Created attachment 7646 [details] patches-for-openssl-0.9.8o-4squeeze23.tar.gz Upstream Debian package version 0.9.8o-4squeeze23 fixes theese issues: * PKCS#7 and CMS routines: malformed X509_ATTRIBUTE structure OpenSSL will leak memory (CVE-2015-3195) * A malicious client can negotiate SSLv2 ciphers that have been disabled on the server and complete SSLv2 handshakes even if all SSLv2 ciphers have been disabled, provided that the SSLv2 protocol was not also disabled via SSL_OP_NO_SSLv2 (CVE-2015-3197) * Additionally, when using a DHE cipher suite a new DH key will always be generated for each connection. Additionally the attached tgz contains backported patches for * EVP_EncodeUpdate overflow (CVE-2016-2105) * EVP_EncryptUpdate overflow (CVE-2016-2106) * Memory corruption in the ASN.1 encoder (CVE-2016-2108) * ASN.1 BIO excessive memory allocation (CVE-2016-2109)
Created attachment 7651 [details] patches-for-openssl-0.9.8o-4squeeze23.tar.gz Updated patch bundle, the other one was incomplete.
Created attachment 7692 [details] Advisory
Tests (amd64, i386): OK
Hmm, the versioning is not ideal: Version: 0.9.8o-4.64.201303050828: ucs_3.1-0-ucs3.1-1 Version: 0.9.8o-4.121.201605261444: ucs_3.1-0-extsec3.1 Version: 0.9.8o-4.120.201605171940: ucs_3.2-0-errata3.2-8 Version: 1.0.1e-2~ucs3.3.111.201603171055: ucs_3.3-0 As it stands it would skip the update you made for Bug 41225. Probably it doesn't cause issues, but.. what do your think? Should we rebuild the package with a fixed build version increment?
(In reply to Arvid Requate from comment #4) > Hmm, the versioning is not ideal: > > Version: 0.9.8o-4.64.201303050828: ucs_3.1-0-ucs3.1-1 > Version: 0.9.8o-4.121.201605261444: ucs_3.1-0-extsec3.1 > Version: 0.9.8o-4.120.201605171940: ucs_3.2-0-errata3.2-8 > Version: 1.0.1e-2~ucs3.3.111.201603171055: ucs_3.3-0 > > As it stands it would skip the update you made for Bug 41225. Probably it > doesn't cause issues, but.. what do your think? Should we rebuild the > package with a fixed build version increment? Rebuilt
Verified: * patches applied during built * package update ok * basic function test ok The package version number in the advisory needs to be updated but we can also simply do this during package announce.
<http://errata.software-univention.de/ucs/3.1/289.html>