From nobody Wed Aug 2 19:28:21 2023
X-Original-To: dev-commits-ports-all@mlmmj.nyi.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1])
by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4RGMTh1nj7zZhmD;
Wed, 2 Aug 2023 19:28:24 +0000 (UTC)
(envelope-from git@FreeBSD.org)
Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3])
(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256
client-signature RSA-PSS (4096 bits) client-digest SHA256)
(Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK))
by mx1.freebsd.org (Postfix) with ESMTPS id 4RGMTK5rFTz4Zpp;
Wed, 2 Aug 2023 19:28:21 +0000 (UTC)
(envelope-from git@FreeBSD.org)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim;
t=1691004501;
h=from:from:reply-to:subject:subject:date:date:message-id:message-id:
to:to:cc:mime-version:mime-version:content-type:content-type:
content-transfer-encoding:content-transfer-encoding;
bh=e7Dxw/s8weoSZ47hSM+4oTqclV/aMr/Jci8hz15V8CM=;
b=XUkiyLvMfy2vvGg3M3UjTuqeg12smawmLDCs/Q5i/WVBjqdjTO3nf/ylF6RM+5AEPzqK4U
dvNs5hI8GA5P1/cx51GZI6lEivDK0PynU64MKt0PisClidmFAAkQQZ381ZiUFamUL2i+3M
jLSHoRGE1Xi6jwL0C+xyARrthCZSBBtGj6lHm4XkbsLGfc7hcP+b/wOwQCNyZtfYaecF6+
zasJlJq4slvxb9K7Huz0YkbJZkfd4K7u8tok4ZJxbOsU7uz6wbRXp+ZuSPsJlyBRnzun+F
JoRUCJ25G0zebT8iNt/ZhMSjqC7Mpt5oFr7T3k0dkvaeVQOmqvpgO78cK2ZBlg==
ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1691004501; a=rsa-sha256; cv=none;
b=aVKENSJr2MHg+T6i9mkQBkxMWyAYSKm3ti93ka8lijLuNfSbo9qYfAD8tgG9el/Sci8ukH
gSxFAa39HIvkT7ACK4FWgEceevUzE07KEkWsRqcrTfSAAbPzufTsiReA1HG6XExs0aOpTr
/qrWhYI8LstukNIfgdOOL9QOTZBzyLu9XRs/w6QzNQ33vccLeYx/xikc0d5DvZJC4RoHYd
QErniB4qC5Ku397+MZYWfP0heUYuInC8HKPpQ/bYvREQa3kymDH3PN/w9I3hNcEYDsA2B8
98a6DMCZyOXBp//gVw950Xe/1522TT7FukmAw25uNzvqeVr5un9sm9CbD7ZCyQ==
ARC-Authentication-Results: i=1;
mx1.freebsd.org;
none
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org;
s=dkim; t=1691004501;
h=from:from:reply-to:subject:subject:date:date:message-id:message-id:
to:to:cc:mime-version:mime-version:content-type:content-type:
content-transfer-encoding:content-transfer-encoding;
bh=e7Dxw/s8weoSZ47hSM+4oTqclV/aMr/Jci8hz15V8CM=;
b=VAc5YrrJ0AZdGjhYEKT8400sOOKyJeq1v1oGmpydJOhE/Govdu3Bbu6BsZDbCzEqVawHt+
bZ9ffXa9AZnV3sYj5vdx932JxkgC1hSG+uIospvKv/l9NClD8OrI2AsLOJmehnItw6IYEo
oS+3IFT67L2NnhV5yGdS7uQaTNM3SFLUa4xeNhyov37uiQFWrbpAcS3fzWnCPjlt33xKMT
G3TmCNbqpueRSoe8a10hOVwMBohrCGg29XXsCSRcgBW9Yp6CGh5cfbvzbVgWidOrJXQKKj
cEMjvuudnelIVshpRoprP62MKSxcxnEIz4/3bgcnS1y/UtO1pPjWFnwz9+EL6g==
Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5])
(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256)
(Client did not present a certificate)
by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4RGMTK4CwNzWtL;
Wed, 2 Aug 2023 19:28:21 +0000 (UTC)
(envelope-from git@FreeBSD.org)
Received: from gitrepo.freebsd.org ([127.0.1.44])
by gitrepo.freebsd.org (8.17.1/8.17.1) with ESMTP id 372JSLpg035232;
Wed, 2 Aug 2023 19:28:21 GMT
(envelope-from git@gitrepo.freebsd.org)
Received: (from git@localhost)
by gitrepo.freebsd.org (8.17.1/8.17.1/Submit) id 372JSL1J035231;
Wed, 2 Aug 2023 19:28:21 GMT
(envelope-from git)
Date: Wed, 2 Aug 2023 19:28:21 GMT
Message-Id: <202308021928.372JSL1J035231@gitrepo.freebsd.org>
To: ports-committers@FreeBSD.org, dev-commits-ports-all@FreeBSD.org,
dev-commits-ports-main@FreeBSD.org
From: Bernard Spil <brnrd@FreeBSD.org>
Subject: git: 04ffe8fb6bec - main - security/openssl: Update to 1.1.1v
List-Id: Commit messages for all branches of the ports repository <dev-commits-ports-all.freebsd.org>
List-Archive: https://lists.freebsd.org/archives/dev-commits-ports-all
List-Help: <mailto:dev-commits-ports-all+help@freebsd.org>
List-Post: <mailto:dev-commits-ports-all@freebsd.org>
List-Subscribe: <mailto:dev-commits-ports-all+subscribe@freebsd.org>
List-Unsubscribe: <mailto:dev-commits-ports-all+unsubscribe@freebsd.org>
Sender: owner-dev-commits-ports-all@freebsd.org
X-BeenThere: dev-commits-ports-all@freebsd.org
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 8bit
X-Git-Committer: brnrd
X-Git-Repository: ports
X-Git-Refname: refs/heads/main
X-Git-Reftype: branch
X-Git-Commit: 04ffe8fb6bec091ce3a5c20c7ab73bce30d2b333
Auto-Submitted: auto-generated
The branch main has been updated by brnrd:
URL: https://cgit.FreeBSD.org/ports/commit/?id=04ffe8fb6bec091ce3a5c20c7ab73bce30d2b333
commit 04ffe8fb6bec091ce3a5c20c7ab73bce30d2b333
Author: Bernard Spil <brnrd@FreeBSD.org>
AuthorDate: 2023-08-02 19:27:30 +0000
Commit: Bernard Spil <brnrd@FreeBSD.org>
CommitDate: 2023-08-02 19:27:30 +0000
security/openssl: Update to 1.1.1v
* MFH this version as this is a roll-up of multiple vulnerability fixes
MFH: 2023Q3
---
security/openssl/Makefile | 3 +-
security/openssl/distinfo | 6 ++--
security/openssl/files/patch-CVE-2023-3817 | 55 ------------------------------
3 files changed, 4 insertions(+), 60 deletions(-)
diff --git a/security/openssl/Makefile b/security/openssl/Makefile
index d0ffd1cac2a2..886026009708 100644
--- a/security/openssl/Makefile
+++ b/security/openssl/Makefile
@@ -1,6 +1,5 @@
PORTNAME= openssl
-PORTVERSION= 1.1.1u
-PORTREVISION= 1
+PORTVERSION= 1.1.1v
PORTEPOCH= 1
CATEGORIES= security devel
MASTER_SITES= https://www.openssl.org/source/ \
diff --git a/security/openssl/distinfo b/security/openssl/distinfo
index a37ebb5597c4..f9b0843950cb 100644
--- a/security/openssl/distinfo
+++ b/security/openssl/distinfo
@@ -1,3 +1,3 @@
-TIMESTAMP = 1685529813
-SHA256 (openssl-1.1.1u.tar.gz) = e2f8d84b523eecd06c7be7626830370300fbcc15386bf5142d72758f6963ebc6
-SIZE (openssl-1.1.1u.tar.gz) = 9892176
+TIMESTAMP = 1691003970
+SHA256 (openssl-1.1.1v.tar.gz) = d6697e2871e77238460402e9362d47d18382b15ef9f246aba6c7bd780d38a6b0
+SIZE (openssl-1.1.1v.tar.gz) = 9893443
diff --git a/security/openssl/files/patch-CVE-2023-3817 b/security/openssl/files/patch-CVE-2023-3817
deleted file mode 100644
index 3f1d5193c73f..000000000000
--- a/security/openssl/files/patch-CVE-2023-3817
+++ /dev/null
@@ -1,55 +0,0 @@
-From 91ddeba0f2269b017dc06c46c993a788974b1aa5 Mon Sep 17 00:00:00 2001
-From: Tomas Mraz <tomas@openssl.org>
-Date: Fri, 21 Jul 2023 11:39:41 +0200
-Subject: [PATCH] DH_check(): Do not try checking q properties if it is
- obviously invalid
-
-If |q| >= |p| then the q value is obviously wrong as q
-is supposed to be a prime divisor of p-1.
-
-We check if p is overly large so this added test implies that
-q is not large either when performing subsequent tests using that
-q value.
-
-Otherwise if it is too large these additional checks of the q value
-such as the primality test can then trigger DoS by doing overly long
-computations.
-
-Fixes CVE-2023-3817
-
-Reviewed-by: Paul Dale <pauli@openssl.org>
-Reviewed-by: Matt Caswell <matt@openssl.org>
-(Merged from https://github.com/openssl/openssl/pull/21551)
----
- crypto/dh/dh_check.c | 11 +++++++++--
- 1 file changed, 9 insertions(+), 2 deletions(-)
-
-diff --git a/crypto/dh/dh_check.c b/crypto/dh/dh_check.c
-index 2001d2e7cb19..9ae96991eb4a 100644
---- crypto/dh/dh_check.c.orig
-+++ crypto/dh/dh_check.c
-@@ -97,7 +97,7 @@ int DH_check_ex(const DH *dh)
-
- int DH_check(const DH *dh, int *ret)
- {
-- int ok = 0, r;
-+ int ok = 0, r, q_good = 0;
- BN_CTX *ctx = NULL;
- BIGNUM *t1 = NULL, *t2 = NULL;
-
-@@ -120,7 +120,14 @@ int DH_check(const DH *dh, int *ret)
- if (t2 == NULL)
- goto err;
-
-- if (dh->q) {
-+ if (dh->q != NULL) {
-+ if (BN_ucmp(dh->p, dh->q) > 0)
-+ q_good = 1;
-+ else
-+ *ret |= DH_CHECK_INVALID_Q_VALUE;
-+ }
-+
-+ if (q_good) {
- if (BN_cmp(dh->g, BN_value_one()) <= 0)
- *ret |= DH_NOT_SUITABLE_GENERATOR;
- else if (BN_cmp(dh->g, dh->p) >= 0)