summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
Diffstat
-rw-r--r--security/openssl-devel/Makefile3
-rw-r--r--security/openssl-devel/distinfo6
-rw-r--r--security/openssl-devel/files/patch-CVE-2018-073239
-rw-r--r--security/openssl-devel/files/patch-CVE-2018-703727
-rw-r--r--security/openssl-devel/pkg-plist44
5 files changed, 45 insertions, 74 deletions
diff --git a/security/openssl-devel/Makefile b/security/openssl-devel/Makefile
index 07ef24c50430..e0fbfb0efaa3 100644
--- a/security/openssl-devel/Makefile
+++ b/security/openssl-devel/Makefile
@@ -2,8 +2,7 @@
# $FreeBSD$
PORTNAME= openssl
-PORTVERSION= 1.1.0h
-PORTREVISION= 2
+PORTVERSION= 1.1.0i
CATEGORIES= security devel
MASTER_SITES= https://www.openssl.org/source/ \
ftp://ftp.cert.dfn.de/pub/tools/net/openssl/source/
diff --git a/security/openssl-devel/distinfo b/security/openssl-devel/distinfo
index aad60dbcdc78..412680cd2c8f 100644
--- a/security/openssl-devel/distinfo
+++ b/security/openssl-devel/distinfo
@@ -1,3 +1,3 @@
-TIMESTAMP = 1522162483
-SHA256 (openssl-1.1.0h.tar.gz) = 5835626cde9e99656585fc7aaa2302a73a7e1340bf8c14fd635a62c66802a517
-SIZE (openssl-1.1.0h.tar.gz) = 5422717
+TIMESTAMP = 1534254208
+SHA256 (openssl-1.1.0i.tar.gz) = ebbfc844a8c8cc0ea5dc10b86c9ce97f401837f3fa08c17b2cdadc118253cf99
+SIZE (openssl-1.1.0i.tar.gz) = 5453234
diff --git a/security/openssl-devel/files/patch-CVE-2018-0732 b/security/openssl-devel/files/patch-CVE-2018-0732
deleted file mode 100644
index ccc444c8bf5c..000000000000
--- a/security/openssl-devel/files/patch-CVE-2018-0732
+++ /dev/null
@@ -1,39 +0,0 @@
-From ea7abeeabf92b7aca160bdd0208636d4da69f4f4 Mon Sep 17 00:00:00 2001
-From: Guido Vranken <guidovranken@gmail.com>
-Date: Mon, 11 Jun 2018 19:38:54 +0200
-Subject: [PATCH] Reject excessively large primes in DH key generation.
-
-CVE-2018-0732
-
-Signed-off-by: Guido Vranken <guidovranken@gmail.com>
-
-(cherry picked from commit 91f7361f47b082ae61ffe1a7b17bb2adf213c7fe)
-
-Reviewed-by: Tim Hudson <tjh@openssl.org>
-Reviewed-by: Matt Caswell <matt@openssl.org>
-(Merged from https://github.com/openssl/openssl/pull/6457)
----
- crypto/dh/dh_key.c | 7 ++++++-
- 1 file changed, 6 insertions(+), 1 deletion(-)
-
-diff --git a/crypto/dh/dh_key.c b/crypto/dh/dh_key.c
-index fce9ff47f36..58003d70878 100644
---- crypto/dh/dh_key.c.orig
-+++ crypto/dh/dh_key.c
-@@ -78,10 +78,15 @@ static int generate_key(DH *dh)
- int ok = 0;
- int generate_new_key = 0;
- unsigned l;
-- BN_CTX *ctx;
-+ BN_CTX *ctx = NULL;
- BN_MONT_CTX *mont = NULL;
- BIGNUM *pub_key = NULL, *priv_key = NULL;
-
-+ if (BN_num_bits(dh->p) > OPENSSL_DH_MAX_MODULUS_BITS) {
-+ DHerr(DH_F_GENERATE_KEY, DH_R_MODULUS_TOO_LARGE);
-+ return 0;
-+ }
-+
- ctx = BN_CTX_new();
- if (ctx == NULL)
- goto err;
diff --git a/security/openssl-devel/files/patch-CVE-2018-7037 b/security/openssl-devel/files/patch-CVE-2018-7037
deleted file mode 100644
index fb2c5a176031..000000000000
--- a/security/openssl-devel/files/patch-CVE-2018-7037
+++ /dev/null
@@ -1,27 +0,0 @@
-From 6939eab03a6e23d2bd2c3f5e34fe1d48e542e787 Mon Sep 17 00:00:00 2001
-From: Billy Brumley <bbrumley@gmail.com>
-Date: Wed, 11 Apr 2018 10:10:58 +0300
-Subject: [PATCH] RSA key generation: ensure BN_mod_inverse and BN_mod_exp_mont
- both get called with BN_FLG_CONSTTIME flag set.
-
-CVE-2018-0737
-
-Reviewed-by: Rich Salz <rsalz@openssl.org>
-Reviewed-by: Matt Caswell <matt@openssl.org>
----
- crypto/rsa/rsa_gen.c | 2 ++
- 1 file changed, 2 insertions(+)
-
-diff --git a/crypto/rsa/rsa_gen.c b/crypto/rsa/rsa_gen.c
-index 9af43e05863..79f77e3eafd 100644
---- crypto/rsa/rsa_gen.c.orig
-+++ crypto/rsa/rsa_gen.c
-@@ -89,6 +89,8 @@ static int rsa_builtin_keygen(RSA *rsa, int bits, BIGNUM *e_value,
- if (BN_copy(rsa->e, e_value) == NULL)
- goto err;
-
-+ BN_set_flags(rsa->p, BN_FLG_CONSTTIME);
-+ BN_set_flags(rsa->q, BN_FLG_CONSTTIME);
- BN_set_flags(r2, BN_FLG_CONSTTIME);
- /* generate p and q */
- for (;;) {
diff --git a/security/openssl-devel/pkg-plist b/security/openssl-devel/pkg-plist
index 227a7fcfd297..cd7f68505bbd 100644
--- a/security/openssl-devel/pkg-plist
+++ b/security/openssl-devel/pkg-plist
@@ -598,9 +598,9 @@ man/man1/x509.1.gz
%%MAN3%%man/man3/BN_value_one.3.gz
%%MAN3%%man/man3/BN_with_flags.3.gz
%%MAN3%%man/man3/BN_zero.3.gz
+%%MAN3%%man/man3/BUF_MEM_free.3.gz
%%MAN3%%man/man3/BUF_MEM_grow.3.gz
%%MAN3%%man/man3/BUF_MEM_grow_clean.3.gz
-%%MAN3%%man/man3/BUF_MEM_free.3.gz
%%MAN3%%man/man3/BUF_MEM_new.3.gz
%%MAN3%%man/man3/BUF_MEM_new_ex.3.gz
%%MAN3%%man/man3/BUF_reverse.3.gz
@@ -978,7 +978,6 @@ man/man1/x509.1.gz
%%MAN3%%man/man3/EC_KEY_get_enc_flags.3.gz
%%MAN3%%man/man3/EC_KEY_get_ex_data.3.gz
%%MAN3%%man/man3/EC_KEY_get_ex_new_index.3.gz
-%%MAN3%%man/man3/EC_KEY_set_ex_data.3.gz
%%MAN3%%man/man3/EC_KEY_get_flags.3.gz
%%MAN3%%man/man3/EC_KEY_get_method.3.gz
%%MAN3%%man/man3/EC_KEY_key2buf.3.gz
@@ -992,6 +991,7 @@ man/man1/x509.1.gz
%%MAN3%%man/man3/EC_KEY_set_asn1_flag.3.gz
%%MAN3%%man/man3/EC_KEY_set_conv_form.3.gz
%%MAN3%%man/man3/EC_KEY_set_enc_flags.3.gz
+%%MAN3%%man/man3/EC_KEY_set_ex_data.3.gz
%%MAN3%%man/man3/EC_KEY_set_flags.3.gz
%%MAN3%%man/man3/EC_KEY_set_group.3.gz
%%MAN3%%man/man3/EC_KEY_set_method.3.gz
@@ -1270,13 +1270,17 @@ man/man1/x509.1.gz
%%MAN3%%man/man3/EVP_EncryptInit_ex.3.gz
%%MAN3%%man/man3/EVP_EncryptUpdate.3.gz
%%MAN3%%man/man3/EVP_MD_CTX_block_size.3.gz
+%%MAN3%%man/man3/EVP_MD_CTX_clear_flags.3.gz
%%MAN3%%man/man3/EVP_MD_CTX_copy.3.gz
%%MAN3%%man/man3/EVP_MD_CTX_copy_ex.3.gz
%%MAN3%%man/man3/EVP_MD_CTX_free.3.gz
%%MAN3%%man/man3/EVP_MD_CTX_md.3.gz
+%%MAN3%%man/man3/EVP_MD_CTX_md_data.3.gz
%%MAN3%%man/man3/EVP_MD_CTX_new.3.gz
%%MAN3%%man/man3/EVP_MD_CTX_reset.3.gz
+%%MAN3%%man/man3/EVP_MD_CTX_set_flags.3.gz
%%MAN3%%man/man3/EVP_MD_CTX_size.3.gz
+%%MAN3%%man/man3/EVP_MD_CTX_test_flags.3.gz
%%MAN3%%man/man3/EVP_MD_CTX_type.3.gz
%%MAN3%%man/man3/EVP_MD_block_size.3.gz
%%MAN3%%man/man3/EVP_MD_meth_dup.3.gz
@@ -1449,8 +1453,8 @@ man/man1/x509.1.gz
%%MAN3%%man/man3/EVP_cast5_cfb.3.gz
%%MAN3%%man/man3/EVP_cast5_ecb.3.gz
%%MAN3%%man/man3/EVP_cast5_ofb.3.gz
-%%MAN3%%man/man3/EVP_chacha20_poly1305.3.gz
%%MAN3%%man/man3/EVP_chacha20.3.gz
+%%MAN3%%man/man3/EVP_chacha20_poly1305.3.gz
%%MAN3%%man/man3/EVP_cleanup.3.gz
%%MAN3%%man/man3/EVP_des_cbc.3.gz
%%MAN3%%man/man3/EVP_des_cfb.3.gz
@@ -1613,6 +1617,7 @@ man/man1/x509.1.gz
%%MAN3%%man/man3/OCSP_SINGLERESP_free.3.gz
%%MAN3%%man/man3/OCSP_SINGLERESP_new.3.gz
%%MAN3%%man/man3/OCSP_basic_add1_nonce.3.gz
+%%MAN3%%man/man3/OCSP_basic_verify.3.gz
%%MAN3%%man/man3/OCSP_cert_id_new.3.gz
%%MAN3%%man/man3/OCSP_cert_to_id.3.gz
%%MAN3%%man/man3/OCSP_check_nonce.3.gz
@@ -2349,6 +2354,7 @@ man/man1/x509.1.gz
%%MAN3%%man/man3/SSL_get_selected_srtp_profile.3.gz
%%MAN3%%man/man3/SSL_get_server_random.3.gz
%%MAN3%%man/man3/SSL_get_session.3.gz
+%%MAN3%%man/man3/SSL_get_shared_ciphers.3.gz
%%MAN3%%man/man3/SSL_get_shared_curve.3.gz
%%MAN3%%man/man3/SSL_get_shared_sigalgs.3.gz
%%MAN3%%man/man3/SSL_get_shutdown.3.gz
@@ -2636,8 +2642,36 @@ man/man1/x509.1.gz
%%MAN3%%man/man3/X509_EXTENSION_set_critical.3.gz
%%MAN3%%man/man3/X509_EXTENSION_set_data.3.gz
%%MAN3%%man/man3/X509_EXTENSION_set_object.3.gz
+%%MAN3%%man/man3/X509_LOOKUP_ctrl_fn.3.gz
%%MAN3%%man/man3/X509_LOOKUP_file.3.gz
+%%MAN3%%man/man3/X509_LOOKUP_get_by_alias_fn.3.gz
+%%MAN3%%man/man3/X509_LOOKUP_get_by_fingerprint_fn.3.gz
+%%MAN3%%man/man3/X509_LOOKUP_get_by_issuer_serial_fn.3.gz
+%%MAN3%%man/man3/X509_LOOKUP_get_by_subject_fn.3.gz
+%%MAN3%%man/man3/X509_LOOKUP_get_method_data.3.gz
+%%MAN3%%man/man3/X509_LOOKUP_get_store.3.gz
%%MAN3%%man/man3/X509_LOOKUP_hash_dir.3.gz
+%%MAN3%%man/man3/X509_LOOKUP_meth_free.3.gz
+%%MAN3%%man/man3/X509_LOOKUP_meth_get_ctrl.3.gz
+%%MAN3%%man/man3/X509_LOOKUP_meth_get_free.3.gz
+%%MAN3%%man/man3/X509_LOOKUP_meth_get_get_by_alias.3.gz
+%%MAN3%%man/man3/X509_LOOKUP_meth_get_get_by_fingerprint.3.gz
+%%MAN3%%man/man3/X509_LOOKUP_meth_get_get_by_issuer_serial.3.gz
+%%MAN3%%man/man3/X509_LOOKUP_meth_get_get_by_subject.3.gz
+%%MAN3%%man/man3/X509_LOOKUP_meth_get_init.3.gz
+%%MAN3%%man/man3/X509_LOOKUP_meth_get_new_item.3.gz
+%%MAN3%%man/man3/X509_LOOKUP_meth_get_shutdown.3.gz
+%%MAN3%%man/man3/X509_LOOKUP_meth_new.3.gz
+%%MAN3%%man/man3/X509_LOOKUP_meth_set_ctrl.3.gz
+%%MAN3%%man/man3/X509_LOOKUP_meth_set_free.3.gz
+%%MAN3%%man/man3/X509_LOOKUP_meth_set_get_by_alias.3.gz
+%%MAN3%%man/man3/X509_LOOKUP_meth_set_get_by_fingerprint.3.gz
+%%MAN3%%man/man3/X509_LOOKUP_meth_set_get_by_issuer_serial.3.gz
+%%MAN3%%man/man3/X509_LOOKUP_meth_set_get_by_subject.3.gz
+%%MAN3%%man/man3/X509_LOOKUP_meth_set_init.3.gz
+%%MAN3%%man/man3/X509_LOOKUP_meth_set_new_item.3.gz
+%%MAN3%%man/man3/X509_LOOKUP_meth_set_shutdown.3.gz
+%%MAN3%%man/man3/X509_LOOKUP_set_method_data.3.gz
%%MAN3%%man/man3/X509_NAME_ENTRY_create_by_NID.3.gz
%%MAN3%%man/man3/X509_NAME_ENTRY_create_by_OBJ.3.gz
%%MAN3%%man/man3/X509_NAME_ENTRY_create_by_txt.3.gz
@@ -2668,6 +2702,8 @@ man/man1/x509.1.gz
%%MAN3%%man/man3/X509_NAME_print.3.gz
%%MAN3%%man/man3/X509_NAME_print_ex.3.gz
%%MAN3%%man/man3/X509_NAME_print_ex_fp.3.gz
+%%MAN3%%man/man3/X509_OBJECT_set1_X509.3.gz
+%%MAN3%%man/man3/X509_OBJECT_set1_X509_CRL.3.gz
%%MAN3%%man/man3/X509_PUBKEY_free.3.gz
%%MAN3%%man/man3/X509_PUBKEY_get.3.gz
%%MAN3%%man/man3/X509_PUBKEY_get0.3.gz
@@ -2813,6 +2849,7 @@ man/man1/x509.1.gz
%%MAN3%%man/man3/X509_VERIFY_PARAM_get_auth_level.3.gz
%%MAN3%%man/man3/X509_VERIFY_PARAM_get_depth.3.gz
%%MAN3%%man/man3/X509_VERIFY_PARAM_get_flags.3.gz
+%%MAN3%%man/man3/X509_VERIFY_PARAM_get_hostflags.3.gz
%%MAN3%%man/man3/X509_VERIFY_PARAM_get_inh_flags.3.gz
%%MAN3%%man/man3/X509_VERIFY_PARAM_get_time.3.gz
%%MAN3%%man/man3/X509_VERIFY_PARAM_set1_email.3.gz
@@ -2837,6 +2874,7 @@ man/man1/x509.1.gz
%%MAN3%%man/man3/X509_check_ip.3.gz
%%MAN3%%man/man3/X509_check_ip_asc.3.gz
%%MAN3%%man/man3/X509_check_issued.3.gz
+%%MAN3%%man/man3/X509_cmp_time.3.gz
%%MAN3%%man/man3/X509_delete_ext.3.gz
%%MAN3%%man/man3/X509_digest.3.gz
%%MAN3%%man/man3/X509_dup.3.gz
generated by cgit v1.2.3 (git 2.25.1) at 2025-12-08 21:35:29 +0000