lp://staging/ubuntu/maverick-updates/openssl

Branch merges

Propose for merging

No branches dependent on this one.

Related source package recipes

No recipes using this branch. (?)

Create packaging recipe

Related snap packages

Related bugs

Related blueprints

53. By Steve Beattie on 2012-01-31

* SECURITY UPDATE: ECDSA private key timing attack
  - debian/patches/CVE-2011-1945.patch: compute with fixed scalar
    length
  - CVE-2011-1945
* SECURITY UPDATE: ECDH ciphersuite denial of service
  - debian/patches/CVE-2011-3210.patch: fix memory usage for thread
    safety
  - CVE-2011-3210
* SECURITY UPDATE: DTLS plaintext recovery attack
  - debian/patches/CVE-2011-4108.patch: perform all computations
    before discarding messages
  - CVE-2011-4108
* SECURITY UPDATE: policy check double free vulnerability
  - debian/patches/CVE-2011-4019.patch: only free domain policyin
    one location
  - CVE-2011-4019
* SECURITY UPDATE: SSL 3.0 block padding exposure
  - debian/patches/CVE-2011-4576.patch: clear bytes used for block
    padding of SSL 3.0 records.
  - CVE-2011-4576
* SECURITY UPDATE: malformed RFC 3779 data denial of service attack
  - debian/patches/CVE-2011-4577.patch: prevent malformed RFC3779
    data from triggering an assertion failure
  - CVE-2011-4577
* SECURITY UPDATE: Server Gated Cryptography (SGC) denial of service
  - debian/patches/CVE-2011-4619.patch: Only allow one SGC handshake
    restart for SSL/TLS.
  - CVE-2011-4619
* SECURITY UPDATE: fix for CVE-2011-4108 denial of service attack
  - debian/patches/CVE-2012-0050.patch: improve handling of DTLS MAC
  - CVE-2012-0050
* debian/patches/openssl-fix_ECDSA_tests.patch: fix ECDSA tests
* debian/libssl0.9.8.postinst: Only issue the reboot notification for
  servers by testing that the X server is not running (LP: #244250)

52. By Steve Beattie on 2011-02-09

* SECURITY UPDATE: OCSP stapling vulnerability
  - debian/patched/openssl-CVE-2011-0014-secadv_20110208.patch:
    stricter parsing of ClientHello message in ssl/t1_lib.c
  - CVE-2011-0014

51. By Steve Beattie on 2010-12-02

* SECURITY UPDATE: ciphersuite downgrade vulnerability
  - openssl-CVE-2010-4180-secadv_20101202-0.9.8.patch:
    disable workaround for Netscape cipher suite bug in ssl/s3_clnt.c
    and ssl/s3_srvr.c
  - CVE-2010-4180

50. By Steve Beattie on 2010-11-16

* SECURITY UPDATE: TLS race condition leading to a buffer overflow and
  possible code execution. (LP: #676243)
  - patches/debian/openssl-CVE-2010-3864-secadv_20101116-0.9.8.patch:
    stricter NULL/not-NULL checking in ssl/t1_lib.c
  - CVE-2010-3864

49. By Marc Deslauriers on 2010-10-06

* SECURITY UPDATE: denial of service and possible code execution via
  crafted private key with an invalid prime.
  - debian/patches/CVE-2010-2939.patch: set bn_ctx to NULL after freeing
    it in ssl/s3_clnt.c.
  - CVE-2010-2939

48. By Colin Watson on 2010-09-24

releasing version 0.9.8o-1ubuntu4

47. By Colin Watson on 2010-09-24

Update AES-NI patch to openssl-0.9.8-aesni-modes-perlasm-win32-v4.patch
from http://rt.openssl.org/Ticket/Display.html?id=2067, fixing segfault
on engine initialisation (LP: #590639).

46. By Kees Cook on 2010-07-20

debian/patches/no-sslv2.patch: disable SSLv2 to match NSS and GnuTLS.
The protocol is unsafe and extremely deprecated. (Debian bug 589706)

45. By Matthias Klose on 2010-07-19

* Don't build anymore for processors not supported anymore in maverick:
  - i486, i586 (on i386).
  - v8 (on sparc).

44. By Marc Deslauriers on 2010-06-14

* Merge from debian unstable, remaining changes (LP: #581167):
  - debian/patches/Bsymbolic-functions.patch: Link using
    -Bsymbolic-functions
  - Ship documentation in openssl-doc, suggested by the package.
  - Use a different priority for libssl0.9.8/restart-services
    depending on whether a desktop, or server dist-upgrade is being
    performed.
  - Display a system restart required notification bubble on libssl0.9.8
    upgrade.
  - Replace duplicate files in the doc directory with symlinks.
  - Move runtime libraries to /lib, for the benefit of wpasupplicant
  - Use host compiler when cross-building (patch from Neil Williams in
    Debian #465248).
  - Don't run 'make test' when cross-building.
  - Create libssl0.9.8-udeb, for the benefit of wget-udeb (LP: #503339).
  - debian/patches/aesni.patch: Backport Intel AES-NI support from
    http://rt.openssl.org/Ticket/Display.html?id=2067 (LP: #485518).
  - debian/patches/perlpath-quilt.patch: Don't change perl #! paths
    under .pc.
* Dropped patches, now upstream:
  - debian/patches/CVE-2009-3245.patch
  - debian/patches/CVE-2010-0740.patch
  - debian/patches/dtls-compatibility.patch
  - debian/patches/CVE-2009-4355.patch
* Dropped "Add support for lpia".
* Dropped "Disable SSLv2 during compile" as this had never actually
  disabled SSLv2.
* Don't disable CVE-2009-3555.patch for Maverick.