rpms/mingw-openssl
7
0
Fork 0
Code Issues Pull Requests Releases Activity

CVE-2011-0014 openssl: OCSP stapling vulnerability fix for

Browse Source 
https://bugzilla.redhat.com/show_bug.cgi?id=676070
This commit is contained in:
Kai Tietz 2011-03-04 11:03:42 +01:00
parent 69fef3cef1
commit f9c5c21b08
2 changed files with 33 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
mingw32-openssl.spec
View File

@ -59,6 +59,7 @@ Patch7: openssl-1.0.0-timezone.patch
# Bug fixes # Bug fixes
Patch23: openssl-1.0.0-beta4-default-paths.patch Patch23: openssl-1.0.0-beta4-default-paths.patch
Patch24: openssl-0.9.8j-bad-mime.patch Patch24: openssl-0.9.8j-bad-mime.patch
Patch25: openssl-1.0.0a-sslt1lib.patch
# Functionality changes # Functionality changes
Patch32: openssl-0.9.8g-ia64.patch Patch32: openssl-0.9.8g-ia64.patch
Patch33: openssl-1.0.0-beta4-ca-dir.patch Patch33: openssl-1.0.0-beta4-ca-dir.patch
@ -157,6 +158,7 @@ Static version of the MinGW port of the OpenSSL toolkit.
%patch23 -p1 -b .default-paths %patch23 -p1 -b .default-paths
%patch24 -p1 -b .bad-mime %patch24 -p1 -b .bad-mime
%patch25 -p1 -b .sslt1lib
%patch32 -p1 -b .ia64 %patch32 -p1 -b .ia64
#patch33 is applied after make test #patch33 is applied after make test
@ -343,6 +345,9 @@ rm -rf $RPM_BUILD_ROOT
%changelog %changelog
* Fri Mar 04 2011 Kai Tietz <ktietz@redhat.com>
- Fixes for CVE-2011-0014 openssl: OCSP stapling vulnerability
* Thu Mar 3 2011 Kai Tietz <ktietz@redhat.com> - 1.0.0a-3 * Thu Mar 3 2011 Kai Tietz <ktietz@redhat.com> - 1.0.0a-3
- Bump and rebuild. - Bump and rebuild.

28
openssl-1.0.0a-sslt1lib.patch Normal file
View File

@ -0,0 +1,28 @@
--- openssl-1.0.0a/ssl/t1_lib.c 25 Nov 2010 12:28:28 -0000 1.64.2.17
+++ openssl-1.0.0a/ssl/t1_lib.c 8 Feb 2011 00:00:00 -0000
@@ -917,6 +917,7 @@
}
n2s(data, idsize);
dsize -= 2 + idsize;
+ size -= 2 + idsize;
if (dsize < 0)
{
*al = SSL_AD_DECODE_ERROR;
@@ -955,9 +956,14 @@
}
/* Read in request_extensions */
+ if (size < 2)
+ {
+ *al = SSL_AD_DECODE_ERROR;
+ return 0;
+ }
n2s(data,dsize);
size -= 2;
- if (dsize > size)
+ if (dsize != size)
{
*al = SSL_AD_DECODE_ERROR;
return 0;