CVSROOT: /cvs
Module name: ports
Changes by: [email protected] 2023/05/30 08:07:38
Modified files:
security/openssl/3.0: Makefile distinfo
security/openssl/3.0/patches:
patch-Configurations_unix-Makefile_tmpl
patch-apps_rehash_c
patch-crypto_ec_asm_ecp_nistz256-armv8_pl
patch-crypto_modes_asm_aes-gcm-armv8_64_pl
security/openssl/3.0/pkg: PLIST
Removed files:
security/openssl/3.0/patches: patch-crypto_bn_build_info
patch-crypto_rsa_rsa_ossl_c
Log message:
Update to OpenSSL 3.0.9
This includes a fix for quadratic time OID pretty printing (CVE-2023-2650)
and a fix for a buffer overread in AES-XTS decryption on arm64 (CVE-2023-1255).
Then there are two fixes for the policy madness in RFC 5280 which mitigate
the exponential growth of the policy tree by imposing a compile-time limit
of 1000 nodes (CVE-2023-0464) and a parsing issue with invalid certificate
policies in leaf certificates (CVE-2023-0465). Moreover, there is a
documentation change for X509_VERIFY_PARAM_add0_policy() explaining that it
doesn't enable policy checking contrary to the set1 version (CVE-2023-0466).
Notably, this update reverts the "mongomery fix" for the RSA padding oracle
(CVE-2022-4304) and includes a different curly thing (where the actual fix is
hoisting the blinding a couple of lines), but at least it no longer involves
700 lines of garbage code that does things already done elsewhere in the lib.
This allows us to remove the patches that neutered this insanity. Of course,
the reason for the revert was performance...
Minor bump due to symbol addition
https://www.openssl.org/news/vulnerabilities.html
