[Buildroot] [PATCH] package/libopenssl: security bump to version 1.1.1q

[Buildroot] [PATCH] package/libopenssl: security bump to version 1.1.1q

[Peter Korsgaard]

Fixes the following security issues:

AES OCB fails to encrypt some bytes (CVE-2022-2097)
===================================================

Severity: MODERATE

AES OCB mode for 32-bit x86 platforms using the AES-NI assembly optimised
implementation will not encrypt the entirety of the data under some
circumstances.  This could reveal sixteen bytes of data that was
preexisting in the memory that wasn't written.  In the special case of
"in place" encryption, sixteen bytes of the plaintext would be revealed.

Since OpenSSL does not support OCB based cipher suites for TLS and DTLS,
they are both unaffected.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
---
 package/libopenssl/libopenssl.hash | 4 ++--
 package/libopenssl/libopenssl.mk   | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/package/libopenssl/libopenssl.hash b/package/libopenssl/libopenssl.hash
index 2f76241c72..8457df6c0a 100644
--- a/package/libopenssl/libopenssl.hash
+++ b/package/libopenssl/libopenssl.hash
@@ -1,5 +1,5 @@
-# From https://www.openssl.org/source/openssl-1.1.1p.tar.gz.sha256
-sha256  bf61b62aaa66c7c7639942a94de4c9ae8280c08f17d4eac2e44644d9fc8ace6f  openssl-1.1.1p.tar.gz
+# From https://www.openssl.org/source/openssl-1.1.1q.tar.gz.sha256
+sha256  d7939ce614029cdff0b6c20f0e2e5703158a489a72b2507b8bd51bf8c8fd10ca  openssl-1.1.1q.tar.gz
 
 # License files
 sha256  c32913b33252e71190af2066f08115c69bc9fddadf3bf29296e20c835389841c  LICENSE
diff --git a/package/libopenssl/libopenssl.mk b/package/libopenssl/libopenssl.mk
index 195438c6b5..135129d47f 100644
--- a/package/libopenssl/libopenssl.mk
+++ b/package/libopenssl/libopenssl.mk
@@ -4,7 +4,7 @@
 #
 ################################################################################
 
-LIBOPENSSL_VERSION = 1.1.1p
+LIBOPENSSL_VERSION = 1.1.1q
 LIBOPENSSL_SITE = https://www.openssl.org/source
 LIBOPENSSL_SOURCE = openssl-$(LIBOPENSSL_VERSION).tar.gz
 LIBOPENSSL_LICENSE = OpenSSL or SSLeay
-- 
2.30.2

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH] package/libopenssl: security bump to version 1.1.1q

[Peter Korsgaard]

>>>>> "Peter" == Peter Korsgaard <peter@korsgaard.com> writes:

 > Fixes the following security issues:
 > AES OCB fails to encrypt some bytes (CVE-2022-2097)
 > ===================================================

 > Severity: MODERATE

 > AES OCB mode for 32-bit x86 platforms using the AES-NI assembly optimised
 > implementation will not encrypt the entirety of the data under some
 > circumstances.  This could reveal sixteen bytes of data that was
 > preexisting in the memory that wasn't written.  In the special case of
 > "in place" encryption, sixteen bytes of the plaintext would be revealed.

 > Since OpenSSL does not support OCB based cipher suites for TLS and DTLS,
 > they are both unaffected.

 > Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

Committed, thanks.

-- 
Bye, Peter Korsgaard
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH] package/libopenssl: security bump to version 1.1.1q

[Peter Korsgaard]

>>>>> "Peter" == Peter Korsgaard <peter@korsgaard.com> writes:
 >> Fixes the following security issues:
 >> AES OCB fails to encrypt some bytes (CVE-2022-2097)
 >> ===================================================

 >> Severity: MODERATE

 >> AES OCB mode for 32-bit x86 platforms using the AES-NI assembly optimised
 >> implementation will not encrypt the entirety of the data under some
 >> circumstances.  This could reveal sixteen bytes of data that was
 >> preexisting in the memory that wasn't written.  In the special case of
 >> "in place" encryption, sixteen bytes of the plaintext would be revealed.

 >> Since OpenSSL does not support OCB based cipher suites for TLS and DTLS,
 >> they are both unaffected.

 >> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

Committed to 2022.05.x and 2022.02.x, thanks.

-- 
Bye, Peter Korsgaard
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot