- Rename engines directories to the same name like in SLE:
/etc/ssl/engines1_1.d -> /etc/ssl/engines1.1.d
/etc/ssl/engdef1_1.d -> /etc/ssl/engdef1.1.d
* Add migration script to move files (bsc#1219562)
/etc/ssl/engines.d/* -> /etc/ssl/engines1.1.d
/etc/ssl/engdef.d/* -> /etc/ssl/engdef1.1.d
- Security fix: [bsc#1219243, CVE-2024-0727]
* Add NULL checks where ContentInfo data can be NULL
* Add openssl-CVE-2024-0727.patch
OBS-URL: https://build.opensuse.org/request/show/1144565
OBS-URL: https://build.opensuse.org/package/show/security:tls/openssl-1_1?expand=0&rev=156
- Because OpenSSL 1.1.1 is no longer default, let's rename engine
directories to contain version of OpenSSL and let unversioned for
the default OpenSSL. [bsc#1194187, bsc#1207472, bsc#1218933]
* /etc/ssl/engines.d -> /etc/ssl/engines1_1.d
* /etc/ssl/engdef.d -> /etc/ssl/engdef1_1.d
* Update patches:
- openssl-1_1-ossl-sli-002-ran-make-update.patch
- openssl-1_1-use-include-directive.patch
OBS-URL: https://build.opensuse.org/request/show/1141235
OBS-URL: https://build.opensuse.org/package/show/security:tls/openssl-1_1?expand=0&rev=154
- Security fix: [bsc#1192820, CVE-2002-20001]
* Fix DHEATER: The Diffie-Hellman Key Agreement Protocol allows
remote attackers (from the client side) to send arbitrary
numbers that are actually not public keys, and trigger
expensive server-side DHE calculation.
* Stop recommending the DHE in SSL_DEFAULT_SUSE_CIPHER_LIST
* Rebase openssl-DEFAULT_SUSE_cipher.patch
- Fix the engines section in /etc/ssl/openssl.cnf [bsc#1194187]
* In an INI-type file, the sections begin with a [section_name]
and they run until the next section begins.
* Rebase openssl-1_1-use-include-directive.patch
OBS-URL: https://build.opensuse.org/request/show/960455
OBS-URL: https://build.opensuse.org/package/show/security:tls/openssl-1_1?expand=0&rev=107
- Added openssl-1_1-use-include-directive.patch so that the default
/etc/ssl/openssl.cnf file will include any configuration files that
other packages might place into /etc/ssl/engines.d/ and
/etc/ssl/engdef.d/ This is a fix for bsc#1004463 where scripting was
being used to modify the openssl.cnf file. The scripting would fail
if either the default openssl.cnf file, or the sample openssl-ibmca
configuration file would be changed by upstream.
- Updated spec file to create the two new necessary directores for
the above patch.
OBS-URL: https://build.opensuse.org/request/show/936137
OBS-URL: https://build.opensuse.org/package/show/security:tls/openssl-1_1?expand=0&rev=100
