openssl 0.9.8k-7ubuntu8.23 source package in Ubuntu

Changelog

openssl (0.9.8k-7ubuntu8.23) lucid-security; urgency=medium

  * SECURITY UPDATE: denial of service via unexpected handshake when
    no-ssl3 build option is used (not the default)
    - debian/patches/CVE-2014-3569.patch: keep the old method for now in
      ssl/s23_srvr.c.
    - CVE-2014-3569
  * SECURITY UPDATE: bignum squaring may produce incorrect results
    - debian/patches/CVE-2014-3570.patch: fix bignum logic in
      crypto/bn/asm/mips3.s, crypto/bn/asm/x86_64-gcc.c,
      crypto/bn/bn_asm.c, added test to crypto/bn/bntest.c.
    - CVE-2014-3570
  * SECURITY UPDATE: DTLS segmentation fault in dtls1_get_record
    - debian/patches/CVE-2014-3571.patch: fix crash in ssl/d1_pkt.c,
      ssl/s3_pkt.c.
    - CVE-2014-3571
  * SECURITY UPDATE: ECDHE silently downgrades to ECDH [Client]
    - debian/patches/CVE-2014-3572.patch: don't skip server key exchange in
      ssl/s3_clnt.c.
    - CVE-2014-3572
  * SECURITY UPDATE: certificate fingerprints can be modified
    - debian/patches/CVE-2014-8275.patch: fix various fingerprint issues in
      crypto/asn1/a_bitstr.c, crypto/asn1/a_type.c, crypto/asn1/a_verify.c,
      crypto/asn1/asn1.h, crypto/asn1/asn1_err.c, crypto/asn1/x_algor.c,
      crypto/dsa/dsa_asn1.c, crypto/ecdsa/ecs_vrf.c, crypto/x509/x509.h,
      crypto/x509/x_all.c, util/libeay.num.
    - CVE-2014-8275
  * SECURITY UPDATE: RSA silently downgrades to EXPORT_RSA [Client]
    - debian/patches/CVE-2015-0204.patch: only allow ephemeral RSA keys in
      export ciphersuites in ssl/d1_srvr.c, ssl/s3_clnt.c, ssl/s3_srvr.c,
      ssl/ssl.h, adjust documentation in doc/ssl/SSL_CTX_set_options.pod,
      doc/ssl/SSL_CTX_set_tmp_rsa_callback.pod.
    - CVE-2015-0204
 -- Marc Deslauriers <email address hidden>   Fri, 09 Jan 2015 11:16:50 -0500

Upload details

Uploaded by:
Marc Deslauriers on 2015-01-09
Uploaded to:
Lucid
Original maintainer:
Ubuntu Developers
Architectures:
any
Section:
utils
Urgency:
Medium Urgency

See full publishing history Publishing

Series Pocket Published Component Section

Downloads

File Size SHA-256 Checksum
openssl_0.9.8k.orig.tar.gz 3.7 MiB 7e7cd4f3974199b729e6e3a0af08bd4279fde0370a1120c1a3b351ab090c6101
openssl_0.9.8k-7ubuntu8.23.diff.gz 173.0 KiB e75f4febd1eface1a6ec5e15be4baeaf0237f2385ef284210f35b39895b24e10
openssl_0.9.8k-7ubuntu8.23.dsc 2.0 KiB 8a61290c599dcdd8ca3757c7770932f17fb991f84bd847464e1044e97b40a74f

View changes file

Binary packages built by this source

libcrypto0.9.8-udeb: No summary available for libcrypto0.9.8-udeb in ubuntu lucid.

No description available for libcrypto0.9.8-udeb in ubuntu lucid.

libssl-dev: No summary available for libssl-dev in ubuntu lucid.

No description available for libssl-dev in ubuntu lucid.

libssl0.9.8: No summary available for libssl0.9.8 in ubuntu lucid.

No description available for libssl0.9.8 in ubuntu lucid.

libssl0.9.8-dbg: No summary available for libssl0.9.8-dbg in ubuntu lucid.

No description available for libssl0.9.8-dbg in ubuntu lucid.

libssl0.9.8-udeb: No summary available for libssl0.9.8-udeb in ubuntu lucid.

No description available for libssl0.9.8-udeb in ubuntu lucid.

openssl: No summary available for openssl in ubuntu lucid.

No description available for openssl in ubuntu lucid.

openssl-doc: No summary available for openssl-doc in ubuntu lucid.

No description available for openssl-doc in ubuntu lucid.