Module Name:	pkgsrc
Committed By:	wiz
Date:		Sun Sep 10 21:12:21 UTC 2006

Modified Files:
	pkgsrc/security/gnutls: Makefile distinfo

Log Message:
Update to 1.4.3:

* Version 1.4.3 (released 2006-09-08)

** Fix PKCS#1 verification to avoid a variant of Bleichenbacher's
** Crypto 06 rump session attack.
In particular, we check that the digestAlgorithm.parameters field is
empty, to avoid that it can contain "garbage" that may be used to
alter the numeric properties of the signature.  See
<http://www.imc.org/ietf-openpgp/mail-archive/msg14307.html> (which is
not exactly the same as the problem we fix here).  Reported by Yutaka
OIWA <y.oiwa@aist.go.jp>.

See GNUTLS-SA-2006-4 on http://www.gnutls.org/security.html for more
up to date information.

** Fix PKCS#1 decryption to avoid Bleichenbacher's Crypto 98 attack.
See <http://www.bell-labs.com/user/bleichen/papers/pkcs.ps.gz>.
Reported by Werner Koch <wk@gnupg.org>.

See GNUTLS-SA-2006-3 on http://www.gnutls.org/security.html for more
up to date information.

** Fix crash in gnutls_x509_crt_sign2 if passed a NULL issuer_key.

** API and ABI modifications:
No changes since last version.

* Version 1.4.2 (released 2006-08-12)

** Fix a crash (strcmp() on a NULL value) in the certificate verification logic.
This can happen if you call gnutls_certificate_verify_peers2 and have
a certain mix of local CA certificates and the peer send special
certificates, that together trigger certain behaviour.  It is not
known at this point whether the crash can be triggered without the
special local CA certificate, and thus turn this into a remote crash
of clients that verify server certificates when they talk to a server
with the special server certificate.  See GNUTLS-SA-2006-2 on
http://www.gnu.org/software/gnutls/security.html for more up to date
information.  Reported by satyakumar <satyam_kkd@hyd.hellosoft.com>.

** Change SRP and Cert-Type extensions to match IANA registry.

** OpenCDK updated to 0.5.9 to fix some problems with OpenPGP support.

** Make --without-included-libtasn1 work.
Reported by Daniel Black <dragonheart@gentoo.org>.

** API and ABI modifications:
No changes since last version.


To generate a diff of this commit:
cvs rdiff -r1.50 -r1.51 pkgsrc/security/gnutls/Makefile
cvs rdiff -r1.29 -r1.30 pkgsrc/security/gnutls/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.