rpm/openssl
SHA256
1
0
Fork 0
forked from pool/openssl
Code Pull Requests Activity

OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/openssl?expand=0&rev=24

Browse Source
This commit is contained in:
OBS User unknown 2009-04-23 17:17:27 +00:00 committed by Git OBS Bridge
parent fd14d1dfb2
commit fc7e76a88f
5 changed files with 118 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

64
openssl-CVE-2009-0590.patch Normal file
View File

@ -0,0 +1,64 @@
Index: openssl-0.9.8h/crypto/asn1/asn1.h
===================================================================
--- openssl-0.9.8h.orig/crypto/asn1/asn1.h
+++ openssl-0.9.8h/crypto/asn1/asn1.h
@@ -1218,6 +1218,7 @@
#define ASN1_R_BAD_OBJECT_HEADER 102
#define ASN1_R_BAD_PASSWORD_READ 103
#define ASN1_R_BAD_TAG 104
+#define ASN1_R_BMPSTRING_IS_WRONG_LENGTH 210
#define ASN1_R_BN_LIB 105
#define ASN1_R_BOOLEAN_IS_WRONG_LENGTH 106
#define ASN1_R_BUFFER_TOO_SMALL 107
@@ -1307,6 +1308,7 @@
#define ASN1_R_UNABLE_TO_DECODE_RSA_KEY 157
#define ASN1_R_UNABLE_TO_DECODE_RSA_PRIVATE_KEY 158
#define ASN1_R_UNEXPECTED_EOC 159
+#define ASN1_R_UNIVERSALSTRING_IS_WRONG_LENGTH 211
#define ASN1_R_UNKNOWN_FORMAT 160
#define ASN1_R_UNKNOWN_MESSAGE_DIGEST_ALGORITHM 161
#define ASN1_R_UNKNOWN_OBJECT_TYPE 162
Index: openssl-0.9.8h/crypto/asn1/asn1_err.c
===================================================================
--- openssl-0.9.8h.orig/crypto/asn1/asn1_err.c
+++ openssl-0.9.8h/crypto/asn1/asn1_err.c
@@ -195,6 +195,7 @@
{ERR_REASON(ASN1_R_BAD_OBJECT_HEADER) ,"bad object header"},
{ERR_REASON(ASN1_R_BAD_PASSWORD_READ) ,"bad password read"},
{ERR_REASON(ASN1_R_BAD_TAG) ,"bad tag"},
+{ERR_REASON(ASN1_R_BMPSTRING_IS_WRONG_LENGTH),"bmpstring is wrong length"},
{ERR_REASON(ASN1_R_BN_LIB) ,"bn lib"},
{ERR_REASON(ASN1_R_BOOLEAN_IS_WRONG_LENGTH),"boolean is wrong length"},
{ERR_REASON(ASN1_R_BUFFER_TOO_SMALL) ,"buffer too small"},
@@ -284,6 +285,7 @@
{ERR_REASON(ASN1_R_UNABLE_TO_DECODE_RSA_KEY),"unable to decode rsa key"},
{ERR_REASON(ASN1_R_UNABLE_TO_DECODE_RSA_PRIVATE_KEY),"unable to decode rsa private key"},
{ERR_REASON(ASN1_R_UNEXPECTED_EOC) ,"unexpected eoc"},
+{ERR_REASON(ASN1_R_UNIVERSALSTRING_IS_WRONG_LENGTH),"universalstring is wrong length"},
{ERR_REASON(ASN1_R_UNKNOWN_FORMAT) ,"unknown format"},
{ERR_REASON(ASN1_R_UNKNOWN_MESSAGE_DIGEST_ALGORITHM),"unknown message digest algorithm"},
{ERR_REASON(ASN1_R_UNKNOWN_OBJECT_TYPE) ,"unknown object type"},
Index: openssl-0.9.8h/crypto/asn1/tasn_dec.c
===================================================================
--- openssl-0.9.8h.orig/crypto/asn1/tasn_dec.c
+++ openssl-0.9.8h/crypto/asn1/tasn_dec.c
@@ -1012,6 +1012,18 @@
case V_ASN1_SET:
case V_ASN1_SEQUENCE:
default:
+ if (utype == V_ASN1_BMPSTRING && (len & 1))
+ {
+ ASN1err(ASN1_F_ASN1_EX_C2I,
+ ASN1_R_BMPSTRING_IS_WRONG_LENGTH);
+ goto err;
+ }
+ if (utype == V_ASN1_UNIVERSALSTRING && (len & 3))
+ {
+ ASN1err(ASN1_F_ASN1_EX_C2I,
+ ASN1_R_UNIVERSALSTRING_IS_WRONG_LENGTH);
+ goto err;
+ }
/* All based on ASN1_STRING and handled the same */
if (!*pval)
{

13
openssl-CVE-2009-0591.patch Normal file
View File

@ -0,0 +1,13 @@
Index: openssl-0.9.8h/crypto/cms/cms_smime.c
===================================================================
--- openssl-0.9.8h.orig/crypto/cms/cms_smime.c
+++ openssl-0.9.8h/crypto/cms/cms_smime.c
@@ -425,7 +425,7 @@
for (i = 0; i < sk_CMS_SignerInfo_num(sinfos); i++)
{
si = sk_CMS_SignerInfo_value(sinfos, i);
- if (!CMS_SignerInfo_verify_content(si, cmsbio))
+ if (CMS_SignerInfo_verify_content(si, cmsbio) <= 0)
{
CMSerr(CMS_F_CMS_VERIFY,
CMS_R_CONTENT_VERIFY_ERROR);

20
openssl-CVE-2009-0789.patch Normal file
View File

@ -0,0 +1,20 @@
Index: openssl-0.9.8h/crypto/asn1/tasn_dec.c
===================================================================
--- openssl-0.9.8h.orig/crypto/asn1/tasn_dec.c
+++ openssl-0.9.8h/crypto/asn1/tasn_dec.c
@@ -611,7 +611,6 @@
err:
ASN1_template_free(val, tt);
- *val = NULL;
return 0;
}
@@ -758,7 +757,6 @@
err:
ASN1_template_free(val, tt);
- *val = NULL;
return 0;
}

8
openssl.changes
View File

@ -1,3 +1,11 @@
-------------------------------------------------------------------
Wed Apr 15 12:28:29 CEST 2009 - gjhe@suse.de
- fix security bug [bnc#489641]
CVE-2009-0590
CVE-2009-0591
CVE-2009-0789
-------------------------------------------------------------------
Wed Jan 7 12:34:56 CET 2009 - olh@suse.de

15
openssl.spec
View File

@ -32,7 +32,7 @@ Obsoletes: openssl-64bit
%endif
#
Version: 0.9.8h
Release: 30
Release: 32
Summary: Secure Sockets and Transport Layer Security
Url: http://www.openssl.org/
Source: http://www.%{name}.org/source/%{name}-%{version}.tar.bz2
@ -52,6 +52,9 @@ Patch8: func-parm-err.patch
Patch9: disable-optimization-for-s390x.diff
%endif
Patch10: openssl-CVE-2008-5077.patch
Patch11: openssl-CVE-2009-0590.patch
Patch12: openssl-CVE-2009-0591.patch
Patch13: openssl-CVE-2009-0789.patch
BuildRoot: %{_tmppath}/%{name}-%{version}-build
%description
@ -192,6 +195,9 @@ Authors:
%patch9
%endif
%patch10 -p1
%patch11 -p1
%patch12 -p1
%patch13 -p1
cp -p %{S:10} .
# lib64 installation fixes
for i in Makefile.org engines/Makefile; do
@ -403,6 +409,11 @@ if ! test -f /.buildenv; then rm -rf $RPM_BUILD_ROOT; fi
%{_bindir}/%{name}
%changelog
* Wed Apr 15 2009 gjhe@suse.de
- fix security bug [bnc#489641]
CVE-2009-0590
CVE-2009-0591
CVE-2009-0789
* Wed Jan 07 2009 olh@suse.de
- obsolete old -XXbit packages (bnc#437293)
* Thu Dec 18 2008 jshi@suse.de
@ -907,7 +918,7 @@ if ! test -f /.buildenv; then rm -rf $RPM_BUILD_ROOT; fi
* Tue Aug 06 2002 draht@suse.de
- Correction for changes in the ASN1 code, assembled in
openssl-0.9.6e-cvs-20020802-asn1_lib.diff
* Wed Jul 31 2002 poeml@suse.de
* Thu Aug 01 2002 poeml@suse.de
- update to 0.9.6e. Major changes:
o Various security fixes (sanity checks to asn1_get_length(),
various remote buffer overflows)