-
openssl (0.9.8o-1ubuntu4.6) maverick-security; urgency=low
* SECURITY UPDATE: ECDSA private key timing attack
- debian/patches/CVE-2011-1945.patch: compute with fixed scalar
length
- CVE-2011-1945
* SECURITY UPDATE: ECDH ciphersuite denial of service
- debian/patches/CVE-2011-3210.patch: fix memory usage for thread
safety
- CVE-2011-3210
* SECURITY UPDATE: DTLS plaintext recovery attack
- debian/patches/CVE-2011-4108.patch: perform all computations
before discarding messages
- CVE-2011-4108
* SECURITY UPDATE: policy check double free vulnerability
- debian/patches/CVE-2011-4019.patch: only free domain policyin
one location
- CVE-2011-4019
* SECURITY UPDATE: SSL 3.0 block padding exposure
- debian/patches/CVE-2011-4576.patch: clear bytes used for block
padding of SSL 3.0 records.
- CVE-2011-4576
* SECURITY UPDATE: malformed RFC 3779 data denial of service attack
- debian/patches/CVE-2011-4577.patch: prevent malformed RFC3779
data from triggering an assertion failure
- CVE-2011-4577
* SECURITY UPDATE: Server Gated Cryptography (SGC) denial of service
- debian/patches/CVE-2011-4619.patch: Only allow one SGC handshake
restart for SSL/TLS.
- CVE-2011-4619
* SECURITY UPDATE: fix for CVE-2011-4108 denial of service attack
- debian/patches/CVE-2012-0050.patch: improve handling of DTLS MAC
- CVE-2012-0050
* debian/patches/openssl-fix_ECDSA_tests.patch: fix ECDSA tests
* debian/libssl0.9.8.postinst: Only issue the reboot notification for
servers by testing that the X server is not running (LP: #244250)
-- Steve Beattie <email address hidden> Tue, 31 Jan 2012 01:37:33 -0800
-
openssl (0.9.8o-1ubuntu4.4) maverick-security; urgency=low
* SECURITY UPDATE: OCSP stapling vulnerability
- debian/patched/openssl-CVE-2011-0014-secadv_20110208.patch:
stricter parsing of ClientHello message in ssl/t1_lib.c
- CVE-2011-0014
-- Steve Beattie <email address hidden> Wed, 09 Feb 2011 16:35:30 -0800
-
openssl (0.9.8o-1ubuntu4.3) maverick-security; urgency=low
* SECURITY UPDATE: ciphersuite downgrade vulnerability
- openssl-CVE-2010-4180-secadv_20101202-0.9.8.patch:
disable workaround for Netscape cipher suite bug in ssl/s3_clnt.c
and ssl/s3_srvr.c
- CVE-2010-4180
-- Steve Beattie <email address hidden> Thu, 02 Dec 2010 16:24:31 -0800
-
openssl (0.9.8o-1ubuntu4.2) maverick-security; urgency=low
* SECURITY UPDATE: TLS race condition leading to a buffer overflow and
possible code execution. (LP: #676243)
- patches/debian/openssl-CVE-2010-3864-secadv_20101116-0.9.8.patch:
stricter NULL/not-NULL checking in ssl/t1_lib.c
- CVE-2010-3864
-- Steve Beattie <email address hidden> Tue, 16 Nov 2010 10:07:49 -0800
-
openssl (0.9.8o-1ubuntu4.1) maverick-security; urgency=low
* SECURITY UPDATE: denial of service and possible code execution via
crafted private key with an invalid prime.
- debian/patches/CVE-2010-2939.patch: set bn_ctx to NULL after freeing
it in ssl/s3_clnt.c.
- CVE-2010-2939
-- Marc Deslauriers <email address hidden> Wed, 06 Oct 2010 16:46:36 -0400
-
openssl (0.9.8o-1ubuntu4) maverick; urgency=low
* Update AES-NI patch to openssl-0.9.8-aesni-modes-perlasm-win32-v4.patch
from http://rt.openssl.org/Ticket/Display.html?id=2067, fixing segfault
on engine initialisation (LP: #590639).
-- Colin Watson <email address hidden> Fri, 24 Sep 2010 12:20:49 +0100
-
openssl (0.9.8o-1ubuntu3) maverick; urgency=low
* debian/patches/no-sslv2.patch: disable SSLv2 to match NSS and GnuTLS.
The protocol is unsafe and extremely deprecated. (Debian bug 589706)
-- Kees Cook <email address hidden> Tue, 20 Jul 2010 08:24:13 -0700
-
openssl (0.9.8o-1ubuntu2) maverick; urgency=low
* Don't build anymore for processors not supported anymore in maverick:
- i486, i586 (on i386).
- v8 (on sparc).
-- Matthias Klose <email address hidden> Mon, 19 Jul 2010 16:44:10 +0200
-
openssl (0.9.8o-1ubuntu1) maverick; urgency=low
* Merge from debian unstable, remaining changes (LP: #581167):
- debian/patches/Bsymbolic-functions.patch: Link using
-Bsymbolic-functions
- Ship documentation in openssl-doc, suggested by the package.
- Use a different priority for libssl0.9.8/restart-services
depending on whether a desktop, or server dist-upgrade is being
performed.
- Display a system restart required notification bubble on libssl0.9.8
upgrade.
- Replace duplicate files in the doc directory with symlinks.
- Move runtime libraries to /lib, for the benefit of wpasupplicant
- Use host compiler when cross-building (patch from Neil Williams in
Debian #465248).
- Don't run 'make test' when cross-building.
- Create libssl0.9.8-udeb, for the benefit of wget-udeb (LP: #503339).
- debian/patches/aesni.patch: Backport Intel AES-NI support from
http://rt.openssl.org/Ticket/Display.html?id=2067 (LP: #485518).
- debian/patches/perlpath-quilt.patch: Don't change perl #! paths
under .pc.
* Dropped patches, now upstream:
- debian/patches/CVE-2009-3245.patch
- debian/patches/CVE-2010-0740.patch
- debian/patches/dtls-compatibility.patch
- debian/patches/CVE-2009-4355.patch
* Dropped "Add support for lpia".
* Dropped "Disable SSLv2 during compile" as this had never actually
disabled SSLv2.
* Don't disable CVE-2009-3555.patch for Maverick.
openssl (0.9.8o-1) unstable; urgency=low
* New upstream version
- Add SHA2 algorithms to SSL_library_init().
- aes-x86_64.pl is now PIC, update pic.patch.
* Add sparc64 support (Closes: #560240)
openssl (0.9.8n-1) unstable; urgency=high
* New upstream version.
- Fixes CVE-2010-0740.
- Drop cfb.patch, applied upstream.
openssl (0.9.8m-2) unstable; urgency=low
* Revert CFB block length change preventing reading older files.
(Closes: #571810, #571940)
openssl (0.9.8m-1) unstable; urgency=low
* New upstream version
- Implements RFC5746, reenables renegotiation but requires the extension.
- Fixes CVE-2009-3245
- Drop patches CVE-2009-4355.patch, CVE-2009-1378.patch,
CVE-2009-1377.patch, CVE-2009-1379.patch, CVE-2009-3555.patch,
CVE-2009-2409.patch, CVE-2009-1387.patch, tls_ext_v3.patch,
no_check_self_signed.patch: applied upstream
- pk7_mime_free.patch removed, code rewritten
- ca.diff partially applied upstream
- engines-path.patch adjusted, upstream made some minor changes to the
build system.
- some flags changed values, bump shlibs.
* Switch to 3.0 (quilt) source package.
* Make sure the package is properly cleaned.
* Add ${misc:Depends} to the Depends on all packages.
* Fix spelling of extension in the changelog file.
openssl (0.9.8k-8) unstable; urgency=high
* Clean up zlib state so that it will be reinitialized on next use and
not cause a memory leak. (CVE-2009-4355, CVE-2008-1678)
-- Marc Deslauriers <email address hidden> Mon, 14 Jun 2010 09:08:29 -0400
-
openssl (0.9.8k-7ubuntu8) lucid; urgency=low
* SECURITY UPDATE: denial of service and possible arbitrary code
execution via unchecked return values
- debian/patches/CVE-2009-3245.patch: check bn_wexpand return value in
crypto/bn/{bn_div.c,bn_gf2m.c,bn_mul.c}, crypto/ec/ec2_smpl.c,
engines/e_ubsec.c.
- CVE-2009-3245
* SECURITY UPDATE: denial of service via "record of death"
- debian/patches/CVE-2010-0740.patch: only send back minor version
number in ssl/s3_pkt.c.
- CVE-2010-0740
-- Marc Deslauriers <email address hidden> Tue, 30 Mar 2010 08:57:51 -0400
