[SECURITY]: OpenSSL CVE-2022-0778

  • Done
  • quality assurance status badge
Details
One participant
  • Leo Famulari
Owner
unassigned
Submitted by
Leo Famulari
Severity
normal
L
L
Leo Famulari wrote on 15 Mar 2022 18:34
(address . guix-patches@gnu.org)
YjDOPUjLxUEh3Nda@jasmine.lan
What follows are patches to fix CVE-2022-0778 in both series of OpenSSL.

-----BEGIN PGP SIGNATURE-----

iQIzBAABCAAdFiEEsFFZSPHn08G5gDigJkb6MLrKfwgFAmIwzjQACgkQJkb6MLrK
fwjWKhAAnjSuQ6ihinZIlOklK8aT4PAttF5moMPxbFYO26YQjap0dyEj+lN7y0iF
1bxItDl5+gU6uuTU2wY6HEsPSDsnX0Y9hwqlMmj5pWU40ju74qXpTNrgwf2ITpUQ
1CkRWceUfJyM/3aEmjUYAadNwtEgdmWBpC6cVzul7gXLWSswvfOoy3sKJr9PGVlw
YOrt1b7goWh5voXhFUSUWxrmFQho5B+UTvaVPRwFFsy0oQLcLOR0umvOVTYU5m1u
ZhO+hHDPXokrBrStqNCgnC5DAcB2LluUE97clyk/piqt9G9mi2mtuQwDjqmyHKi6
QwaEKAT+dWbJRecorkNcGq9MpQXongMJTzrp6fj1aIk1o3y2cxcP7I46KeBTmkmb
yhEuwAScARp304pnZobtRw6/0Ujs17yDmyfAaVEs0pKUiMM8sSxl0RxmudoJbQJX
Yx2awAS+8cODMzhNLDOIwVtueuvuaYyXWyn3jFwccGOulo4D/YpS5cqDGNO3yCqj
C093Wq3Lxts3Gfvr+8yZJEzwdf7l3Ij1G60W4oW+CBIFz5wECXwoLErnf4S2W36B
vFsAgykYLoEBwKiMBU9ccDohpM1JOs3L9a5SmGtV27j+qOObqo/UJ6ImE7Gr+X7w
8QI4JxR2friNRt0iUA4h5zmBmxrxUOxSIiyLvFmNLT/GCcQtxRs=
=Cc/e
-----END PGP SIGNATURE-----


L
L
Leo Famulari wrote on 15 Mar 2022 18:44
[PATCH 1/2] gnu: OpenSSL: Fix CVE-2022-0778.
(address . 54402@debbugs.gnu.org)
5c138798407acaff19910d642e4268d2ed244f0e.1647366259.git.leo@famulari.name
For more information about this vulnerability:


* gnu/packages/tls.scm (openssl/fixed): Update to 1.1.1n.
---
gnu/packages/tls.scm | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)

Toggle diff (24 lines)
diff --git a/gnu/packages/tls.scm b/gnu/packages/tls.scm
index 11c01a8d2a..9ed0f3dea4 100644
--- a/gnu/packages/tls.scm
+++ b/gnu/packages/tls.scm
@@ -513,7 +513,7 @@ (define openssl/fixed
(package
(inherit openssl)
(name "openssl")
- (version "1.1.1m")
+ (version "1.1.1n")
(source (origin
(method url-fetch)
(uri (list (string-append "https://www.openssl.org/source/openssl-"
@@ -526,7 +526,7 @@ (define openssl/fixed
(patches (search-patches "openssl-1.1-c-rehash-in.patch"))
(sha256
(base32
- "15kcvdi69jka67sk1l3a50c26cb7xv9xiwdrgky4bji3ifz9k4gq"))))))
+ "0ymif8rlc5cf5qp5bh2pxlrgq6xryh7g4sqfvrdjg9gnli8ypp20"))))))
(define-public openssl-3.0
(package
--
2.34.0
L
L
Leo Famulari wrote on 15 Mar 2022 18:44
[PATCH 2/2] gnu: OpenSSL 3: Fix CVE-2022-0778.
(address . 54402@debbugs.gnu.org)
ee32fa9ab8a13856c9cbc6acc7f23cad2e0a0941.1647366259.git.leo@famulari.name
For more information about this vulnerability:


* gnu/packages/tls.scm (openssl): Update to 3.0.2.
---
gnu/packages/tls.scm | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)

Toggle diff (24 lines)
diff --git a/gnu/packages/tls.scm b/gnu/packages/tls.scm
index 9ed0f3dea4..c776085cad 100644
--- a/gnu/packages/tls.scm
+++ b/gnu/packages/tls.scm
@@ -531,7 +531,7 @@ (define openssl/fixed
(define-public openssl-3.0
(package
(inherit openssl)
- (version "3.0.1")
+ (version "3.0.2")
(source (origin
(method url-fetch)
(uri (list (string-append "https://www.openssl.org/source/openssl-"
@@ -544,7 +544,7 @@ (define-public openssl-3.0
(patches (search-patches "openssl-3.0-c-rehash-in.patch"))
(sha256
(base32
- "1l86kgn57av5yh711qp7c9zmi2haqmiah0ddxnbfgg2k6f2ss4f3"))))
+ "0qyvvw8n97f0gs786l2dkxnmi3hs344mxplw7jp5cisdmp71rscq"))))
(arguments
(substitute-keyword-arguments (package-arguments openssl)
((#:phases phases '%standard-phases)
--
2.34.0
L
L
Leo Famulari wrote on 16 Mar 2022 22:20
Re: [SECURITY]: OpenSSL CVE-2022-0778
(address . 54402-done@debbugs.gnu.org)
YjJUgy65WAe1Q8F9@jasmine.lan
I improved the commit messages and pushed these patches as
62ea3d510f1d1af76ba7fd573eea9c666558f299
Closed
?