Issue metadata
Sign in to add a comment
|
CrOS: Vulnerability reported in dev-libs/openssl |
||||||||||||||||||||||||||||
Issue descriptionAutomated analysis has detected that the following third party packages have had vulnerabilities publicly reported. NOTE: There may be several bugs listed below - in almost all cases, all bugs can be quickly addressed by upgrading to the latest version of the package. Package Name: dev-libs/openssl Package Version: [cpe:/a:openssl:openssl:1.0.2h] Advisory: CVE-2016-2179 Details: https://vomit.googleplex.com/advisory?id=CVE/CVE-2016-2179 CVSS severity score: 5/10.0 Confidence: high Description: The DTLS implementation in OpenSSL before 1.1.0 does not properly restrict the lifetime of queue entries associated with unused out-of-order messages, which allows remote attackers to cause a denial of service (memory consumption) by maintaining many crafted DTLS sessions simultaneously, related to d1_lib.c, statem_dtls.c, statem_lib.c, and statem_srvr.c. Advisory: CVE-2016-2181 Details: https://vomit.googleplex.com/advisory?id=CVE/CVE-2016-2181 CVSS severity score: 5/10.0 Confidence: high Description: The Anti-Replay feature in the DTLS implementation in OpenSSL before 1.1.0 mishandles early use of a new epoch number in conjunction with a large sequence number, which allows remote attackers to cause a denial of service (false-positive packet drops) via spoofed DTLS records, related to rec_layer_d1.c and ssl3_record.c. Advisory: CVE-2016-2182 Details: https://vomit.googleplex.com/advisory?id=CVE/CVE-2016-2182 CVSS severity score: 7.5/10.0 Confidence: high Description: The BN_bn2dec function in crypto/bn/bn_print.c in OpenSSL before 1.1.0 does not properly validate division results, which allows remote attackers to cause a denial of service (out-of-bounds write and application crash) or possibly have unspecified other impact via unknown vectors. Advisory: CVE-2016-6302 Details: https://vomit.googleplex.com/advisory?id=CVE/CVE-2016-6302 CVSS severity score: 5/10.0 Confidence: high Description: The tls_decrypt_ticket function in ssl/t1_lib.c in OpenSSL before 1.1.0 does not consider the HMAC size during validation of the ticket length, which allows remote attackers to cause a denial of service via a ticket that is too short. Advisory: CVE-2016-6303 Details: https://vomit.googleplex.com/advisory?id=CVE/CVE-2016-6303 CVSS severity score: 7.5/10.0 Confidence: high Description: Integer overflow in the MDC2_Update function in crypto/mdc2/mdc2dgst.c in OpenSSL before 1.1.0 allows remote attackers to cause a denial of service (out-of-bounds write and application crash) or possibly have unspecified other impact via unknown vectors.
,
Sep 19 2016
,
Sep 19 2016
,
Sep 20 2016
Fixed in: https://chromium-review.googlesource.com/#/c/387266/1. Thanks Andrey!
,
Sep 20 2016
,
Sep 20 2016
,
Sep 21 2016
,
Sep 21 2016
Andrey, will this be pulled into M-54?
,
Sep 22 2016
The following revision refers to this bug: https://chromium.googlesource.com/chromiumos/overlays/chromiumos-overlay/+/9a8bddc947c1c8052bc486edcc216001cde0267a commit 9a8bddc947c1c8052bc486edcc216001cde0267a Author: Andrey Ulanov <andreyu@google.com> Date: Mon Sep 19 23:32:28 2016 openssl: add a few security patches The following CVEs are fixed: CVE-2016-2177 CVE-2016-2178 CVE-2016-2179 CVE-2016-2181 CVE-2016-2182 CVE-2016-6302 CVE-2016-6303 BUG=b:29558011 BUG=b:31562497 BUG= chromium:647919 TEST=emerge openssl Change-Id: I8c707379daea6bde356b5989300dab60cf88881c Reviewed-on: https://chromium-review.googlesource.com/387266 Commit-Ready: Andrey Ulanov <andreyu@google.com> Tested-by: Andrey Ulanov <andreyu@google.com> Reviewed-by: Mike Frysinger <vapier@chromium.org> [add] https://crrev.com/9a8bddc947c1c8052bc486edcc216001cde0267a/dev-libs/openssl/files/openssl-1.0.2h-CVE-2016-6302.patch [add] https://crrev.com/9a8bddc947c1c8052bc486edcc216001cde0267a/dev-libs/openssl/files/openssl-1.0.2h-CVE-2016-2177.patch [add] https://crrev.com/9a8bddc947c1c8052bc486edcc216001cde0267a/dev-libs/openssl/files/openssl-1.0.2h-CVE-2016-2178.patch [add] https://crrev.com/9a8bddc947c1c8052bc486edcc216001cde0267a/dev-libs/openssl/files/openssl-1.0.2h-CVE-2016-2181.patch [add] https://crrev.com/9a8bddc947c1c8052bc486edcc216001cde0267a/dev-libs/openssl/files/openssl-1.0.2h-CVE-2016-2182.patch [add] https://crrev.com/9a8bddc947c1c8052bc486edcc216001cde0267a/dev-libs/openssl/files/openssl-1.0.2h-CVE-2016-2179.patch [rename] https://crrev.com/9a8bddc947c1c8052bc486edcc216001cde0267a/dev-libs/openssl/openssl-1.0.2h-r3.ebuild [add] https://crrev.com/9a8bddc947c1c8052bc486edcc216001cde0267a/dev-libs/openssl/files/openssl-1.0.2h-CVE-2016-6303.patch
,
Sep 22 2016
these patches shouldn't be too much of a risk to backport
,
Sep 23 2016
[Automated comment] Request affecting a post-stable build (M52), manual review required.
,
Sep 23 2016
[Automated comment] Request affecting a post-stable build (M53), manual review required.
,
Sep 23 2016
Your change meets the bar and is auto-approved for M54 (branch: 2840)
,
Sep 23 2016
[Automated comment] Request affecting a post-stable build (M52), manual review required.
,
Sep 23 2016
[Automated comment] Request affecting a post-stable build (M53), manual review required.
,
Sep 23 2016
[Automated comment] Request affecting a post-stable build (M52), manual review required.
,
Sep 23 2016
Please mark security bugs as fixed as soon as the fix lands, and before requesting merges. This update is based on the merge- labels applied to this issue. Please reopen if this update was incorrect. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
,
Sep 23 2016
,
Sep 23 2016
The following revision refers to this bug: https://chromium.googlesource.com/chromiumos/overlays/chromiumos-overlay/+/9f1259d730fa724e0c31ef6e7059f0fd155cf299 commit 9f1259d730fa724e0c31ef6e7059f0fd155cf299 Author: Andrey Ulanov <andreyu@google.com> Date: Mon Sep 19 23:32:28 2016 openssl: add a few security patches The following CVEs are fixed: CVE-2016-2177 CVE-2016-2178 CVE-2016-2179 CVE-2016-2181 CVE-2016-2182 CVE-2016-6302 CVE-2016-6303 BUG=b:29558011 BUG=b:31562497 BUG= chromium:647919 TEST=emerge openssl Reviewed-on: https://chromium-review.googlesource.com/387266 Commit-Ready: Andrey Ulanov <andreyu@google.com> Tested-by: Andrey Ulanov <andreyu@google.com> Reviewed-by: Mike Frysinger <vapier@chromium.org> Change-Id: I8c707379daea6bde356b5989300dab60cf88881c Reviewed-on: https://chromium-review.googlesource.com/388069 Commit-Queue: Andrey Ulanov <andreyu@google.com> [add] https://crrev.com/9f1259d730fa724e0c31ef6e7059f0fd155cf299/dev-libs/openssl/files/openssl-1.0.2h-CVE-2016-6302.patch [add] https://crrev.com/9f1259d730fa724e0c31ef6e7059f0fd155cf299/dev-libs/openssl/files/openssl-1.0.2h-CVE-2016-2177.patch [add] https://crrev.com/9f1259d730fa724e0c31ef6e7059f0fd155cf299/dev-libs/openssl/files/openssl-1.0.2h-CVE-2016-2178.patch [add] https://crrev.com/9f1259d730fa724e0c31ef6e7059f0fd155cf299/dev-libs/openssl/files/openssl-1.0.2h-CVE-2016-2181.patch [add] https://crrev.com/9f1259d730fa724e0c31ef6e7059f0fd155cf299/dev-libs/openssl/files/openssl-1.0.2h-CVE-2016-2182.patch [add] https://crrev.com/9f1259d730fa724e0c31ef6e7059f0fd155cf299/dev-libs/openssl/files/openssl-1.0.2h-CVE-2016-2179.patch [rename] https://crrev.com/9f1259d730fa724e0c31ef6e7059f0fd155cf299/dev-libs/openssl/openssl-1.0.2h-r3.ebuild [add] https://crrev.com/9f1259d730fa724e0c31ef6e7059f0fd155cf299/dev-libs/openssl/files/openssl-1.0.2h-CVE-2016-6303.patch
,
Sep 26 2016
1.0.2j is out, fixing issues with the fixes in 1.0.2i: https://www.openssl.org/news/secadv/20160926.txt
,
Sep 26 2016
This issue has been approved for a merge. Please merge the fix to any appropriate branches as soon as possible! If all merges have been completed, please remove any remaining Merge-Approved labels from this issue. Thanks for your time! To disable nags, add the Disable-Nags label. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
,
Sep 26 2016
,
Sep 26 2016
The following revision refers to this bug: https://chromium.googlesource.com/chromiumos/overlays/chromiumos-overlay/+/e49f0d3b2d1225fdf589980c2bb80753f8c91b4b commit e49f0d3b2d1225fdf589980c2bb80753f8c91b4b Author: Andrey Ulanov <andreyu@google.com> Date: Mon Sep 19 23:32:28 2016 openssl: add a few security patches The following CVEs are fixed: CVE-2016-2177 CVE-2016-2178 CVE-2016-2179 CVE-2016-2181 CVE-2016-2182 CVE-2016-6302 CVE-2016-6303 BUG=b:29558011 BUG=b:31562497 BUG= chromium:647919 TEST=emerge openssl Previously-Reviewed-on: https://chromium-review.googlesource.com/387266 (cherry picked from commit 9a8bddc947c1c8052bc486edcc216001cde0267a) Change-Id: I4614a9cf8f22f1d55d126e4c97a7cf86240ac75b Reviewed-on: https://chromium-review.googlesource.com/388932 Reviewed-by: Andrey Ulanov <andreyu@google.com> Reviewed-by: Greg Kerr <kerrnel@chromium.org> Reviewed-by: Mike Frysinger <vapier@chromium.org> Tested-by: Mike Frysinger <vapier@chromium.org> [add] https://crrev.com/e49f0d3b2d1225fdf589980c2bb80753f8c91b4b/dev-libs/openssl/files/openssl-1.0.2h-CVE-2016-6302.patch [add] https://crrev.com/e49f0d3b2d1225fdf589980c2bb80753f8c91b4b/dev-libs/openssl/files/openssl-1.0.2h-CVE-2016-2177.patch [add] https://crrev.com/e49f0d3b2d1225fdf589980c2bb80753f8c91b4b/dev-libs/openssl/files/openssl-1.0.2h-CVE-2016-2178.patch [add] https://crrev.com/e49f0d3b2d1225fdf589980c2bb80753f8c91b4b/dev-libs/openssl/files/openssl-1.0.2h-CVE-2016-2181.patch [add] https://crrev.com/e49f0d3b2d1225fdf589980c2bb80753f8c91b4b/dev-libs/openssl/files/openssl-1.0.2h-CVE-2016-2182.patch [add] https://crrev.com/e49f0d3b2d1225fdf589980c2bb80753f8c91b4b/dev-libs/openssl/files/openssl-1.0.2h-CVE-2016-2179.patch [rename] https://crrev.com/e49f0d3b2d1225fdf589980c2bb80753f8c91b4b/dev-libs/openssl/openssl-1.0.2h-r3.ebuild [add] https://crrev.com/e49f0d3b2d1225fdf589980c2bb80753f8c91b4b/dev-libs/openssl/files/openssl-1.0.2h-CVE-2016-6303.patch
,
Sep 26 2016
The following revision refers to this bug: https://chromium.googlesource.com/chromiumos/overlays/chromiumos-overlay/+/e49f0d3b2d1225fdf589980c2bb80753f8c91b4b commit e49f0d3b2d1225fdf589980c2bb80753f8c91b4b Author: Andrey Ulanov <andreyu@google.com> Date: Mon Sep 19 23:32:28 2016 openssl: add a few security patches The following CVEs are fixed: CVE-2016-2177 CVE-2016-2178 CVE-2016-2179 CVE-2016-2181 CVE-2016-2182 CVE-2016-6302 CVE-2016-6303 BUG=b:29558011 BUG=b:31562497 BUG= chromium:647919 TEST=emerge openssl Previously-Reviewed-on: https://chromium-review.googlesource.com/387266 (cherry picked from commit 9a8bddc947c1c8052bc486edcc216001cde0267a) Change-Id: I4614a9cf8f22f1d55d126e4c97a7cf86240ac75b Reviewed-on: https://chromium-review.googlesource.com/388932 Reviewed-by: Andrey Ulanov <andreyu@google.com> Reviewed-by: Greg Kerr <kerrnel@chromium.org> Reviewed-by: Mike Frysinger <vapier@chromium.org> Tested-by: Mike Frysinger <vapier@chromium.org> [add] https://crrev.com/e49f0d3b2d1225fdf589980c2bb80753f8c91b4b/dev-libs/openssl/files/openssl-1.0.2h-CVE-2016-6302.patch [add] https://crrev.com/e49f0d3b2d1225fdf589980c2bb80753f8c91b4b/dev-libs/openssl/files/openssl-1.0.2h-CVE-2016-2177.patch [add] https://crrev.com/e49f0d3b2d1225fdf589980c2bb80753f8c91b4b/dev-libs/openssl/files/openssl-1.0.2h-CVE-2016-2178.patch [add] https://crrev.com/e49f0d3b2d1225fdf589980c2bb80753f8c91b4b/dev-libs/openssl/files/openssl-1.0.2h-CVE-2016-2181.patch [add] https://crrev.com/e49f0d3b2d1225fdf589980c2bb80753f8c91b4b/dev-libs/openssl/files/openssl-1.0.2h-CVE-2016-2182.patch [add] https://crrev.com/e49f0d3b2d1225fdf589980c2bb80753f8c91b4b/dev-libs/openssl/files/openssl-1.0.2h-CVE-2016-2179.patch [rename] https://crrev.com/e49f0d3b2d1225fdf589980c2bb80753f8c91b4b/dev-libs/openssl/openssl-1.0.2h-r3.ebuild [add] https://crrev.com/e49f0d3b2d1225fdf589980c2bb80753f8c91b4b/dev-libs/openssl/files/openssl-1.0.2h-CVE-2016-6303.patch
,
Sep 26 2016
The following revision refers to this bug: https://chromium.googlesource.com/chromiumos/overlays/chromiumos-overlay/+/036df3db483ee34efe7224aa511933fcb5bb5fa3 commit 036df3db483ee34efe7224aa511933fcb5bb5fa3 Author: Andrey Ulanov <andreyu@google.com> Date: Thu Sep 22 17:33:13 2016 openssl: update to 1.0.2j BUG= chromium:647919 TEST=emerge openssl Change-Id: I95a054837fe86f14cbf06994ddf609712240567a Reviewed-on: https://chromium-review.googlesource.com/388027 Commit-Ready: Andrey Ulanov <andreyu@google.com> Tested-by: Andrey Ulanov <andreyu@google.com> Reviewed-by: Mike Frysinger <vapier@chromium.org> [delete] https://crrev.com/d657468abe1e8c6102dfd42d9c7bad3e76024d81/dev-libs/openssl/files/openssl-1.0.2h-CVE-2016-6302.patch [delete] https://crrev.com/d657468abe1e8c6102dfd42d9c7bad3e76024d81/dev-libs/openssl/files/openssl-1.0.2h-CVE-2016-2177.patch [delete] https://crrev.com/d657468abe1e8c6102dfd42d9c7bad3e76024d81/dev-libs/openssl/files/openssl-1.0.0d-windres.patch [delete] https://crrev.com/d657468abe1e8c6102dfd42d9c7bad3e76024d81/dev-libs/openssl/files/openssl-1.0.2h-CVE-2016-2178.patch [rename] https://crrev.com/036df3db483ee34efe7224aa511933fcb5bb5fa3/dev-libs/openssl/openssl-1.0.2j.ebuild [delete] https://crrev.com/d657468abe1e8c6102dfd42d9c7bad3e76024d81/dev-libs/openssl/files/openssl-1.0.2h-CVE-2016-2181.patch [modify] https://crrev.com/036df3db483ee34efe7224aa511933fcb5bb5fa3/dev-libs/openssl/Manifest [delete] https://crrev.com/d657468abe1e8c6102dfd42d9c7bad3e76024d81/dev-libs/openssl/files/openssl-1.0.2h-CVE-2016-2179.patch [delete] https://crrev.com/d657468abe1e8c6102dfd42d9c7bad3e76024d81/dev-libs/openssl/files/openssl-1.0.2h-CVE-2016-2182.patch [delete] https://crrev.com/d657468abe1e8c6102dfd42d9c7bad3e76024d81/dev-libs/openssl/files/openssl-1.0.2h-CVE-2016-6303.patch [rename] https://crrev.com/036df3db483ee34efe7224aa511933fcb5bb5fa3/dev-libs/openssl/files/openssl-1.0.2i-parallel-build.patch
,
Sep 26 2016
The following revision refers to this bug: https://chromium.googlesource.com/chromiumos/overlays/chromiumos-overlay/+/036df3db483ee34efe7224aa511933fcb5bb5fa3 commit 036df3db483ee34efe7224aa511933fcb5bb5fa3 Author: Andrey Ulanov <andreyu@google.com> Date: Thu Sep 22 17:33:13 2016 openssl: update to 1.0.2j BUG= chromium:647919 TEST=emerge openssl Change-Id: I95a054837fe86f14cbf06994ddf609712240567a Reviewed-on: https://chromium-review.googlesource.com/388027 Commit-Ready: Andrey Ulanov <andreyu@google.com> Tested-by: Andrey Ulanov <andreyu@google.com> Reviewed-by: Mike Frysinger <vapier@chromium.org> [delete] https://crrev.com/d657468abe1e8c6102dfd42d9c7bad3e76024d81/dev-libs/openssl/files/openssl-1.0.2h-CVE-2016-6302.patch [delete] https://crrev.com/d657468abe1e8c6102dfd42d9c7bad3e76024d81/dev-libs/openssl/files/openssl-1.0.2h-CVE-2016-2177.patch [delete] https://crrev.com/d657468abe1e8c6102dfd42d9c7bad3e76024d81/dev-libs/openssl/files/openssl-1.0.0d-windres.patch [delete] https://crrev.com/d657468abe1e8c6102dfd42d9c7bad3e76024d81/dev-libs/openssl/files/openssl-1.0.2h-CVE-2016-2178.patch [rename] https://crrev.com/036df3db483ee34efe7224aa511933fcb5bb5fa3/dev-libs/openssl/openssl-1.0.2j.ebuild [delete] https://crrev.com/d657468abe1e8c6102dfd42d9c7bad3e76024d81/dev-libs/openssl/files/openssl-1.0.2h-CVE-2016-2181.patch [modify] https://crrev.com/036df3db483ee34efe7224aa511933fcb5bb5fa3/dev-libs/openssl/Manifest [delete] https://crrev.com/d657468abe1e8c6102dfd42d9c7bad3e76024d81/dev-libs/openssl/files/openssl-1.0.2h-CVE-2016-2179.patch [delete] https://crrev.com/d657468abe1e8c6102dfd42d9c7bad3e76024d81/dev-libs/openssl/files/openssl-1.0.2h-CVE-2016-2182.patch [delete] https://crrev.com/d657468abe1e8c6102dfd42d9c7bad3e76024d81/dev-libs/openssl/files/openssl-1.0.2h-CVE-2016-6303.patch [rename] https://crrev.com/036df3db483ee34efe7224aa511933fcb5bb5fa3/dev-libs/openssl/files/openssl-1.0.2i-parallel-build.patch
,
Sep 26 2016
,
Sep 27 2016
,
Sep 28 2016
Issue 651012 has been merged into this issue.
,
Sep 29 2016
This issue has been approved for a merge. Please merge the fix to any appropriate branches as soon as possible! If all merges have been completed, please remove any remaining Merge-Approved labels from this issue. Thanks for your time! To disable nags, add the Disable-Nags label. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
,
Sep 29 2016
,
Jan 3 2017
This bug has been closed for more than 14 weeks. Removing security view restrictions. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
,
Mar 4 2017
,
Apr 17 2017
,
May 30 2017
,
Aug 1 2017
,
Oct 14 2017
|
|||||||||||||||||||||||||||||
►
Sign in to add a comment |
|||||||||||||||||||||||||||||
Comment 1 by kerrnel@chromium.org
, Sep 19 2016