From e3c9096077131ac7b69a9126781a2bdf623b4540f85694b472d56939f6427f5a Mon Sep 17 00:00:00 2001 From: Daniel Molkentin Date: Wed, 12 Apr 2017 14:18:22 +0000 Subject: [PATCH 1/4] Accepting request 487344 from KDE:Qt - Update to 1.10.16 * Fix a bug in X509 DN string comparisons that could result in out of bound reads. This could result in information leakage, denial of service, or potentially incorrect certificate validation results. (CVE-2017-2801) * Avoid use of C++11 std::to_string in some code added in 1.10.14 (GH #747 #834) - Changes from 1.10.15: * Change an unintended behavior of 2.0.0, which named the include directory botan-2.0. Since future release of Botan-2 should be compatible with code written against old versions, there does not seem to be any reason to * version the include directory with the minor number. (GH #830 #833) * Fix a bug which caused an error when building on Cygwin or other platforms where shared libraries are not supported. (GH #821) * Enable use of readdir on Cygwin, which allows the tests to run (GH #824) * Switch to readthedocs Sphinx theme by default (GH #822 #823) OBS-URL: https://build.opensuse.org/request/show/487344 OBS-URL: https://build.opensuse.org/package/show/devel:libraries:c_c++/Botan?expand=0&rev=64 --- Botan-1.10.14.tgz | 3 --- Botan-1.10.14.tgz.asc | 11 ----------- Botan-1.10.16.tgz | 3 +++ Botan-1.10.16.tgz.asc | 11 +++++++++++ Botan.changes | 19 +++++++++++++++++++ Botan.spec | 4 ++-- 6 files changed, 35 insertions(+), 16 deletions(-) delete mode 100644 Botan-1.10.14.tgz delete mode 100644 Botan-1.10.14.tgz.asc create mode 100644 Botan-1.10.16.tgz create mode 100644 Botan-1.10.16.tgz.asc diff --git a/Botan-1.10.14.tgz b/Botan-1.10.14.tgz deleted file mode 100644 index 3dfd944..0000000 --- a/Botan-1.10.14.tgz +++ /dev/null @@ -1,3 +0,0 @@ -version https://git-lfs.github.com/spec/v1 -oid sha256:10ed0b394db165733ac9557d8656356b7e9744d38c61c2b9c44cba6d84ff4c1c -size 2710757 diff --git a/Botan-1.10.14.tgz.asc b/Botan-1.10.14.tgz.asc deleted file mode 100644 index 60b4cee..0000000 --- a/Botan-1.10.14.tgz.asc +++ /dev/null @@ -1,11 +0,0 @@ ------BEGIN PGP SIGNATURE----- - -iQEzBAABCAAdFiEEYh2vZBHhhRxM+aLhYhHr8e+637wFAlg8DKMACgkQYhHr8e+6 -37xl/gf+OoUkiVu7Mi+UvOozBoQ8k9KPrj+afhTPlSgpXJHLhrtm7k1JMyGFzYJf -PwEUEI2POI5SQ6sEX++MhN09XYQDle3LWEwsgBmZh0aoIr+3aYHNKgH6U3FjLT6t -B0gk7RWygEDbm8NGdxqWducHrFdLR/MVSuYjuX4zgOjR0Nr69pimdjAGc1r4KH/3 -EHrSnSFeMMWqfN0CShQg30gp00et4P7rWo4NLNXVigkVif0TvQ4dAVejWr8UWkKN -OId+XTfngj7ynpQnkBfUZ7O9N+ybbaiLaKaEbn1xN5WwFIqYt8DeUcX3RjOT11eF -XbMK5bJDzcpE2+crlXodw8B6KkqY7A== -=e8ta ------END PGP SIGNATURE----- diff --git a/Botan-1.10.16.tgz b/Botan-1.10.16.tgz new file mode 100644 index 0000000..924384b --- /dev/null +++ b/Botan-1.10.16.tgz @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:6c5472401d06527e87adcb53dd270f3c9b1fb688703b04dd7a7cfb86289efe52 +size 2711177 diff --git a/Botan-1.10.16.tgz.asc b/Botan-1.10.16.tgz.asc new file mode 100644 index 0000000..95151a9 --- /dev/null +++ b/Botan-1.10.16.tgz.asc @@ -0,0 +1,11 @@ +-----BEGIN PGP SIGNATURE----- + +iQEzBAABCAAdFiEEYh2vZBHhhRxM+aLhYhHr8e+637wFAljkQzcACgkQYhHr8e+6 +37zwOAf9G0+rAaNoq5K9m4LZq4A1jP1B4HBsrddLu0PFCCDD8usYNTJkSUhoVTTt +BZqFa9NK8+NV/cELnRiiVw1mvMCN981tzl2rBiE6yw3CrfvuLYGX21Vc3RNIIjYs +rdH5oIvRP7C7zmRP3uuybFefsI6XXUVppjFcP6N14zDNXQxl2eoW9LZbxl0m28Dp +tMum3qSIaQemcJzOpfoXYW1A/Q3Rz8Wh3Xh1Jfjm8kUY9GOGtf9vQwO8Jb4jn9kJ +ftyoDlBWMQAgPd3DXKx/tfn7YcshbgmCW6lrqrwMIz84ESqkqZt8h/olPrJK/8tO +cdPl7ovtfSfQXWRJzAL3ehF1HeKZVg== +=EDPN +-----END PGP SIGNATURE----- diff --git a/Botan.changes b/Botan.changes index bff31e7..1bb98e9 100644 --- a/Botan.changes +++ b/Botan.changes @@ -1,3 +1,22 @@ +------------------------------------------------------------------- +Tue Apr 11 11:57:53 UTC 2017 - daniel.molkentin@suse.com + +- Update to 1.10.16 + * Fix a bug in X509 DN string comparisons that could result in out of bound + reads. This could result in information leakage, denial of service, or + potentially incorrect certificate validation results. (CVE-2017-2801) + * Avoid use of C++11 std::to_string in some code added in 1.10.14 (GH #747 #834) +- Changes from 1.10.15: + * Change an unintended behavior of 2.0.0, which named the include directory + botan-2.0. Since future release of Botan-2 should be compatible with code + written against old versions, there does not seem to be any reason to + * version the include directory with the minor number. (GH #830 #833) + * Fix a bug which caused an error when building on Cygwin or other platforms + where shared libraries are not supported. (GH #821) + * Enable use of readdir on Cygwin, which allows the tests to run (GH #824) + * Switch to readthedocs Sphinx theme by default (GH #822 #823) + + ------------------------------------------------------------------- Wed Dec 28 12:02:11 CET 2016 - pth@suse.de diff --git a/Botan.spec b/Botan.spec index 77f7727..3d324b4 100644 --- a/Botan.spec +++ b/Botan.spec @@ -1,7 +1,7 @@ # # spec file for package Botan # -# Copyright (c) 2016 SUSE LINUX GmbH, Nuernberg, Germany. +# Copyright (c) 2017 SUSE LINUX GmbH, Nuernberg, Germany. # # All modifications and additions to the file contributed by third parties # remain the property of their copyright owners, unless otherwise agreed @@ -19,7 +19,7 @@ %define version_suffix 1_10-1 %define short_version 1.10 Name: Botan -Version: 1.10.14 +Version: 1.10.16 Release: 0 Summary: A C++ Crypto Library License: BSD-2-Clause From 9ab8e8e4503910cb58649abe6013b7b7f1023be7575b259900a081ebcf17d32d Mon Sep 17 00:00:00 2001 From: Daniel Molkentin Date: Wed, 12 Apr 2017 15:18:32 +0000 Subject: [PATCH 2/4] Accepting request 487615 from home:dmolkentin:branches:devel:libraries:c_c++ - Add patch to build SLES11 (allows for simplified backporting, e.g. bsc#968030) - Clean up spec file - Update to 1.10.16 (bsc#1013209, bsc#974521, bsc#968030, bsc#968026, bsc#968025, bsc#965621, bsc#965620) OBS-URL: https://build.opensuse.org/request/show/487615 OBS-URL: https://build.opensuse.org/package/show/devel:libraries:c_c++/Botan?expand=0&rev=65 --- Botan.changes | 10 ++++++++-- Botan.spec | 7 +++++-- no-cpuid-header.patch | 13 +++++++++++++ 3 files changed, 26 insertions(+), 4 deletions(-) create mode 100644 no-cpuid-header.patch diff --git a/Botan.changes b/Botan.changes index 1bb98e9..556f33a 100644 --- a/Botan.changes +++ b/Botan.changes @@ -1,7 +1,14 @@ +------------------------------------------------------------------- +Wed Apr 12 14:52:45 UTC 2017 - daniel.molkentin@suse.com + +- Add patch to build SLES11 (allows for simplified backporting, e.g. bsc#968030) +- Clean up spec file + ------------------------------------------------------------------- Tue Apr 11 11:57:53 UTC 2017 - daniel.molkentin@suse.com -- Update to 1.10.16 +- Update to 1.10.16 (bsc#1013209, bsc#974521, bsc#968030, bsc#968026, + bsc#968025, bsc#965621, bsc#965620) * Fix a bug in X509 DN string comparisons that could result in out of bound reads. This could result in information leakage, denial of service, or potentially incorrect certificate validation results. (CVE-2017-2801) @@ -16,7 +23,6 @@ Tue Apr 11 11:57:53 UTC 2017 - daniel.molkentin@suse.com * Enable use of readdir on Cygwin, which allows the tests to run (GH #824) * Switch to readthedocs Sphinx theme by default (GH #822 #823) - ------------------------------------------------------------------- Wed Dec 28 12:02:11 CET 2016 - pth@suse.de diff --git a/Botan.spec b/Botan.spec index 3d324b4..65d0628 100644 --- a/Botan.spec +++ b/Botan.spec @@ -37,9 +37,9 @@ Patch6: Botan-fix_pkgconfig.patch Patch7: dont-set-mach-value.diff Patch8: aarch64-support.patch Patch9: ppc64le-support.patch +Patch10: no-cpuid-header.patch BuildRequires: bzip2 >= 1.0.2 BuildRequires: gcc-c++ -BuildRequires: gmp-devel BuildRequires: gmp-devel >= 4.1 BuildRequires: libbz2-devel BuildRequires: openssl-devel @@ -71,7 +71,7 @@ supported, including RSA, DSA, DES, AES, MD5, and SHA-1. %define botan_docdir %{_docdir}/%{name}-%{version} Summary: Development files for Botan Group: Development/Libraries/C and C++ -Requires: gmp-devel +Requires: gmp-devel >= 4.1 Requires: libbotan-%{version_suffix} = %{version} Requires: libbz2-devel Provides: Botan-devel = %{version} @@ -91,6 +91,9 @@ programs that use the Botan library. %patch7 -p1 %patch8 %patch9 +%if 0%{?suse_version} == 1110 +%patch10 -p1 +%endif %build export RPM_OPT_FLAGS diff --git a/no-cpuid-header.patch b/no-cpuid-header.patch new file mode 100644 index 0000000..5285208 --- /dev/null +++ b/no-cpuid-header.patch @@ -0,0 +1,13 @@ +diff --git a/src/utils/cpuid.cpp b/src/utils/cpuid.cpp +index f6581f09c..ae087fac3 100644 +--- a/src/utils/cpuid.cpp ++++ b/src/utils/cpuid.cpp +@@ -36,7 +36,7 @@ + #include + #define CALL_CPUID(type, out) do { __cpuid(out, type); } while(0) + +-#elif defined(BOTAN_BUILD_COMPILER_IS_GCC) && (BOTAN_GCC_VERSION >= 430) ++#elif defined(BOTAN_BUILD_COMPILER_IS_GCC) && 0 + + // Only available starting in GCC 4.3 + #include From 54747791d56d872317d98dee5c06594c934c30953019c60d7737fe552f8bdbb1 Mon Sep 17 00:00:00 2001 From: Daniel Molkentin Date: Wed, 12 Apr 2017 15:37:33 +0000 Subject: [PATCH 3/4] Accepting request 487618 from home:dmolkentin:branches:devel:libraries:c_c++ Add missing patch reference to changelog OBS-URL: https://build.opensuse.org/request/show/487618 OBS-URL: https://build.opensuse.org/package/show/devel:libraries:c_c++/Botan?expand=0&rev=66 --- Botan.changes | 1 + 1 file changed, 1 insertion(+) diff --git a/Botan.changes b/Botan.changes index 556f33a..3641a9c 100644 --- a/Botan.changes +++ b/Botan.changes @@ -2,6 +2,7 @@ Wed Apr 12 14:52:45 UTC 2017 - daniel.molkentin@suse.com - Add patch to build SLES11 (allows for simplified backporting, e.g. bsc#968030) + * add no-cpuid-header.patch - Clean up spec file ------------------------------------------------------------------- From dc7ebce1b7e855a4be51f31c94e8c74069be23159f32b8092ceb119432d5b379 Mon Sep 17 00:00:00 2001 From: Daniel Molkentin Date: Thu, 13 Apr 2017 14:11:35 +0000 Subject: [PATCH 4/4] Accepting request 487836 from home:dmolkentin:branches:devel:libraries:c_c++ - Update to 1.10.16 (Fixes CVE-2017-2801, bsc#1033605) OBS-URL: https://build.opensuse.org/request/show/487836 OBS-URL: https://build.opensuse.org/package/show/devel:libraries:c_c++/Botan?expand=0&rev=67 --- Botan.changes | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/Botan.changes b/Botan.changes index 3641a9c..dac04e2 100644 --- a/Botan.changes +++ b/Botan.changes @@ -8,8 +8,7 @@ Wed Apr 12 14:52:45 UTC 2017 - daniel.molkentin@suse.com ------------------------------------------------------------------- Tue Apr 11 11:57:53 UTC 2017 - daniel.molkentin@suse.com -- Update to 1.10.16 (bsc#1013209, bsc#974521, bsc#968030, bsc#968026, - bsc#968025, bsc#965621, bsc#965620) +- Update to 1.10.16 (Fixes CVE-2017-2801, bsc#1033605) * Fix a bug in X509 DN string comparisons that could result in out of bound reads. This could result in information leakage, denial of service, or potentially incorrect certificate validation results. (CVE-2017-2801)