--- - branch: pkgsrc-2014Q2 date: Wed Jul 16 11:53:40 UTC 2014 files: - new: 1.4.2.1 old: '1.4' path: pkgsrc/security/polarssl/Makefile pathrev: pkgsrc/security/polarssl/Makefile@1.4.2.1 type: modified - new: 1.2.8.1 old: '1.2' path: pkgsrc/security/polarssl/distinfo pathrev: pkgsrc/security/polarssl/distinfo@1.2.8.1 type: modified id: 20140716T115340Z.ebd0ea8c097806ba2cd1d9f301cb8b71d5fd5c4c log: "Pullup ticket #4452 - requested by obache\nsecurity/polarssl: security update\n\nRevisions pulled up:\n- security/polarssl/Makefile 1.5\n- security/polarssl/distinfo 1.3\n\n---\n Module Name:\tpkgsrc\n Committed By:\tobache\n Date:\t\tWed Jul 16 10:03:57 UTC 2014\n\n \ Modified Files:\n \tpkgsrc/security/polarssl: Makefile distinfo\n\n Log Message:\n PolarSSL ChangeLog\n\n = Version 1.2.11 released 2014-07-11\n Features\n \ * Entropy module now supports seed writing and reading\n\n Changes\n * Introduced POLARSSL_HAVE_READDIR_R for systems without it\n * Improvements to the CMake build system, contributed by Julian Ospald.\n * Work around a bug of the version of Clang shipped by Apple with\n Mavericks that prevented bignum.c from compiling. (Reported by Rafael\n Baptista.) * Improvements to tests/Makefile, contributed by Oden\n Eriksson. * Use UTC time to check certificate validity.\n * Reject certificates with times not in UTC, per RFC 5280.\n * Migrate zeroizing of data to polarssl_zeroize() instead of memset()\n against unwanted compiler optimizations\n\n Security\n * Forbid change of server certificate during renegotiation to prevent\n \"triple handshake\" attack when authentication mode is optional (the\n attack was already impossible when authentication is required).\n * Check notBefore timestamp of certificates and CRLs from the future.\n * Forbid sequence number wrapping\n * Prevent potential NULL pointer dereference in ssl_read_record() (found\n by TrustInSoft)\n * Fix length checking for AEAD ciphersuites (found by Codenomicon).\n It was possible to crash the server (and client) using crafted messages\n when a GCM suite was chosen.\n\n Bugfix\n * Fixed X.509 hostname comparison (with non-regular characters)\n * SSL now gracefully handles missing RNG\n * crypt_and_hash app checks MAC before final decryption\n * Fixed x509_crt_parse_path() bug on Windows platforms\n * Added missing MPI_CHK() around some statements in mpi_div_mpi() (found\n by \ TrustInSoft)\n * Fixed potential overflow in certificate size verification in\n ssl_write_certificate() (found by TrustInSoft)\n * Fix ASM format in bn_mul.h\n * Potential memory leak in bignum_selftest()\n * Replaced expired test certificate\n * ssl_mail_client now terminates lines with CRLF, instead of LF\n * Fix bug in RSA PKCS#1 v1.5 \"reversed\" operations\n * Fixed testing with out-of-source builds using cmake\n * Fixed version-major intolerance in server\n * Fixed CMake symlinking on out-of-source builds\n \ * Bignum's MIPS-32 assembly was used on MIPS-64, causing chaos. (Found by\n \ Alex Wilson.)\n * ssl_init() was leaving a dirty pointer in ssl_context if malloc of\n out_ctr failed\n * ssl_handshake_init() was leaving dirty pointers in subcontexts if\n malloc of one of them failed\n * x509_get_current_time() uses localtime_r() to prevent thread issues\n * Some example server programs were not sending the close_notify alert.\n * Potential memory leak in mpi_exp_mod() when error occurs during\n calculation of RR.\n * Improve interoperability by not writing extension length in ClientHello\n \ when no extensions are present (found by Matthew Page)\n * rsa_check_pubkey() now allows an E up to N\n * On OpenBSD, use arc4random_buf() instead of rand() to prevent warnings\n * mpi_fill_random() was creating numbers larger than requested on\n big-endian platform when size was not an integer number of limbs\n * Fix detection of DragonflyBSD in net.c (found by Markus Pfeiffer)\n \ * Stricter check on SSL ClientHello internal sizes compared to actual\n \ packet size (found by TrustInSoft)\n * Fix preprocessor checks for bn_mul PPC asm (found by Barry K. Nathan).\n * Use \\n\\t rather than semicolons for bn_mul asm, since some assemblers\n interpret semicolons as comment delimiters (found by Barry K. Nathan).\n * Disable broken Sparc64 bn_mul assembly (found by Florian Obser).\n * Fix base64_decode() to return and check length correctly (in case of\n tight buffers)\n\n = Version 1.2.10 released 2013-10-07\n Changes\n * Changed RSA blinding to a slower but thread-safe version\n * Make get_pkcs_padding() constant-time\n\n Bugfix\n \ * Fixed memory leak in RSA as a result of introduction of blinding\n * Fixed ssl_pkcs11_decrypt() prototype\n * Fixed MSVC project files\n\n = Version 1.2.9 released 2013-10-01\n Changes\n * x509_verify() now case insensitive for cn (RFC 6125 6.4)\n\n Bugfix\n * Fixed potential memory leak when failing to resume a session\n * Fixed potential file descriptor leaks (found by Remi Gacogne)\n * Minor fixes\n\n Security\n * Fixed potential heap buffer overflow on large hostname setting\n * Fixed potential negative value misinterpretation in load_file()\n * RSA blinding on CRT operations to counter timing attacks\n (found by Cyril Arnaud and Pierre-Alain Fouque)\n" module: pkgsrc subject: 'CVS commit: [pkgsrc-2014Q2] pkgsrc/security/polarssl' unixtime: '1405511620' user: tron