CVS commit: pkgsrc/security/openssl

["Adam Ciarcinski" <adam%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   adam
Date:           Sat Sep 16 02:54:58 UTC 2023

Modified Files:
        pkgsrc/security/openssl: Makefile distinfo

Log Message:
openssl: updated to 1.1.1w

Changes between 1.1.1v and 1.1.1w [11 Sep 2023]

*) Fix POLY1305 MAC implementation corrupting XMM registers on Windows.

   The POLY1305 MAC (message authentication code) implementation in OpenSSL
   does not save the contents of non-volatile XMM registers on Windows 64
   platform when calculating the MAC of data larger than 64 bytes. Before
   returning to the caller all the XMM registers are set to zero rather than
   restoring their previous content. The vulnerable code is used only on newer
   x86_64 processors supporting the AVX512-IFMA instructions.

   The consequences of this kind of internal application state corruption can
   be various - from no consequences, if the calling application does not
   depend on the contents of non-volatile XMM registers at all, to the worst
   consequences, where the attacker could get complete control of the
   application process. However given the contents of the registers are just
   zeroized so the attacker cannot put arbitrary values inside, the most likely
   consequence, if any, would be an incorrect result of some application
   dependent calculations or a crash leading to a denial of service.

   (CVE-2023-4807)
   [Bernd Edlinger]

Changes between 1.1.1u and 1.1.1v [1 Aug 2023]

*) Fix excessive time spent checking DH q parameter value.

   The function DH_check() performs various checks on DH parameters. After
   fixing CVE-2023-3446 it was discovered that a large q parameter value can
   also trigger an overly long computation during some of these checks.
   A correct q value, if present, cannot be larger than the modulus p
   parameter, thus it is unnecessary to perform these checks if q is larger
   than p.

   If DH_check() is called with such q parameter value,
   DH_CHECK_INVALID_Q_VALUE return flag is set and the computationally
   intensive checks are skipped.

   (CVE-2023-3817)
   [Tomáš Mráz]


To generate a diff of this commit:
cvs rdiff -u -r1.290 -r1.291 pkgsrc/security/openssl/Makefile
cvs rdiff -u -r1.167 -r1.168 pkgsrc/security/openssl/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/security/openssl/Makefile
diff -u pkgsrc/security/openssl/Makefile:1.290 pkgsrc/security/openssl/Makefile:1.291
--- pkgsrc/security/openssl/Makefile:1.290      Tue Jun 27 10:46:50 2023
+++ pkgsrc/security/openssl/Makefile    Sat Sep 16 02:54:58 2023
@@ -1,9 +1,9 @@
-# $NetBSD: Makefile,v 1.290 2023/06/27 10:46:50 riastradh Exp $
+# $NetBSD: Makefile,v 1.291 2023/09/16 02:54:58 adam Exp $
 
 # Remember to upload-distfiles when updating OpenSSL -- otherwise it
 # is not possible for users who have bootstrapped without OpenSSL
 # to install it and enable HTTPS fetching.
-DISTNAME=      openssl-1.1.1u
+DISTNAME=      openssl-1.1.1w
 CATEGORIES=    security
 MASTER_SITES=  https://www.openssl.org/source/
 

Index: pkgsrc/security/openssl/distinfo
diff -u pkgsrc/security/openssl/distinfo:1.167 pkgsrc/security/openssl/distinfo:1.168
--- pkgsrc/security/openssl/distinfo:1.167      Tue May 30 14:52:00 2023
+++ pkgsrc/security/openssl/distinfo    Sat Sep 16 02:54:58 2023
@@ -1,8 +1,8 @@
-$NetBSD: distinfo,v 1.167 2023/05/30 14:52:00 wiz Exp $
+$NetBSD: distinfo,v 1.168 2023/09/16 02:54:58 adam Exp $
 
-BLAKE2s (openssl-1.1.1u.tar.gz) = 3be5d53d3d57999fcf6c82184980dc0bb02344d1f7e94c5b0dde2665a1678c7b
-SHA512 (openssl-1.1.1u.tar.gz) = d00aeb0b4c4676deff06ff95af7ac33dd683b92f972b4a8ae55cf384bb37c7ec30ab83c6c0745daf87cf1743a745fced6a347fd11fed4c548aa0953610ed4919
-Size (openssl-1.1.1u.tar.gz) = 9892176 bytes
+BLAKE2s (openssl-1.1.1w.tar.gz) = 22267f203159562dd9916f2d419618fa6cc26d58fadd7963be5c0d92d7deda8e
+SHA512 (openssl-1.1.1w.tar.gz) = b4c625fe56a4e690b57b6a011a225ad0cb3af54bd8fb67af77b5eceac55cc7191291d96a660c5b568a08a2fbf62b4612818e7cca1bb95b2b6b4fc649b0552b6d
+Size (openssl-1.1.1w.tar.gz) = 9893384 bytes
 SHA1 (patch-Configurations_shared-info.pl) = 0e835f6e343b5d05ef9a0e6ef2a195201262d15c
 SHA1 (patch-Configurations_unix-Makefile.tmpl) = 3f47dd453381485aeb6c37dc53f932428fdcef50
 SHA1 (patch-Configure) = 479f1bc826f7721f6b44d6b5a6cf460432924bf2