* [Buildroot] [PATCH 1/1] package/libopenssl: security bump to version 1.0.2p
@ 2018-08-17 5:32 Bernd Kuhls
2018-08-17 7:04 ` Peter Korsgaard
2018-08-24 8:41 ` Peter Korsgaard
0 siblings, 2 replies; 5+ messages in thread
From: Bernd Kuhls @ 2018-08-17 5:32 UTC (permalink / raw)
To: buildroot
Fixes CVE-2018-0732 & CVE-2018-0737:
https://www.openssl.org/news/vulnerabilities.html
Added upstream sha1 hash.
Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
---
package/libopenssl/libopenssl.hash | 6 ++++--
package/libopenssl/libopenssl.mk | 2 +-
2 files changed, 5 insertions(+), 3 deletions(-)
diff --git a/package/libopenssl/libopenssl.hash b/package/libopenssl/libopenssl.hash
index 48b7471c20..2b1e048751 100644
--- a/package/libopenssl/libopenssl.hash
+++ b/package/libopenssl/libopenssl.hash
@@ -1,5 +1,7 @@
-# From https://www.openssl.org/source/openssl-1.0.2o.tar.gz.sha256
-sha256 ec3f5c9714ba0fd45cb4e087301eb1336c317e0d20b575a125050470e8089e4d openssl-1.0.2o.tar.gz
+# From https://www.openssl.org/source/openssl-1.0.2p.tar.gz.sha256
+sha256 50a98e07b1a89eb8f6a99477f262df71c6fa7bef77df4dc83025a2845c827d00 openssl-1.0.2p.tar.gz
+# From https://www.openssl.org/source/openssl-1.0.2p.tar.gz.sha1
+sha1 f34b5322e92415755c7d58bf5d0d5cf37666382c openssl-1.0.2p.tar.gz
# Locally computed
sha256 eddd8a5123748052c598214487ac178e4bfa4e31ba2ec520c70d59c8c5bfa2e9 openssl-1.0.2a-parallel-install-dirs.patch?id=c8abcbe8de5d3b6cdd68c162f398c011ff6e2d9d
sha256 147c3eeaad614c044749ea527cb433eae5e2d5cad34a78c6ba61cd967bfbe01f openssl-1.0.2a-parallel-obj-headers.patch?id=c8abcbe8de5d3b6cdd68c162f398c011ff6e2d9d
diff --git a/package/libopenssl/libopenssl.mk b/package/libopenssl/libopenssl.mk
index 16a9c2e9d2..d8e3dd8b56 100644
--- a/package/libopenssl/libopenssl.mk
+++ b/package/libopenssl/libopenssl.mk
@@ -4,7 +4,7 @@
#
################################################################################
-LIBOPENSSL_VERSION = 1.0.2o
+LIBOPENSSL_VERSION = 1.0.2p
LIBOPENSSL_SITE = http://www.openssl.org/source
LIBOPENSSL_SOURCE = openssl-$(LIBOPENSSL_VERSION).tar.gz
LIBOPENSSL_LICENSE = OpenSSL or SSLeay
--
2.18.0
^ permalink raw reply related [flat|nested] 5+ messages in thread
* [Buildroot] [PATCH 1/1] package/libopenssl: security bump to version 1.0.2p
2018-08-17 5:32 [Buildroot] [PATCH 1/1] package/libopenssl: security bump to version 1.0.2p Bernd Kuhls
@ 2018-08-17 7:04 ` Peter Korsgaard
2018-08-17 17:08 ` Bernd Kuhls
2018-08-24 8:41 ` Peter Korsgaard
1 sibling, 1 reply; 5+ messages in thread
From: Peter Korsgaard @ 2018-08-17 7:04 UTC (permalink / raw)
To: buildroot
>>>>> "Bernd" == Bernd Kuhls <bernd.kuhls@t-online.de> writes:
> Fixes CVE-2018-0732 & CVE-2018-0737:
> https://www.openssl.org/news/vulnerabilities.html
> Added upstream sha1 hash.
I'm not sure that really buys us much, but OK.
Committed, thanks.
--
Bye, Peter Korsgaard
^ permalink raw reply [flat|nested] 5+ messages in thread
* [Buildroot] [PATCH 1/1] package/libopenssl: security bump to version 1.0.2p
2018-08-17 7:04 ` Peter Korsgaard
@ 2018-08-17 17:08 ` Bernd Kuhls
2018-08-17 17:29 ` Peter Korsgaard
0 siblings, 1 reply; 5+ messages in thread
From: Bernd Kuhls @ 2018-08-17 17:08 UTC (permalink / raw)
To: buildroot
Am Fri, 17 Aug 2018 09:04:45 +0200 schrieb Peter Korsgaard:
>>>>>> "Bernd" == Bernd Kuhls
>>>>>> <bernd.kuhls@t-online.de> writes:
> > Added upstream sha1 hash.
>
> I'm not sure that really buys us much, but OK.
Hi Peter,
I am just following the manual:
http://buildroot.uclibc.org/downloads/manual/manual.html#adding-packages-
hash
"If upstream provides more than one type of hash (e.g. sha1 and sha512),
then it is best to add all those hashes in the .hash file."
Regards, Bernd
^ permalink raw reply [flat|nested] 5+ messages in thread
* [Buildroot] [PATCH 1/1] package/libopenssl: security bump to version 1.0.2p
2018-08-17 17:08 ` Bernd Kuhls
@ 2018-08-17 17:29 ` Peter Korsgaard
0 siblings, 0 replies; 5+ messages in thread
From: Peter Korsgaard @ 2018-08-17 17:29 UTC (permalink / raw)
To: buildroot
>>>>> "Bernd" == Bernd Kuhls <bernd.kuhls@t-online.de> writes:
> Am Fri, 17 Aug 2018 09:04:45 +0200 schrieb Peter Korsgaard:
>>>>>>> "Bernd" == Bernd Kuhls
>>>>>>> <bernd.kuhls@t-online.de> writes:
>> > Added upstream sha1 hash.
>>
>> I'm not sure that really buys us much, but OK.
> Hi Peter,
> I am just following the manual:
> http://buildroot.uclibc.org/downloads/manual/manual.html#adding-packages-
> hash
> "If upstream provides more than one type of hash (e.g. sha1 and sha512),
> then it is best to add all those hashes in the .hash file."
Heh, you win ;) I believe this was originally aimed at weaker hashes
(md5 and sha1), but you're right, it doesn't harm.
Thanks for the patch!
--
Bye, Peter Korsgaard
^ permalink raw reply [flat|nested] 5+ messages in thread
* [Buildroot] [PATCH 1/1] package/libopenssl: security bump to version 1.0.2p
2018-08-17 5:32 [Buildroot] [PATCH 1/1] package/libopenssl: security bump to version 1.0.2p Bernd Kuhls
2018-08-17 7:04 ` Peter Korsgaard
@ 2018-08-24 8:41 ` Peter Korsgaard
1 sibling, 0 replies; 5+ messages in thread
From: Peter Korsgaard @ 2018-08-24 8:41 UTC (permalink / raw)
To: buildroot
>>>>> "Bernd" == Bernd Kuhls <bernd.kuhls@t-online.de> writes:
> Fixes CVE-2018-0732 & CVE-2018-0737:
> https://www.openssl.org/news/vulnerabilities.html
> Added upstream sha1 hash.
> Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Committed to 2018.02.x and 2018.05.x, thanks.
--
Bye, Peter Korsgaard
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2018-08-24 8:41 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2018-08-17 5:32 [Buildroot] [PATCH 1/1] package/libopenssl: security bump to version 1.0.2p Bernd Kuhls
2018-08-17 7:04 ` Peter Korsgaard
2018-08-17 17:08 ` Bernd Kuhls
2018-08-17 17:29 ` Peter Korsgaard
2018-08-24 8:41 ` Peter Korsgaard
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox