From 1c06a7c58df1c655577090ace07b84166ac4efed Mon Sep 17 00:00:00 2001 From: bsiegert Date: Sun, 8 Mar 2020 09:49:18 +0000 Subject: [PATCH] Pullup ticket #6140 - requested by nia security/mbedtls: security fix Revisions pulled up: - security/mbedtls/Makefile 1.12 - security/mbedtls/PLIST 1.6 - security/mbedtls/distinfo 1.8 --- Module Name: pkgsrc Committed By: nia Date: Sat Feb 29 11:45:02 UTC 2020 Modified Files: pkgsrc/security/mbedtls: Makefile PLIST distinfo Log Message: mbedtls: Update to 2.16.5 = mbed TLS 2.16.5 branch released 2020-02-20 Security * Fix potential memory overread when performing an ECDSA signature operation. The overread only happens with cryptographically low probability (of the order of 2^-n where n is the bitsize of the curve) unless the RNG is broken, and could result in information disclosure or denial of service (application crash or extra resource consumption). Found by Auke Zeilstra and Peter Schwabe, using static analysis. * To avoid a side channel vulnerability when parsing an RSA private key, read all the CRT parameters from the DER structure rather than reconstructing them. Found by Alejandro Cabrera Aldaya and Billy Bob Brumley. Reported and fix contributed by Jack Lloyd. ARMmbed/mbed-crypto#352 Bugfix * Fix an unchecked call to mbedtls_md() in the x509write module. * Fix a bug in mbedtls_pk_parse_key() that would cause it to accept some RSA keys that would later be rejected by functions expecting private keys. Found by Catena cyber using oss-fuzz (issue 20467). * Fix a bug in mbedtls_pk_parse_key() that would cause it to accept some RSA keys with invalid values by silently fixing those values. --- security/mbedtls/Makefile | 4 ++-- security/mbedtls/distinfo | 10 +++++----- 2 files changed, 7 insertions(+), 7 deletions(-) diff --git a/security/mbedtls/Makefile b/security/mbedtls/Makefile index fc60b6aa0e9f..785b0d3c6769 100644 --- a/security/mbedtls/Makefile +++ b/security/mbedtls/Makefile @@ -1,6 +1,6 @@ -# $NetBSD: Makefile,v 1.9 2019/10/01 17:44:11 nia Exp $ +# $NetBSD: Makefile,v 1.9.4.1 2020/03/08 09:49:18 bsiegert Exp $ -DISTNAME= mbedtls-2.16.3-apache +DISTNAME= mbedtls-2.16.5-apache PKGNAME= ${DISTNAME:-apache=} CATEGORIES= security devel MASTER_SITES= https://tls.mbed.org/download/ diff --git a/security/mbedtls/distinfo b/security/mbedtls/distinfo index 3980fcfb7282..3d0ddb7154bf 100644 --- a/security/mbedtls/distinfo +++ b/security/mbedtls/distinfo @@ -1,7 +1,7 @@ -$NetBSD: distinfo,v 1.6 2019/10/01 17:44:11 nia Exp $ +$NetBSD: distinfo,v 1.6.4.1 2020/03/08 09:49:18 bsiegert Exp $ -SHA1 (mbedtls-2.16.3-apache.tgz) = dce8550f8f9465f3aea44cb7d0f9d0ba8140034a -RMD160 (mbedtls-2.16.3-apache.tgz) = 611635dce5ac99372272dd5c6edcb64d886f6e3b -SHA512 (mbedtls-2.16.3-apache.tgz) = 62b984d04570334e740ff8b857b4dad73804a4d0aec22b224cb813eb8a6a4b2ec9bff3126c198552e030da94201fd98ed764e8b9f53056e2f94a51dfdbb47cdd -Size (mbedtls-2.16.3-apache.tgz) = 2553709 bytes +SHA1 (mbedtls-2.16.5-apache.tgz) = c36962183e05467aa1dadafcaacf90216a737866 +RMD160 (mbedtls-2.16.5-apache.tgz) = 92e0ffc42f519518472048109c0caa138a7ebe81 +SHA512 (mbedtls-2.16.5-apache.tgz) = 89a6a2cc6fe8b568396caed5fe8428ff5debf833c643b0e4c3144fdc474b127d156d8f5e5ea47a8b5d6522a2689e91a57abc533390b3f54aaa2c756ef6d3baf7 +Size (mbedtls-2.16.5-apache.tgz) = 2695416 bytes SHA1 (patch-library_net__sockets.c) = cd8f9cf84947800eb73d004847789626511ceb35