From patchwork Thu Jun 3 12:20:27 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Adolf Belka X-Patchwork-Id: 4391 Return-Path: Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) server-digest SHA384 client-signature ECDSA (P-384) client-digest SHA384) (Client CN "mail01.haj.ipfire.org", Issuer "R3" (verified OK)) by web04.haj.ipfire.org (Postfix) with ESMTPS id 4FwlNM1G1Zz3wc6 for ; Thu, 3 Jun 2021 12:20:35 +0000 (UTC) Received: from mail02.haj.ipfire.org (mail02.haj.ipfire.org [172.28.1.201]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) client-signature ECDSA (P-384)) (Client CN "mail02.haj.ipfire.org", Issuer "R3" (verified OK)) by mail01.ipfire.org (Postfix) with ESMTPS id 4FwlNK6YCxz136; Thu, 3 Jun 2021 12:20:33 +0000 (UTC) Received: from mail02.haj.ipfire.org (localhost [127.0.0.1]) by mail02.haj.ipfire.org (Postfix) with ESMTP id 4FwlNK5qnXz2yXw; Thu, 3 Jun 2021 12:20:33 +0000 (UTC) Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) server-digest SHA384 client-signature ECDSA (P-384) client-digest SHA384) (Client CN "mail01.haj.ipfire.org", Issuer "R3" (verified OK)) by mail02.haj.ipfire.org (Postfix) with ESMTPS id 4FwlNK1Tgyz2xGT for ; Thu, 3 Jun 2021 12:20:33 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) server-digest SHA384) (No client certificate requested) by mail01.ipfire.org (Postfix) with ESMTPSA id 4FwlNJ46jFz9k; Thu, 3 Jun 2021 12:20:32 +0000 (UTC) DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003ed25519; t=1622722832; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding; bh=Z3Kn/+aN6nrqn8/t2ZhILwribMIi0xm+iLTiSc3NgHc=; b=MF3sbreOvt+KbYnwnlq7HjjMeeFA/n9Mh52I0pgjDjAuQD8bHL62trDZJ7AyiNperEE1N1 dkAs13uE5U4M0QDg== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003rsa; t=1622722832; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding; bh=Z3Kn/+aN6nrqn8/t2ZhILwribMIi0xm+iLTiSc3NgHc=; b=Zcnt3iEfT7z/yOiYS2eGIoT0JXhIeol37Pw5GhaYdcCmy5FiHxqmdDk4bx2wmbCDv/2xal zau8J66q82LFMl3TAMp/L1VvDnsF25Smq+RD1wZtIN3rIltrE5cU6ROVWyvqDONxSDpty/ CEAANDVuzRzMX9W3JTxh0Jtze/ublKoNurUgWcJv9cMCMcVtDDIlKlUoewG2aoPgG6YVZ5 9FuiIBvhx1xCSFsPno5QxZ+NLXqcpLH6TOAntoWuvoVcBIk7HUooUZ97blfnaQ2CULWh6m bqhc/nfGcXJ9A0gFPZ2ehaYjFEVDCXmDqRXpUqb/OXbp2sXixW/dW3PjNIRelg== From: Adolf Belka To: development@lists.ipfire.org Subject: [PATCH] gnutls: Update to 3.6.16 Date: Thu, 3 Jun 2021 14:20:27 +0200 Message-Id: <20210603122027.683629-1-adolf.belka@ipfire.org> MIME-Version: 1.0 X-BeenThere: development@lists.ipfire.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: IPFire development talk List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: development-bounces@lists.ipfire.org Sender: "Development" - Update from 3.6.14 to 3.6.16 - Update rootfile - Changelog * Version 3.6.16 (released 2021-05-24) ** libgnutls: Fixed potential miscalculation of ECDSA/EdDSA code backported from Nettle. In GnuTLS, as long as it is built and linked against the fixed version of Nettle, this only affects GOST curves. [CVE-2021-20305] ** libgnutls: Fixed potential use-after-free in sending "key_share" and "pre_shared_key" extensions. When sending those extensions, the client may dereference a pointer no longer valid after realloc. This happens only when the client sends a large Client Hello message, e.g., when HRR is sent in a resumed session previously negotiated large FFDHE parameters, because the initial allocation of the buffer is large enough without having to call realloc (#1151). [GNUTLS-SA-2021-03-10, CVSS: low] * Version 3.6.15 (released 2020-09-04) ** libgnutls: Fixed "no_renegotiation" alert handling at incorrect timing. The server sending a "no_renegotiation" alert in an unexpected timing, followed by an invalid second handshake was able to cause a TLS 1.3 client to crash via a null-pointer dereference. The crash happens in the application's error handling path, where the gnutls_deinit function is called after detecting a handshake failure (#1071). [GNUTLS-SA-2020-09-04, CVSS: medium] ** libgnutls: If FIPS self-tests are failed, gnutls_fips140_mode_enabled() now indicates that with a false return value (!1306). ** libgnutls: Under FIPS mode, the generated ECDH/DH public keys are checked accordingly to SP800-56A rev 3 (!1295, !1299). ** libgnutls: gnutls_x509_crt_export2() now returns 0 upon success, rather than the size of the internal base64 blob (#1025). The new behavior aligns to the existing documentation. ** libgnutls: Certificate verification failue due to OCSP must-stapling is not honered is now correctly marked with the GNUTLS_CERT_INVALID flag (!1317). The new behavior aligns to the existing documentation. ** libgnutls: The audit log message for weak hashes is no longer printed twice (!1301). ** libgnutls: Fixed version negotiation when TLS 1.3 is enabled and TLS 1.2 is disabled in the priority string. Previously, even when TLS 1.2 is explicitly disabled with "-VERS-TLS1.2", the server still offered TLS 1.2 if TLS 1.3 is enabled (#1054). Signed-off-by: Adolf Belka --- config/rootfiles/common/gnutls | 2 +- lfs/gnutls | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/config/rootfiles/common/gnutls b/config/rootfiles/common/gnutls index cb7ecf8e5..e59c1a84f 100644 --- a/config/rootfiles/common/gnutls +++ b/config/rootfiles/common/gnutls @@ -33,7 +33,7 @@ usr/lib/libgnutls-dane.so.0.4.1 #usr/lib/libgnutls.la #usr/lib/libgnutls.so usr/lib/libgnutls.so.30 -usr/lib/libgnutls.so.30.28.0 +usr/lib/libgnutls.so.30.28.2 #usr/lib/libgnutlsxx.la #usr/lib/libgnutlsxx.so usr/lib/libgnutlsxx.so.28 diff --git a/lfs/gnutls b/lfs/gnutls index 07344a8c4..65db67b0c 100644 --- a/lfs/gnutls +++ b/lfs/gnutls @@ -24,7 +24,7 @@ include Config -VER = 3.6.14 +VER = 3.6.16 THISAPP = gnutls-$(VER) DL_FILE = $(THISAPP).tar.xz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = bf70632d420e421baff482247f01dbfe +$(DL_FILE)_MD5 = 5db1678931fa6bbd40beed235c6a0a37 install : $(TARGET)