Link [ pkgsrc | NetBSD | pkgsrc git mirror | PR fulltext-search | netbsd commit viewer ]


   
        usage: [branch:branch] [user:user] [path[@revision]] keyword [... [-excludekeyword [...]]] (e.g. branch:MAIN pkgtools/pkg)




switch to index mode

recent branches: MAIN (1h)  pkgsrc-2024Q1 (10d)  pkgsrc-2023Q4 (57d)  pkgsrc-2023Q2 (89d)  pkgsrc-2023Q3 (169d) 

2024-05-28 05:49:25 UTC Now

2024-02-03 18:21:26 UTC MAIN commitmail json YAML

openssl: updated to 3.1.5

Changes between 3.1.4 and 3.1.5 [30 Jan 2024]

* A file in PKCS12 format can contain certificates and keys and may come from
  an untrusted source. The PKCS12 specification allows certain fields to be
  NULL, but OpenSSL did not correctly check for this case. A fix has been
  applied to prevent a NULL pointer dereference that results in OpenSSL
  crashing. If an application processes PKCS12 files from an untrusted source
  using the OpenSSL APIs then that application will be vulnerable to this
  issue prior to this fix.

  OpenSSL APIs that were vulnerable to this are: PKCS12_parse(),
  PKCS12_unpack_p7data(), PKCS12_unpack_p7encdata(), PKCS12_unpack_authsafes()
  and PKCS12_newpass().

  We have also fixed a similar issue in SMIME_write_PKCS7(). However since this
  function is related to writing data we do not consider it security
  significant.

  ([CVE-2024-0727])

(adam)