Skip to content

Commit

Permalink
Patched our OpenSSL 1.1.1 sources for CVE-2024-2511, CVE-2024-4741, C…
Browse files Browse the repository at this point in the history
  • Loading branch information
dumol committed Aug 15, 2024
1 parent 0a58cdb commit 80735e7
Show file tree
Hide file tree
Showing 3,106 changed files with 112 additions and 39 deletions.
The diff you're trying to view is too large. We only load the first 3000 changed files.
Original file line number Diff line number Diff line change
Expand Up @@ -433,7 +433,7 @@ def main():
openssl_version = backend.openssl_version_text()
if CHEVAH_OS.startswith(("win", "lnx", "macos", "aix")):
# On some OS'es we build against our own OpenSSL.
expecting = u'OpenSSL 1.1.1w-chevah1 26 Jul 2024'
expecting = u'OpenSSL 1.1.1w-chevah2 15 Aug 2024'
if CHEVAH_OS.startswith("aix"):
# On AIX we are stuck with a patched 1.0.2.
expecting = u'OpenSSL 1.0.2v-chevah5 21 Sep 2023'
Expand Down
7 changes: 5 additions & 2 deletions src/openssl/README
Original file line number Diff line number Diff line change
@@ -1,6 +1,9 @@
# OpenSSL 1.0.2 sources are patched with latest security fixes from the
# CentOS 7 sources at https://git.centos.org/rpms/openssl/blob/c7/f/SOURCES.
# Latest patches are at https://git.centos.org/rpms/openssl/commits/c7.
# Until 2023, Ubuntu Server 16.04 source packages were available for download at
# http://archive.ubuntu.com/ubuntu/pool/main/o/openssl/. E.g.
# If not found above, latest patches for OpenSSL 1.1.1 are in 1.1.1f sources for
# Ubuntu 20.04 at http://archive.ubuntu.com/ubuntu/pool/main/o/openssl/. E.g.
# http://archive.ubuntu.com/ubuntu/pool/main/o/openssl/openssl_1.1.1f-1ubuntu2.23.debian.tar.xz
# Until 2023, Ubuntu Server 16.04 source updates for OpenSSL 1.0.2 were
# available at http://archive.ubuntu.com/ubuntu/pool/main/o/openssl/. E.g.
# http://archive.ubuntu.com/ubuntu/pool/main/o/openssl/openssl_1.0.2g-1ubuntu4.19.debian.tar.xz
File renamed without changes.
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,22 @@
https://github.com/openssl/openssl/commits/ and pick the appropriate
release branch.


Changes between 1.1.1w-chevah1 and 1.1.1w-chevah2 [15 Aug 2024]

*) Fix SSL_select_next_proto buffer overread.

(CVE-2024-5535)

*) Fix Use After Free with SSL_free_buffers.

(CVE-2024-4741)

*) Fix unbounded memory growth with session handling in TLSv1.3.

(CVE-2024-2511)


Changes between 1.1.1w and 1.1.1w-chevah1 [26 Jul 2024]

*) Fix PKCS12 decoding crashes.
Expand All @@ -17,6 +33,7 @@

(CVE-2023-5678)


Changes between 1.1.1v and 1.1.1w [11 Sep 2023]

*) Fix POLY1305 MAC implementation corrupting XMM registers on Windows.
Expand Down
File renamed without changes.
File renamed without changes.
File renamed without changes.
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,13 @@
This file gives a brief overview of the major changes between each OpenSSL
release. For more details please read the CHANGES file.

Major changes between OpenSSL 1.1.1w-chevah1 and 1.1.1w-chevah2 [15 Aug 2024]

o Fix SSL_select_next_proto buffer overread (CVE-2024-5535)
o Fix Use After Free with SSL_free_buffers (CVE-2024-4741)
o Fix unbounded memory growth with session handling in TLSv1.3
(CVE-2024-2511)

Major changes between OpenSSL 1.1.1w and OpenSSL 1.1.1w-chevah1 [26 Jul 2024]

o Fix PKCS12 decoding crashes (CVE-2024-0727)
Expand Down
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@

OpenSSL 1.1.1w-chevah1 26 Jul 2024
OpenSSL 1.1.1w-chevah2 15 Aug 2024

Copyright (c) 1998-2023 The OpenSSL Project
Copyright (c) 1995-1998 Eric A. Young, Tim J. Hudson
Expand Down
File renamed without changes.
Loading

0 comments on commit 80735e7

Please sign in to comment.