OpenBSD errata, Dec 3, 2015

Previous Topic Next Topic
 
classic Classic list List threaded Threaded
1 message Options
Reply | Threaded
Open this post in threaded view
|  
Report Content as Inappropriate

OpenBSD errata, Dec 3, 2015

Bob Beck-3

Four new OpenSSL CVE's were released today, which OpenSSL deemed to be
not of sufficient severity to warrant advance disclosure.

OpenBSD/LibreSSL is not vulnerable to two of these CVE's.

CVE-2015-1393: Recently introduced in OpenSSL only. We did not merge
this because it gave miod@ a bad feeling.

CVE-2015-1394: NULL pointer dereference in client side certificate
validation. It was reported to OpenSSL on Aug 27, 2015, and kept
secret from the community until Dec 3, 2015 by OpenSSL and the
reporter of the bug.

CVE-2015-1395: Memory leak in PKCS7 - not reachable from TLS/SSL

CVE-2015-1396: String handling bug in code we deleted long ago, using
a function that all uses of which were flensed from LibreSSL shortly
after it's creation.

Fixes have been commited for both CVE-2015-1394 and CVE-2015-1395.
CVE-2015-1394 warrants an errata.

The errata for CVE-2015-1394 is available for OpenBSD 5.8 and OpenBSD
5.7 from the master site as well as the mirrors:

http://ftp.openbsd.org/pub/OpenBSD/patches/5.8/common/009_clientcert.patch.sig
http://ftp.openbsd.org/pub/OpenBSD/patches/5.7/common/021_clientcert.patch.sig

Loading...