731
  * SECURITY UPDATE: BN_mod_exp may produce incorrect results on x86_64
    - debian/patches/CVE-2017-3732.patch: fix carry bug in
      bn_sqr8x_internal in crypto/bn/asm/x86_64-mont5.pl.
    - CVE-2017-3732