From 78c3ea61b29ed527e4854f2f03ca0614888f5dd1 Mon Sep 17 00:00:00 2001 From: Michael Tremer Date: Mon, 26 Sep 2016 14:37:20 +0100 Subject: [PATCH] openssl: Update to 1.0.2j Missing CRL sanity check (CVE-2016-7052) ======================================== Severity: Moderate This issue only affects OpenSSL 1.0.2i, released on 22nd September 2016. A bug fix which included a CRL sanity check was added to OpenSSL 1.1.0 but was omitted from OpenSSL 1.0.2i. As a result any attempt to use CRLs in OpenSSL 1.0.2i will crash with a null pointer exception. OpenSSL 1.0.2i users should upgrade to 1.0.2j The issue was reported to OpenSSL on 22nd September 2016 by Bruce Stephens and Thomas Jakobi. The fix was developed by Matt Caswell of the OpenSSL development team. https://www.openssl.org/news/secadv/20160926.txt Signed-off-by: Michael Tremer --- lfs/openssl | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/lfs/openssl b/lfs/openssl index d0ed4d30b1..0405a77f8b 100644 --- a/lfs/openssl +++ b/lfs/openssl @@ -24,7 +24,7 @@ include Config -VER = 1.0.2i +VER = 1.0.2j THISAPP = openssl-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -87,7 +87,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = 678374e63f8df456a697d3e5e5a931fb +$(DL_FILE)_MD5 = 96322138f0b69e61b7212bc53d5e912b install : $(TARGET) -- 2.39.5