|
Actions:
|
2024-07-10 12:02 AEST by Arthur Barrett - There is now a security advisory for 3.0!
https://www.openssl.org/news/secadv/20240627.txt
OpenSSL Security Advisory [27th June 2024]
==========================================
SSL_select_next_proto buffer overread (CVE-2024-5535)
=====================================================
Severity: Low
OpenSSL 3.3, 3.2, 3.1, 3.0, 1.1.1 and 1.0.2 are vulnerable to this issue.
OpenSSL 3.0 users should upgrade to OpenSSL 3.0.15 once it is released.
But the current release is 3.0.14
KBytes Date File
14946 2024-Jun-04 15:15:27 openssl-3.0.14.tar.gz (SHA256) (PGP sign) (SHA1)
15305 2024-Jun-04 15:15:27 openssl-3.1.6.tar.gz (SHA256) (PGP sign) (SHA1)
17328 2024-Jun-04 15:15:27 openssl-3.2.2.tar.gz (SHA256) (PGP sign) (SHA1)
17632 2024-Jun-04 15:15:27 openssl-3.3.1.tar.gz (SHA256) (PGP sign) (SHA1) |
|
|
2024-09-04 11:56 AEST by Arthur Barrett - For 3.0.13 I build just using vs2022, but that produced a result that is not compatible with Windows XP.
So for 3.0.15 I am building with:
VS2015 - for Suite 2009
VS2022 - for Suite 2025
also need to include the merge module in the installer, see bug 7848
|
|
|
2024-09-04 22:45 AEST by CVS Support - Created an attachment (id=3800)
vs2015 test results - second try with fix for loader_attic etc.
A 'problem' with the first openssl 3.0 build I shipped in CVSNT is that it
'depends on' some DLL's that do NOT have customized names:
D:\cvsbin\release builder>dir D:\cvsdeps\openSSL\lib\engines-3
Volume in drive D is D-Drive
Volume Serial Number is 3CB3-69D5
Directory of D:\cvsdeps\openSSL\lib\engines-3
26/05/2024 11:26 <DIR> .
26/05/2024 11:26 <DIR> ..
26/05/2024 11:26 37,888 capi.dll
26/05/2024 11:26 183,296 capi.pdb
26/05/2024 11:26 46,592 loader_attic.dll
26/05/2024 11:26 216,064 loader_attic.pdb
26/05/2024 11:26 28,672 padlock.dll
26/05/2024 11:26 101,376 padlock.pdb
6 File(s) 613,888 bytes
2 Dir(s) 117,574,754,304 bytes free
D:\cvsbin\release builder>dir D:\cvsdeps\openSSL\lib\ossl-modules
Volume in drive D is D-Drive
Volume Serial Number is 3CB3-69D5
Directory of D:\cvsdeps\openSSL\lib\ossl-modules
26/05/2024 11:26 <DIR> .
26/05/2024 11:26 <DIR> ..
26/05/2024 11:26 98,304 legacy.dll
26/05/2024 11:26 338,944 legacy.pdb
2 File(s) 437,248 bytes
2 Dir(s) 117,574,754,304 bytes free
So I tried to fix this in the vs2022 build script which is what I copied to
make the vs2015 build script. This is incomplete and caused errors during
test, because loader_attic.dll could not be found (and presumably other tests
would have failed too for the other DLL's).
The test '90-test_store' failed because it was not able to load the DLL
loader_attic.dll
That DLL doesn't exist, because we rename it to loader_attic-3_0_vc140.dll
Changing the test to use the 'new' DLL name, also failed, so instead I've tried
to patch the code so we can call loader_attic but the DLL loaded is the right
one.
This didn't break in the previous 3.0.13 build because I just ignored these
DLL's - we don't ship them so there is no DLL Hell / namespace pollution. But
maybe I should be shipping them, in which case I'd have a problem.
If it can be fixed it would be nice to fix it.
D:\GnuWin32\bin\sed < test\recipes\90-test_store.t >
test\recipes\90-test_store.t.1 "s/loader_attic/loader_attic-3_0_vc140/g"
copy /y test\recipes\90-test_store.t.1 test\recipes\90-test_store.t
nmake TESTS="test_store" test
one test fails:
# ERROR: (ptr) 'prov = ossl_provider_find(NULL, name, 0) != NULL' failed @
test\provider_internal_test.c:96
# 0x0
# OPENSSL_TEST_RAND_ORDER=1725444204
not ok 3 - test_configured_provider
#
------------------------------------------------------------------------------
E:\perl-5.38\perl\bin\perl.exe ..\..\util\wrap.pl
..\..\test\provider_internal_test.exe => 1
not ok 1 - running provider_internal_test
#
------------------------------------------------------------------------------
# Failed test 'running provider_internal_test'
# at D:\cvsbin\release
builder\openssl\openssl-3.0.15-vc140-x32\util\perl/OpenSSL/Test/Simple.pm line
77.
# Looks like you failed 1 test of 1.02-test_internal_provider.t ........
Dubious, test returned 1 (wstat 256, 0x100)
Failed 1/1 subtests
|