diff options
Diffstat (limited to 'website/static/security/patches')
8 files changed, 301 insertions, 0 deletions
diff --git a/website/static/security/patches/EN-25:18/freebsd-update.patch b/website/static/security/patches/EN-25:18/freebsd-update.patch new file mode 100644 index 0000000000..df93f7bb03 --- /dev/null +++ b/website/static/security/patches/EN-25:18/freebsd-update.patch @@ -0,0 +1,32 @@ +--- usr.sbin/freebsd-update/freebsd-update.sh.orig ++++ usr.sbin/freebsd-update/freebsd-update.sh +@@ -3111,10 +3111,28 @@ + grep -E '^/libexec/ld-elf[^|]*\.so\.[0-9]+\|' > INDEX-NEW + install_from_index INDEX-NEW || return 1 + +- # Install new shared libraries next ++ # Next, in order, libsys, libc, and libthr. + grep -vE '^/boot/' $1/INDEX-NEW | + grep -vE '^[^|]+\|d\|' | + grep -vE '^/libexec/ld-elf[^|]*\.so\.[0-9]+\|' | ++ grep -E '^[^|]*/lib/libsys\.so\.[0-9]+\|' > INDEX-NEW ++ install_from_index INDEX-NEW || return 1 ++ grep -vE '^/boot/' $1/INDEX-NEW | ++ grep -vE '^[^|]+\|d\|' | ++ grep -vE '^/libexec/ld-elf[^|]*\.so\.[0-9]+\|' | ++ grep -E '^[^|]*/lib/libc\.so\.[0-9]+\|' > INDEX-NEW ++ install_from_index INDEX-NEW || return 1 ++ grep -vE '^/boot/' $1/INDEX-NEW | ++ grep -vE '^[^|]+\|d\|' | ++ grep -vE '^/libexec/ld-elf[^|]*\.so\.[0-9]+\|' | ++ grep -E '^[^|]*/lib/libthr\.so\.[0-9]+\|' > INDEX-NEW ++ install_from_index INDEX-NEW || return 1 ++ ++ # Install the rest of the shared libraries next ++ grep -vE '^/boot/' $1/INDEX-NEW | ++ grep -vE '^[^|]+\|d\|' | ++ grep -vE '^/libexec/ld-elf[^|]*\.so\.[0-9]+\|' | ++ grep -vE '^[^|]*/lib/(libsys|libc|libthr)\.so\.[0-9]+\|' | + grep -E '^[^|]*/lib/[^|]*\.so\.[0-9]+\|' > INDEX-NEW + install_from_index INDEX-NEW || return 1 + diff --git a/website/static/security/patches/EN-25:18/freebsd-update.patch.asc b/website/static/security/patches/EN-25:18/freebsd-update.patch.asc new file mode 100644 index 0000000000..f44b92f70d --- /dev/null +++ b/website/static/security/patches/EN-25:18/freebsd-update.patch.asc @@ -0,0 +1,16 @@ +-----BEGIN PGP SIGNATURE----- + +iQIzBAABCgAdFiEEthUnfoEIffdcgYM7bljekB8AGu8FAmjb+yMACgkQbljekB8A +Gu85Mw/9HtHqy0ZseVpE6OhJy4+6pG00tCnQq/ERCbycGkyZziJakwCQFviEx0MO +MUSta9g8MhysdMLNTRl9wwaiEGoXxXZvRaEEFB0Crf4Fvt4V4QLzU7WUxgbfa4kp +wQOad+xzfe/7KLiUk70OHh1ODfYydC8NVPCoIT+pbkHzdGvaqEKXR8vtjs7Myf7V +M7Y6GhRs9tDvA63TEBWEVLP1wVTJ3sYGopeyzKU7xNBEngih5LaP17BOXMlA74rR +zrNxIkRTJe+gPAbMUyZ7OdmbdtzeYtcbwZN+7uf4Vd2xSP0VjqNlC8goKdPNw2kN +71mrGpejtDSqvT23RCPA3ek5dqDFsl+2h2MfUstNLofnKSO4H6pq0I61PZbYDDkY +VVgNdybqzs/lFsL4VNFS5dbaoa6OiBpX2yo2b7AUwaqtP4n6qKSaO2yTBsZfxoAs +nTZkCzbVCzlqP4JXCDdmjvnAhaf0DxEx7QsSj5YCp5RihIqXaE+XZ4LlQFt0HgDr +2iLLX2V9g3g966CKcXI0vVt/vzOqpakrcBpnslW0b6+rhthe1MTIhgdDLvpmJ5DX +a35bUeKqqxCq9yiPDKE0RpABnxSKEWGB+asVErLNRga97wf5fUojTmtLURALMIY8 +OSCW9nsI8iCX/4+eB3OfuWPpW9Z9IGB19CDMgdnVUnozBgjv0cM= +=saMY +-----END PGP SIGNATURE----- diff --git a/website/static/security/patches/SA-25:08/openssl-13.patch b/website/static/security/patches/SA-25:08/openssl-13.patch new file mode 100644 index 0000000000..ff46f32c81 --- /dev/null +++ b/website/static/security/patches/SA-25:08/openssl-13.patch @@ -0,0 +1,11 @@ +--- crypto/openssl/crypto/cms/cms_pwri.c.orig ++++ crypto/openssl/crypto/cms/cms_pwri.c +@@ -215,7 +215,7 @@ + /* Check byte failure */ + goto err; + } +- if (inlen < (size_t)(tmp[0] - 4)) { ++ if (inlen < 4 + (size_t)tmp[0]) { + /* Invalid length value */ + goto err; + } diff --git a/website/static/security/patches/SA-25:08/openssl-13.patch.asc b/website/static/security/patches/SA-25:08/openssl-13.patch.asc new file mode 100644 index 0000000000..b8cb1f7718 --- /dev/null +++ b/website/static/security/patches/SA-25:08/openssl-13.patch.asc @@ -0,0 +1,16 @@ +-----BEGIN PGP SIGNATURE----- + +iQIzBAABCgAdFiEEthUnfoEIffdcgYM7bljekB8AGu8FAmjb+0IACgkQbljekB8A +Gu+lIg/+Lolkw+WssmbgxxZdypCud/7HTk/+M4YdBPMtoZYFec/Mzpw9ok+MUs2O +7Ev1mc0rQ9Rcfw5PEe6tKvC3MMFtWOcHNr3QqkkvkAA2nsxCeEPIBHyQiEm347PU +ntraIANMy+MbmaegU5+vyzpZQxBl6erAc+9p7eyMFBJtFzRCZV2SIPV4lUrgYsKq +WyjM7o7jRfOcn7aZ6X+pPnUjQY6jkJQIiHqytdG8XTIkzDvcpy88g9Yg1qxBwi// +ESgZWIHdU4kbChQJPFfYGYUFZ2tn15iMRjmjQA6SKCWpJNq56r3PLNCQ7Z99KCe8 +dAs0Uw0ZPQZuZVMNb3XV4W/MEDWc+2I9HUXwJfA6RFDbm71sj9XTwBYskEDPcD+q +w3OMkG184EUgqrZazaO2MLas+X7aaMwn7Dvr+zCjREfKp8s6Qar5nKgjP7XoBmTg +ewez2FEUmjdt7SIq5K81Xjmnd7Qu069Yztw/YavCHcQOpwf7Iea1etH9ynMQ0jEb +zAgO++HJJiN6+Noahcauet8L5TsjJIoZd8DTB2g0fONt1S5HCtklnBptyDfispBO +pWf059PG079wiTmL/qT1x4UnYnyZs32HghR9+R4tOkSFs3RiVMaGk8ZnIL+Nmp3v +sRx3so9zFU0TBVww9eRe9/ve4MKd+AqJJe8X1iioDvk7l8JyUTw= +=NXRd +-----END PGP SIGNATURE----- diff --git a/website/static/security/patches/SA-25:08/openssl-14.patch b/website/static/security/patches/SA-25:08/openssl-14.patch new file mode 100644 index 0000000000..10c55dd60a --- /dev/null +++ b/website/static/security/patches/SA-25:08/openssl-14.patch @@ -0,0 +1,21 @@ +--- crypto/openssl/crypto/cms/cms_pwri.c.orig ++++ crypto/openssl/crypto/cms/cms_pwri.c +@@ -228,7 +228,7 @@ + /* Check byte failure */ + goto err; + } +- if (inlen < (size_t)(tmp[0] - 4)) { ++ if (inlen < 4 + (size_t)tmp[0]) { + /* Invalid length value */ + goto err; + } +--- crypto/openssl/crypto/http/http_lib.c.orig ++++ crypto/openssl/crypto/http/http_lib.c +@@ -267,6 +267,7 @@ + /* strip leading '[' and trailing ']' from escaped IPv6 address */ + sl -= 2; + strncpy(host, server + 1, sl); ++ host[sl] = '\0'; + server = host; + } + diff --git a/website/static/security/patches/SA-25:08/openssl-14.patch.asc b/website/static/security/patches/SA-25:08/openssl-14.patch.asc new file mode 100644 index 0000000000..43ac390451 --- /dev/null +++ b/website/static/security/patches/SA-25:08/openssl-14.patch.asc @@ -0,0 +1,16 @@ +-----BEGIN PGP SIGNATURE----- + +iQIzBAABCgAdFiEEthUnfoEIffdcgYM7bljekB8AGu8FAmjb+0MACgkQbljekB8A +Gu8Mrg//Wx7TovEbu7hCYrBcs3+LwhVEQh2S6V7APXHtoXIY6Tp56b0ii60F5nBY +a8LSKYqb+sZlTgRt2IHU/gFAzHJAPB5zb2Vc+//T6l192mS8sI+Z3lgJQ8IvWaW5 +g3RI/iukDMo2He7xrXgtGukJjKOen/Y0gphb5kXApBgdw5I/yPXFhbF1WmfB13aN +M8gfhr7fuRBd+BXQ6S/q0WSNg0cwQkiA1fy0iE6xaIfeX6I44sxGBU7yKWnxfGfS +crExJdfVFTv+9duMRIjQovDAEheQBAd5ZJLnTUHmJX0pCP9Qv1Mg0rGchvVzKlSg +Q0GXLABmuyq81XwMHz9enW0xzTWmp1/9gCyL9+O/x5EeQnYqOSarWDxFg3G9qYyF +1TGAX7oj3PJ3s7HkHoBKKN3tR7pHjIi+EHkXFnbpA8Pik8rLY54kwMPHXSL153o7 +DNKyn41sx76+yBckiWKvNq6yIzRiFCcuQ8IwOVMNZ+bkw4M14HjSRs0+aDlmkvgG +Hs5tqWH0qdo5wMMp09aVizlXgTfTSZhdRxW/cUdS+XPBKJ7ogvTI/M9TDn33BzuP +oex1SeoBIRInKKMW6EipisAE9B6jnvfH5gsh2f0XpUDqX5vWBjOpxiF4hZLmPvti +nt18T+/ScdIwHebnKUob70hf3mTGxLpnPNH5eM8SdkMsJORGook= +=DhAy +-----END PGP SIGNATURE----- diff --git a/website/static/security/patches/SA-25:08/openssl-15.patch b/website/static/security/patches/SA-25:08/openssl-15.patch new file mode 100644 index 0000000000..f4678a9583 --- /dev/null +++ b/website/static/security/patches/SA-25:08/openssl-15.patch @@ -0,0 +1,173 @@ +--- crypto/openssl/crypto/cms/cms_pwri.c.orig ++++ crypto/openssl/crypto/cms/cms_pwri.c +@@ -242,7 +242,7 @@ + /* Check byte failure */ + goto err; + } +- if (inlen < (size_t)(tmp[0] - 4)) { ++ if (inlen < 4 + (size_t)tmp[0]) { + /* Invalid length value */ + goto err; + } +--- crypto/openssl/crypto/ec/ecp_sm2p256.c.orig ++++ crypto/openssl/crypto/ec/ecp_sm2p256.c +@@ -56,10 +56,6 @@ + 0xffffffffffffffff, 0xffffffff00000000, + 0xffffffffffffffff, 0xfffffffeffffffff + }; +-ALIGN32 static const BN_ULONG def_ord[P256_LIMBS] = { +- 0x53bbf40939d54123, 0x7203df6b21c6052b, +- 0xffffffffffffffff, 0xfffffffeffffffff +-}; + + ALIGN32 static const BN_ULONG ONE[P256_LIMBS] = {1, 0, 0, 0}; + +@@ -177,13 +173,6 @@ + BN_MOD_INV(out, in, ecp_sm2p256_div_by_2, ecp_sm2p256_sub, def_p); + } + +-/* Modular inverse mod order |out| = |in|^(-1) % |ord|. */ +-static ossl_inline void ecp_sm2p256_mod_ord_inverse(BN_ULONG* out, +- const BN_ULONG* in) { +- BN_MOD_INV(out, in, ecp_sm2p256_div_by_2_mod_ord, ecp_sm2p256_sub_mod_ord, +- def_ord); +-} +- + /* Point double: R <- P + P */ + static void ecp_sm2p256_point_double(P256_POINT *R, const P256_POINT *P) + { +@@ -454,52 +443,6 @@ + } + #endif + +-/* +- * Convert Jacobian coordinate point into affine coordinate (x,y) +- */ +-static int ecp_sm2p256_get_affine(const EC_GROUP *group, +- const EC_POINT *point, +- BIGNUM *x, BIGNUM *y, BN_CTX *ctx) +-{ +- ALIGN32 BN_ULONG z_inv2[P256_LIMBS] = {0}; +- ALIGN32 BN_ULONG z_inv3[P256_LIMBS] = {0}; +- ALIGN32 BN_ULONG x_aff[P256_LIMBS] = {0}; +- ALIGN32 BN_ULONG y_aff[P256_LIMBS] = {0}; +- ALIGN32 BN_ULONG point_x[P256_LIMBS] = {0}; +- ALIGN32 BN_ULONG point_y[P256_LIMBS] = {0}; +- ALIGN32 BN_ULONG point_z[P256_LIMBS] = {0}; +- +- if (EC_POINT_is_at_infinity(group, point)) { +- ECerr(ERR_LIB_EC, EC_R_POINT_AT_INFINITY); +- return 0; +- } +- +- if (ecp_sm2p256_bignum_field_elem(point_x, point->X) <= 0 +- || ecp_sm2p256_bignum_field_elem(point_y, point->Y) <= 0 +- || ecp_sm2p256_bignum_field_elem(point_z, point->Z) <= 0) { +- ECerr(ERR_LIB_EC, EC_R_COORDINATES_OUT_OF_RANGE); +- return 0; +- } +- +- ecp_sm2p256_mod_inverse(z_inv3, point_z); +- ecp_sm2p256_sqr(z_inv2, z_inv3); +- +- if (x != NULL) { +- ecp_sm2p256_mul(x_aff, point_x, z_inv2); +- if (!bn_set_words(x, x_aff, P256_LIMBS)) +- return 0; +- } +- +- if (y != NULL) { +- ecp_sm2p256_mul(z_inv3, z_inv3, z_inv2); +- ecp_sm2p256_mul(y_aff, point_y, z_inv3); +- if (!bn_set_words(y, y_aff, P256_LIMBS)) +- return 0; +- } +- +- return 1; +-} +- + /* r = sum(scalar[i]*point[i]) */ + static int ecp_sm2p256_windowed_mul(const EC_GROUP *group, + P256_POINT *r, +@@ -689,44 +632,6 @@ + return 1; + } + +-static int ecp_sm2p256_inv_mod_ord(const EC_GROUP *group, BIGNUM *r, +- const BIGNUM *x, BN_CTX *ctx) +-{ +- int ret = 0; +- ALIGN32 BN_ULONG t[P256_LIMBS] = {0}; +- ALIGN32 BN_ULONG out[P256_LIMBS] = {0}; +- +- if (bn_wexpand(r, P256_LIMBS) == NULL) { +- ECerr(ERR_LIB_EC, ERR_R_BN_LIB); +- goto err; +- } +- +- if ((BN_num_bits(x) > 256) || BN_is_negative(x)) { +- BIGNUM *tmp; +- +- if ((tmp = BN_CTX_get(ctx)) == NULL +- || !BN_nnmod(tmp, x, group->order, ctx)) { +- ECerr(ERR_LIB_EC, ERR_R_BN_LIB); +- goto err; +- } +- x = tmp; +- } +- +- if (!ecp_sm2p256_bignum_field_elem(t, x)) { +- ECerr(ERR_LIB_EC, EC_R_COORDINATES_OUT_OF_RANGE); +- goto err; +- } +- +- ecp_sm2p256_mod_ord_inverse(out, t); +- +- if (!bn_set_words(r, out, P256_LIMBS)) +- goto err; +- +- ret = 1; +-err: +- return ret; +-} +- + const EC_METHOD *EC_GFp_sm2p256_method(void) + { + static const EC_METHOD ret = { +@@ -747,7 +652,7 @@ + ossl_ec_GFp_simple_point_copy, + ossl_ec_GFp_simple_point_set_to_infinity, + ossl_ec_GFp_simple_point_set_affine_coordinates, +- ecp_sm2p256_get_affine, ++ ossl_ec_GFp_simple_point_get_affine_coordinates, + 0, 0, 0, + ossl_ec_GFp_simple_add, + ossl_ec_GFp_simple_dbl, +@@ -763,7 +668,7 @@ + ecp_sm2p256_field_mul, + ecp_sm2p256_field_sqr, + 0 /* field_div */, +- 0 /* field_inv */, ++ ossl_ec_GFp_simple_field_inv, + 0 /* field_encode */, + 0 /* field_decode */, + 0 /* field_set_to_one */, +@@ -779,7 +684,7 @@ + ossl_ecdsa_simple_sign_setup, + ossl_ecdsa_simple_sign_sig, + ossl_ecdsa_simple_verify_sig, +- ecp_sm2p256_inv_mod_ord, ++ 0, /* use constant‑time fallback for inverse mod order */ + 0, /* blind_coordinates */ + 0, /* ladder_pre */ + 0, /* ladder_step */ +--- crypto/openssl/crypto/http/http_lib.c.orig ++++ crypto/openssl/crypto/http/http_lib.c +@@ -263,6 +263,7 @@ + /* strip leading '[' and trailing ']' from escaped IPv6 address */ + sl -= 2; + strncpy(host, server + 1, sl); ++ host[sl] = '\0'; + server = host; + } + diff --git a/website/static/security/patches/SA-25:08/openssl-15.patch.asc b/website/static/security/patches/SA-25:08/openssl-15.patch.asc new file mode 100644 index 0000000000..452a1fbaaa --- /dev/null +++ b/website/static/security/patches/SA-25:08/openssl-15.patch.asc @@ -0,0 +1,16 @@ +-----BEGIN PGP SIGNATURE----- + +iQIzBAABCgAdFiEEthUnfoEIffdcgYM7bljekB8AGu8FAmjb+0QACgkQbljekB8A +Gu+tUg//daQG6OHScuUNTvwR9d3kOqeiEcA2hiaMg7BuPlaimq6+o4/Nsrxuu5z1 +l2l1seZXGP1iTXAWAjxL1d8ceVBJ4mqO3yhIg5qDF3rlhCNpHf8Fphl0yu7SQohx +wBVx2RcZ8ldq+TmvgNywWeEeuuJ5D4CukPHPAjIv1+/NB/P+NsrkC37YZ88bfckF +0oAqF6b2KONV3hBVVSAjMhoR3esDOoqp7yGwpzBsiDb7EANj+wMd1aYuUtp3bOHH +dZa0uGLEBITzd2s/rGEfsF7os0UdJFv0GJ2SZXxHUV80coIyKSxccFAwnxI1/CVY +8ji20zfYtdVmwn2ZhnVCO3n95HqAsiglX35LrrXSoohC3nx9XcCQr3BlYc6G6icC +9RnCeI6sFjAQ7x46fnYy51BrfgTmmRrTmGDbbGrrwphNP8QrrrXBRD7TIaHKmQgj +nTS7VsQya/X9pnQHTIxjmOPQ6gVLrZ0w6nBRyNC8HkjcCv+jOLXcyf+8flNTI84/ +dmuh9c/xDqzhXgUaEe4SHW9NtL9ohV7/l/Qt1FgXOV/VzHuK+kLtCXz9KskIsUYc +kKg0UPFuP0t0UgDimkXx3eLctEyfmJtbL/j1iLUqV442REkK+QttyJILV0GmMpQy +KvIHb9/sQnC65TpP3oyxbVcrasosNRhvaILmtzXvIInlqHC0OhQ= +=lGPI +-----END PGP SIGNATURE----- |