---
- branch: pkgsrc-2012Q4
  date: Fri Feb  8 16:19:00 UTC 2013
  files:
  - new: 1.170.2.1
    old: '1.170'
    path: pkgsrc/security/openssl/Makefile
    pathrev: pkgsrc/security/openssl/Makefile@1.170.2.1
    type: modified
  - new: 1.90.6.1
    old: '1.90'
    path: pkgsrc/security/openssl/distinfo
    pathrev: pkgsrc/security/openssl/distinfo@1.90.6.1
    type: modified
  id: 20130208T161900Z.3935d0e45946da0e0c7f397cf810d12295b0d7ea
  log: "Pullup ticket #4055 - requested by taca\nsecurity/openssl: security update\n\nRevisions
    pulled up:\n- security/openssl/Makefile                                     1.172\n-
    security/openssl/distinfo                                     1.91\n\n---\n   Module
    Name:\tpkgsrc\n   Committed By:\ttaca\n   Date:\t\tTue Feb  5 15:54:31 UTC 2013\n\n
    \  Modified Files:\n   \tpkgsrc/security/openssl: Makefile distinfo\n\n   Log
    Message:\n   Update openssl to 0.9.8y.\n\n    Changes between 0.9.8x and 0.9.8y
    [5 Feb 2013]\n\n     *) Make the decoding of SSLv3, TLS and DTLS CBC records constant
    time=\n   .=\n\n        This addresses the flaw in CBC record processing discovered
    by\n        Nadhem Alfardan and Kenny Paterson. Details of this attack can be
    =\n   found\n        at: http://www.isg.rhul.ac.uk/tls/\n\n        Thanks go to
    Nadhem Alfardan and Kenny Paterson of the Information=\n\n        Security Group
    at Royal Holloway, University of London\n        (www.isg.rhul.ac.uk) for discovering
    this flaw and Adam Langley an=\n   d\n        Emilia K=E4sper for the initial
    patch.\n        (CVE-2013-0169)\n        [Emilia K=E4sper, Adam Langley, Ben Laurie,
    Andy Polyakov, Steve H=\n   enson]\n\n     *) Return an error when checking OCSP
    signatures when key is NULL.\n        This fixes a DoS attack. (CVE-2013-0166)\n
    \       [Steve Henson]\n\n     *) Call OCSP Stapling callback after ciphersuite
    has been chosen, so\n        the right response is stapled. Also change SSL_get_certificate()\n
    \       so it returns the certificate actually sent.\n        See http://rt.openssl.org/Ticket/Display.html?id=3D2836.\n
    \       (This is a backport)\n        [Rob Stradling <rob.stradling@comodo.com>]\n\n
    \    *) Fix possible deadlock when decoding public keys.\n        [Steve Henson]\n"
  module: pkgsrc
  subject: 'CVS commit: [pkgsrc-2012Q4] pkgsrc/security/openssl'
  unixtime: '1360340340'
  user: tron