Dominique Leuenberger
863b688e84
Accepting request 930407 from security:tls
...
Automatic submission by obs-autosubmit
OBS-URL: https://build.opensuse.org/request/show/930407
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/openssl-1_1?expand=0&rev=27
2021-11-11 20:35:46 +00:00
adc35a7f9e
Accepting request 928745 from home:gladiac:branches:security:tls
...
- Add missing libopenssl1_1-hmac 32bit package
OBS-URL: https://build.opensuse.org/request/show/928745
OBS-URL: https://build.opensuse.org/package/show/security:tls/openssl-1_1?expand=0&rev=97
2021-11-05 12:49:39 +00:00
Dominique Leuenberger
b0d056e146
Accepting request 914095 from security:tls
...
OBS-URL: https://build.opensuse.org/request/show/914095
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/openssl-1_1?expand=0&rev=26
2021-08-28 20:28:35 +00:00
Jason Sikes
f21d23e877
Accepting request 914079 from home:pmonrealgonzalez:branches:security:tls
...
- Update to 1.1.1l:
* [bsc#1189520, CVE-2021-3711] Fixed an SM2 Decryption Buffer Overflow.
* [bsc#1189521, CVE-2021-3712] Fixed various read buffer overruns
processing ASN.1 strings
- Require the crypto-policies package from libopenssl-1_1
OBS-URL: https://build.opensuse.org/request/show/914079
OBS-URL: https://build.opensuse.org/package/show/security:tls/openssl-1_1?expand=0&rev=96
2021-08-25 02:52:01 +00:00
Dominique Leuenberger
11b1c70b4c
Accepting request 906782 from security:tls
...
OBS-URL: https://build.opensuse.org/request/show/906782
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/openssl-1_1?expand=0&rev=25
2021-07-21 17:05:32 +00:00
bbd5132f50
Accepting request 906749 from home:jsikes:branches:security:tls
...
New candidate fix for bsc1180995. Enjoy!
OBS-URL: https://build.opensuse.org/request/show/906749
OBS-URL: https://build.opensuse.org/package/show/security:tls/openssl-1_1?expand=0&rev=95
2021-07-17 07:22:41 +00:00
15122a3c70
Accepting request 895194 from home:jsikes:branches:security:tls
...
Fixed error in spec file. Enjoy!
OBS-URL: https://build.opensuse.org/request/show/895194
OBS-URL: https://build.opensuse.org/package/show/security:tls/openssl-1_1?expand=0&rev=94
2021-05-24 15:50:42 +00:00
Dominique Leuenberger
9119842a93
Accepting request 886506 from security:tls
...
OBS-URL: https://build.opensuse.org/request/show/886506
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/openssl-1_1?expand=0&rev=24
2021-04-19 19:06:14 +00:00
Jason Sikes
7d266d26c5
Accepting request 886496 from home:jsikes:branches:security:tls
...
Added bsc numbers to changelog.
OBS-URL: https://build.opensuse.org/request/show/886496
OBS-URL: https://build.opensuse.org/package/show/security:tls/openssl-1_1?expand=0&rev=92
2021-04-18 23:41:13 +00:00
Richard Brown
f4f7fdf3c5
Accepting request 882115 from security:tls
...
OBS-URL: https://build.opensuse.org/request/show/882115
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/openssl-1_1?expand=0&rev=23
2021-04-08 19:01:22 +00:00
Jason Sikes
abf147163e
Accepting request 882114 from home:jsikes:branches:security:tls
...
Update to 1.1.1k with CVE fixes. Enjoy!
OBS-URL: https://build.opensuse.org/request/show/882114
OBS-URL: https://build.opensuse.org/package/show/security:tls/openssl-1_1?expand=0&rev=90
2021-03-30 07:22:25 +00:00
Jason Sikes
2a418dd2f6
Accepting request 881422 from home:jsikes:branches:security:tls
...
Updated to 1.1.1k. Enjoy!
OBS-URL: https://build.opensuse.org/request/show/881422
OBS-URL: https://build.opensuse.org/package/show/security:tls/openssl-1_1?expand=0&rev=89
2021-03-25 23:47:36 +00:00
Dominique Leuenberger
3ae49ce958
Accepting request 878152 from security:tls
...
OBS-URL: https://build.opensuse.org/request/show/878152
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/openssl-1_1?expand=0&rev=22
2021-03-12 12:30:28 +00:00
50473db176
Accepting request 876739 from home:pmonrealgonzalez:branches:security:tls
...
- Fix unresolved error codes [bsc#1182959]
- Update patches:
* openssl-1.1.1-fips.patch
* openssl-1.1.1-evp-kdf.patch
OBS-URL: https://build.opensuse.org/request/show/876739
OBS-URL: https://build.opensuse.org/package/show/security:tls/openssl-1_1?expand=0&rev=87
2021-03-10 11:16:54 +00:00
Richard Brown
9548fda780
Accepting request 874306 from security:tls
...
OBS-URL: https://build.opensuse.org/request/show/874306
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/openssl-1_1?expand=0&rev=21
2021-03-03 17:33:24 +00:00
a13839c7c6
Accepting request 873674 from home:pmonrealgonzalez:branches:security:tls
...
- Update to 1.1.1j
* Fixed the X509_issuer_and_serial_hash() function. It attempts
to create a unique hash value based on the issuer and serial
number data contained within an X509 certificate. However it
was failing to correctly handle any errors that may occur
while parsing the issuer field [bsc#1182331, CVE-2021-23841]
* Fixed the RSA_padding_check_SSLv23() function and the
RSA_SSLV23_PADDING padding mode to correctly check for
rollback attacks.
* Fixed the EVP_CipherUpdate, EVP_EncryptUpdate and
EVP_DecryptUpdate functions. Previously they could overflow the
output length argument in some cases where the input length is
close to the maximum permissable length for an integer on the
platform. In such cases the return value from the function call
would be 1 (indicating success), but the output length value
would be negative. This could cause applications to behave
incorrectly or crash. [bsc#1182333, CVE-2021-23840]
* Fixed SRP_Calc_client_key so that it runs in constant time.
The previous implementation called BN_mod_exp without setting
BN_FLG_CONSTTIME. This could be exploited in a side channel
attack to recover the password. Since the attack is local host
only this is outside of the current OpenSSL threat model and
therefore no CVE is assigned.
- Rebase patches:
* openssl-1.1.1-fips.patch
* openssl-1.1.0-issuer-hash.patch
* openssl-1.1.1-evp-kdf.patch
- Add version guards for the crypto-policies
OBS-URL: https://build.opensuse.org/request/show/873674
OBS-URL: https://build.opensuse.org/package/show/security:tls/openssl-1_1?expand=0&rev=85
2021-02-22 12:20:01 +00:00
Jason Sikes
1f67f5cc44
Accepting request 869986 from home:jsikes:branches:security:tls
...
Small change to undo another small change. Sorry.
OBS-URL: https://build.opensuse.org/request/show/869986
OBS-URL: https://build.opensuse.org/package/show/security:tls/openssl-1_1?expand=0&rev=84
2021-02-06 23:06:18 +00:00
083820900d
Accepting request 869551 from home:jsikes:branches:security:tls
...
Small fix. Enjoy!
OBS-URL: https://build.opensuse.org/request/show/869551
OBS-URL: https://build.opensuse.org/package/show/security:tls/openssl-1_1?expand=0&rev=83
2021-02-05 15:53:45 +00:00
3d07044ba3
Accepting request 865443 from home:pmonrealgonzalez:branches:security:tls
...
- Disable test_srp subsection from 90-test_sslapi.t test
- Use SECLEVEL 2 in 80-test_ssl_new.t
- Add patches:
* openssl-1_1-use-seclevel2-in-tests.patch
* openssl-1_1-disable-test_srp-sslapi.patch
- Allow SHA1 in SECLEVEL 2 in non-FIPS mode
- Add openssl-1_1-seclevel.patch
OBS-URL: https://build.opensuse.org/request/show/865443
OBS-URL: https://build.opensuse.org/package/show/security:tls/openssl-1_1?expand=0&rev=82
2021-01-21 14:53:39 +00:00
3a839dd9e9
- Require the crypto-policies package [bsc#1180051]
...
OBS-URL: https://build.opensuse.org/package/show/security:tls/openssl-1_1?expand=0&rev=81
2021-01-07 13:09:26 +00:00
15b55e8cea
OBS-URL: https://build.opensuse.org/package/show/security:tls/openssl-1_1?expand=0&rev=80
2021-01-07 12:04:52 +00:00
0e5c7b7193
Accepting request 858095 from home:pmonrealgonzalez:branches:security:tls
...
- Require the crypto-policies package [bsc#1180051]
OBS-URL: https://build.opensuse.org/request/show/858095
OBS-URL: https://build.opensuse.org/package/show/security:tls/openssl-1_1?expand=0&rev=79
2020-12-22 09:44:19 +00:00
Dominique Leuenberger
e594dc44e4
Accepting request 853304 from security:tls
...
OBS-URL: https://build.opensuse.org/request/show/853304
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/openssl-1_1?expand=0&rev=20
2020-12-16 09:58:44 +00:00
55671aee4d
Accepting request 855722 from home:pmonrealgonzalez:branches:security:tls
...
- Refresh openssl-1.1.1-fips-post-rand.patch
OBS-URL: https://build.opensuse.org/request/show/855722
OBS-URL: https://build.opensuse.org/package/show/security:tls/openssl-1_1?expand=0&rev=77
2020-12-14 11:22:02 +00:00
ae4e19d8e5
Accepting request 854071 from home:vitezslav_cizek:branches:security:tls
...
- Update to 1.1.1i (bsc#1179491)
* Fixed NULL pointer deref in GENERAL_NAME_cmp (CVE-2020-1971)
OBS-URL: https://build.opensuse.org/request/show/854071
OBS-URL: https://build.opensuse.org/package/show/security:tls/openssl-1_1?expand=0&rev=76
2020-12-14 11:20:34 +00:00
a44c4ab57f
Accepting request 850541 from home:vitezslav_cizek:branches:security:tls
...
Don't forward to Factory yet. Needs more testing.
- Use the centralized crypto policy profile (jsc#SLE-15832)
* add openssl-1.1.1-system-cipherlist.patch from Fedora
OBS-URL: https://build.opensuse.org/request/show/850541
OBS-URL: https://build.opensuse.org/package/show/security:tls/openssl-1_1?expand=0&rev=75
2020-12-05 17:19:30 +00:00
Dominique Leuenberger
af7a8f80d6
Accepting request 841379 from security:tls
...
OBS-URL: https://build.opensuse.org/request/show/841379
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/openssl-1_1?expand=0&rev=19
2020-10-18 14:17:49 +00:00
Tomáš Chvátal
7be8052908
Accepting request 841314 from home:dimstar:Factory
...
- Escape rpm command %%expand when used in comment.
Fix build with RPM 4.16, see
https://build.opensuse.org/package/live_build_log/openSUSE:Factory:Staging:A/openssl-1_1/standard/x86_64
OBS-URL: https://build.opensuse.org/request/show/841314
OBS-URL: https://build.opensuse.org/package/show/security:tls/openssl-1_1?expand=0&rev=73
2020-10-13 05:14:08 +00:00
5cbee84ef1
Accepting request 836174 from home:vitezslav_cizek:branches:security:tls
...
- Update to 1.1.1h
* Disallow explicit curve parameters in verifications chains when X509_V_FLAG_X509_STRICT is used
* Enable 'MinProtocol' and 'MaxProtocol' to configure both TLS and DTLS contexts
- refresh openssl-fips_selftest_upstream_drbg.patch
* DRBG internals got renamed back:
reseed_gen_counter -> generate_counter
reseed_prop_counter -> reseed_counter
OBS-URL: https://build.opensuse.org/request/show/836174
OBS-URL: https://build.opensuse.org/package/show/security:tls/openssl-1_1?expand=0&rev=72
2020-09-23 06:41:06 +00:00
Dominique Leuenberger
8a0b3e7ace
Accepting request 805875 from security:tls
...
OBS-URL: https://build.opensuse.org/request/show/805875
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/openssl-1_1?expand=0&rev=18
2020-05-19 12:43:15 +00:00
e4417781b1
Accepting request 805872 from home:vitezslav_cizek:branches:security:tls
...
- Limit the DRBG selftests to not deplete entropy (bsc#1165274)
* fixes also Firefox crashing with Kerberos (bsc#1167132)
* update openssl-fips_selftest_upstream_drbg.patch
OBS-URL: https://build.opensuse.org/request/show/805872
OBS-URL: https://build.opensuse.org/package/show/security:tls/openssl-1_1?expand=0&rev=70
2020-05-15 15:20:55 +00:00
Dominique Leuenberger
0d743beb17
Accepting request 796090 from security:tls
...
OBS-URL: https://build.opensuse.org/request/show/796090
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/openssl-1_1?expand=0&rev=17
2020-04-27 21:27:46 +00:00
Martin Pluskal
5a11d9c32d
Accepting request 796077 from home:vitezslav_cizek:branches:security:tls
...
- Update to 1.1.1g
* Fixed segmentation fault in SSL_check_chain (CVE-2020-1967, bsc#1169407)
Server or client applications that call the SSL_check_chain() function
during or after a TLS 1.3 handshake may crash due to a NULL pointer
dereference as a result of incorrect handling of the
"signature_algorithms_cert" TLS extension. The crash occurs if an invalid
or unrecognised signature algorithm is received from the peer. This could
be exploited by a malicious peer in a Denial of Service attack.
* Added AES consttime code for no-asm configurations
an optional constant time support for AES was added
when building openssl for no-asm.
- refresh patches:
* openssl-1.1.1-fips.patch
* openssl-1.1.1-fips-crng-test.patch
OBS-URL: https://build.opensuse.org/request/show/796077
OBS-URL: https://build.opensuse.org/package/show/security:tls/openssl-1_1?expand=0&rev=68
2020-04-21 15:13:15 +00:00
Dominique Leuenberger
5b13303a59
Accepting request 790184 from security:tls
...
OBS-URL: https://build.opensuse.org/request/show/790184
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/openssl-1_1?expand=0&rev=16
2020-04-02 15:42:25 +00:00
fc87bd7e12
Accepting request 790182 from home:vitezslav_cizek:branches:security:tls
...
- Update to 1.1.1f
* Revert the unexpected EOF reporting via SSL_ERROR_SSL
- refresh openssl-1.1.0-no-html.patch
OBS-URL: https://build.opensuse.org/request/show/790182
OBS-URL: https://build.opensuse.org/package/show/security:tls/openssl-1_1?expand=0&rev=66
2020-03-31 14:27:13 +00:00
32ced036f1
Accepting request 786956 from home:vitezslav_cizek:branches:security:tls
...
- Update to 1.1.1e
* Properly detect EOF while reading in libssl. Previously if we hit an EOF
while reading in libssl then we would report an error back to the
application (SSL_ERROR_SYSCALL) but errno would be 0. We now add
an error to the stack (which means we instead return SSL_ERROR_SSL) and
therefore give a hint as to what went wrong.
* Check that ed25519 and ed448 are allowed by the security level. Previously
signature algorithms not using an MD were not being checked that they were
allowed by the security level.
* Fixed SSL_get_servername() behaviour. The behaviour of SSL_get_servername()
was not quite right. The behaviour was not consistent between resumption
and normal handshakes, and also not quite consistent with historical
behaviour. The behaviour in various scenarios has been clarified and
it has been updated to make it match historical behaviour as closely as
possible.
* Corrected the documentation of the return values from the EVP_DigestSign*
set of functions. The documentation mentioned negative values for some
errors, but this was never the case, so the mention of negative values
was removed.
* Added a new method to gather entropy on VMS, based on SYS$GET_ENTROPY.
The presence of this system service is determined at run-time.
* Added newline escaping functionality to a filename when using openssl dgst.
This output format is to replicate the output format found in the '*sum'
checksum programs. This aims to preserve backward compatibility.
* Print all values for a PKCS#12 attribute with 'openssl pkcs12', not just
the first value.
- Update bunch of patches as the internal crypto headers got reorganized
- drop openssl-1_1-CVE-2019-1551.patch (upstream)
- openssl dgst: default to SHA256 only when called without a digest,
OBS-URL: https://build.opensuse.org/request/show/786956
OBS-URL: https://build.opensuse.org/package/show/security:tls/openssl-1_1?expand=0&rev=65
2020-03-20 17:43:35 +00:00
Dominique Leuenberger
659e2d5f28
Accepting request 780187 from security:tls
...
OBS-URL: https://build.opensuse.org/request/show/780187
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/openssl-1_1?expand=0&rev=15
2020-03-01 20:26:08 +00:00
Vítězslav Čížek
8e4d5710d8
Accepting request 780178 from home:vitezslav_cizek:branches:security:tls
...
- Run FIPS DRBG selftests against the crypto/rand DRBG implementation
(bsc#1164557)
* add openssl-fips_selftest_upstream_drbg.patch
OBS-URL: https://build.opensuse.org/request/show/780178
OBS-URL: https://build.opensuse.org/package/show/security:tls/openssl-1_1?expand=0&rev=63
2020-02-28 09:10:25 +00:00
Dominique Leuenberger
42d434a07f
Accepting request 778018 from security:tls
...
OBS-URL: https://build.opensuse.org/request/show/778018
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/openssl-1_1?expand=0&rev=14
2020-02-24 14:49:54 +00:00
92e6fcbee3
Accepting request 778004 from home:vitezslav_cizek:branches:security:tls
...
- Use the newly build libcrypto shared library when computing the hmac
checksums in order to avoid a bootstrapping issue by BuildRequiring
libopenssl1_1 (bsc#1164102)
- Fix wrong return values of FIPS DSA and ECDH selftests (bsc#1163569)
* add openssl-fips_fix_selftests_return_value.patch
OBS-URL: https://build.opensuse.org/request/show/778004
OBS-URL: https://build.opensuse.org/package/show/security:tls/openssl-1_1?expand=0&rev=61
2020-02-21 15:33:18 +00:00
Vítězslav Čížek
97fb15d08d
apply the sha3 patch
...
OBS-URL: https://build.opensuse.org/package/show/security:tls/openssl-1_1?expand=0&rev=60
2020-02-19 08:57:54 +00:00
Vítězslav Čížek
ffdf279f1f
Accepting request 776093 from home:jsikes:branches:security:tls
...
Finally submitted bsc#1155345. Enjoy!
OBS-URL: https://build.opensuse.org/request/show/776093
OBS-URL: https://build.opensuse.org/package/show/security:tls/openssl-1_1?expand=0&rev=59
2020-02-19 08:42:05 +00:00
Dominique Leuenberger
a7c4747f34
Accepting request 770495 from security:tls
...
Automatic submission by obs-autosubmit
OBS-URL: https://build.opensuse.org/request/show/770495
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/openssl-1_1?expand=0&rev=13
2020-02-11 21:16:32 +00:00
Dominique Leuenberger
847afcdb2d
Accepting request 768078 from security:tls
...
OBS-URL: https://build.opensuse.org/request/show/768078
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/openssl-1_1?expand=0&rev=12
2020-02-03 10:10:35 +00:00
048a7c3935
Accepting request 768532 from home:pmonrealgonzalez:branches:security:tls
...
- Support for CPACF enhancements - part 2 (crypto) [jsc#SLE-7403]
OBS-URL: https://build.opensuse.org/request/show/768532
OBS-URL: https://build.opensuse.org/package/show/security:tls/openssl-1_1?expand=0&rev=56
2020-01-30 09:32:13 +00:00
Vítězslav Čížek
f10b8031f6
Accepting request 768077 from home:pmonrealgonzalez:branches:security:tls
...
- Support for CPACF enhancements - part 2 (crypto) [jsc#SLE-7575]
- Add patches:
* openssl-s390x-assembly-pack-accelerate-X25519-X448-Ed25519-and-Ed448.patch
* openssl-s390x-fix-x448-and-x448-test-vector-ctime-for-x25519-and-x448.patch
OBS-URL: https://build.opensuse.org/request/show/768077
OBS-URL: https://build.opensuse.org/package/show/security:tls/openssl-1_1?expand=0&rev=55
2020-01-28 16:00:58 +00:00
Vítězslav Čížek
69c8efb60b
Accepting request 767781 from home:pmonrealgonzalez:branches:security:tls
...
* openssl-1.1.1-ssh-kdf.patch replaces openssl-jsc-SLE-8789-backport_KDF.patch
OBS-URL: https://build.opensuse.org/request/show/767781
OBS-URL: https://build.opensuse.org/package/show/security:tls/openssl-1_1?expand=0&rev=54
2020-01-27 14:29:03 +00:00
2a1b36e3f7
Accepting request 767728 from home:vitezslav_cizek:branches:security:tls
...
* openssl-1.1.1-ssh-kdf.patch replaces openssl-jsc-SLE-8789-backport_KDF.patch\
- keep EVP_KDF functions at version 1.1.1d for backward compatibility
* add openssl-keep_EVP_KDF_functions_version.patch
OBS-URL: https://build.opensuse.org/request/show/767728
OBS-URL: https://build.opensuse.org/package/show/security:tls/openssl-1_1?expand=0&rev=53
2020-01-27 14:25:49 +00:00
Tomáš Chvátal
d4b57dac41
Accepting request 766919 from home:vitezslav_cizek:branches:security:tls
...
layered FIPS initialization (bsc#1161789)
OBS-URL: https://build.opensuse.org/request/show/766919
OBS-URL: https://build.opensuse.org/package/show/security:tls/openssl-1_1?expand=0&rev=52
2020-01-24 15:19:27 +00:00
Tomáš Chvátal
c29de1fbdc
Accepting request 766865 from home:vitezslav_cizek:branches:security:tls
...
Add million FIPS and s390 patches
- Temporarily ignore broken OPENSSL_INIT_NO_ATEXIT due to our
layered FIPS initialization
* openssl-fips-ignore_broken_atexit_test.patch
- Import FIPS patches from SLE-15
* openssl-fips-dont_run_FIPS_module_installed.patch
* openssl-fips_mode.patch
* openssl-ship_fips_standalone_hmac.patch
* openssl-fips-clearerror.patch
* openssl-fips-selftests_in_nonfips_mode.patch
- Don't run FIPS power-up self-tests when the checksum files aren't
installed (bsc#1042392)
* add openssl-fips-run_selftests_only_when_module_is_complete.patch
- Import FIPS patches from Fedora (bsc#1157702, jsc#SLE-9553)
* openssl-1.1.1-fips-crng-test.patch
* openssl-1.1.1-fips-post-rand.patch
* openssl-1.1.1-fips.patch
* openssl-1.1.0-issuer-hash.patch
* openssl-1.1.1-evp-kdf.patch
* openssl-1.1.1-ssh-kdf.patch replaces openssl-jsc-SLE-8789-backport_KDF.patch
- Support for CPACF enhancements - part 1 (crypto) [bsc#1152695, jsc#SLE-7861]
- Add patches:
* openssl-s390x-assembly-pack-add-OPENSSL_s390xcap-environment.patch
* openssl-s390x-assembly-pack-add-support-for-pcc-and-kma-inst.patch
* openssl-s390x-assembly-pack-add-OPENSSL_s390xcap-man-page.patch
* openssl-s390x-assembly-pack-update-OPENSSL_s390xcap-3.patch
* openssl-s390xcpuid.pl-fix-comment.patch
OBS-URL: https://build.opensuse.org/request/show/766865
OBS-URL: https://build.opensuse.org/package/show/security:tls/openssl-1_1?expand=0&rev=51
2020-01-24 11:52:58 +00:00