* [Buildroot] [PATCH] polarssl: security bump to version 1.2.18
@ 2015-11-12 19:30 Gustavo Zacarias
2015-11-12 21:41 ` Peter Korsgaard
0 siblings, 1 reply; 2+ messages in thread
From: Gustavo Zacarias @ 2015-11-12 19:30 UTC (permalink / raw)
To: buildroot
Fixes a potential heap corruption on Windows when
mbedtls_x509_crt_parse_path() is passed a path longer than 2GB. This
cannot be triggered remotely. Found by Guido Vranken, Intelworks.
Fixes a potential buffer overflow in some asn1_write_xxx() functions.
This cannot be triggered remotely unless you create X.509 certificates
based on untrusted input or write keys of untrusted origin. Found by
Guido Vranken, Intelworks.
The X509 max_pathlen constraint was not enforced on intermediate
certificates. Found by Nicholas Wilson, and fix and tests provided by
Janos Follath.
Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
---
| 4 ++--
| 2 +-
2 files changed, 3 insertions(+), 3 deletions(-)
--git a/package/polarssl/polarssl.hash b/package/polarssl/polarssl.hash
index c203392..71f7c29 100644
--- a/package/polarssl/polarssl.hash
+++ b/package/polarssl/polarssl.hash
@@ -1,2 +1,2 @@
-# From https://tls.mbed.org/tech-updates/releases/mbedtls-2.1.2-and-1.3.14-and-polarssl-1.2.17-released
-sha256 9301d4ebec3eb45bc9f28f2d79bfdb0c3dd351c386aa6cc66643e1b2be274d52 polarssl-1.2.17-gpl.tgz
+# From https://tls.mbed.org/tech-updates/releases/mbedtls-2.2.0-2.1.3-1.3.15-and-polarssl.1.2.18-released
+sha256 63c4ed4d9f6a241088e2287958f265403f874248d6a98b98f27cd3aa2f90f030 polarssl-1.2.18-gpl.tgz
--git a/package/polarssl/polarssl.mk b/package/polarssl/polarssl.mk
index aaa6759..c589ec7 100644
--- a/package/polarssl/polarssl.mk
+++ b/package/polarssl/polarssl.mk
@@ -5,7 +5,7 @@
################################################################################
POLARSSL_SITE = https://tls.mbed.org/code/releases
-POLARSSL_VERSION = 1.2.17
+POLARSSL_VERSION = 1.2.18
POLARSSL_SOURCE = polarssl-$(POLARSSL_VERSION)-gpl.tgz
POLARSSL_CONF_OPTS = \
-DENABLE_PROGRAMS=$(if $(BR2_PACKAGE_POLARSSL_PROGRAMS),ON,OFF)
--
2.4.10
^ permalink raw reply related [flat|nested] 2+ messages in thread
* [Buildroot] [PATCH] polarssl: security bump to version 1.2.18
2015-11-12 19:30 [Buildroot] [PATCH] polarssl: security bump to version 1.2.18 Gustavo Zacarias
@ 2015-11-12 21:41 ` Peter Korsgaard
0 siblings, 0 replies; 2+ messages in thread
From: Peter Korsgaard @ 2015-11-12 21:41 UTC (permalink / raw)
To: buildroot
>>>>> "Gustavo" == Gustavo Zacarias <gustavo@zacarias.com.ar> writes:
> Fixes a potential heap corruption on Windows when
> mbedtls_x509_crt_parse_path() is passed a path longer than 2GB. This
> cannot be triggered remotely. Found by Guido Vranken, Intelworks.
> Fixes a potential buffer overflow in some asn1_write_xxx() functions.
> This cannot be triggered remotely unless you create X.509 certificates
> based on untrusted input or write keys of untrusted origin. Found by
> Guido Vranken, Intelworks.
> The X509 max_pathlen constraint was not enforced on intermediate
> certificates. Found by Nicholas Wilson, and fix and tests provided by
> Janos Follath.
> Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Committed, thanks.
--
Bye, Peter Korsgaard
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2015-11-12 21:41 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2015-11-12 19:30 [Buildroot] [PATCH] polarssl: security bump to version 1.2.18 Gustavo Zacarias
2015-11-12 21:41 ` Peter Korsgaard
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.