| |||||||||||||||||||
Fedora alert FEDORA-2010-9639 (openssl)
-------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2010-9639 2010-06-07 20:42:38 -------------------------------------------------------------------------------- Name : openssl Product : Fedora 12 Version : 1.0.0a Release : 1.fc12 URL : http://www.openssl.org/ Summary : A general purpose cryptography library with TLS implementation Description : The OpenSSL toolkit provides support for secure communications between machines. OpenSSL includes a certificate management tool and shared libraries which provide various cryptographic algorithms and protocols. -------------------------------------------------------------------------------- Update Information: Minor update from upstream fixing two security vulnerabilities - CVE-2010-0742 and CVE-2010-1633. It is fully ABI compatible with openssl-1.0.0. -------------------------------------------------------------------------------- ChangeLog: * Fri Jun 4 2010 Tomas Mraz <tmraz@redhat.com> 1.0.0a-1 - new upstream patch release, fixes CVE-2010-0742 (#598738) and CVE-2010-1633 (#598732) * Wed May 19 2010 Tomas Mraz <tmraz@redhat.com> 1.0.0-5 - pkgconfig files now contain the correct libdir (#593723) * Tue May 18 2010 Tomas Mraz <tmraz@redhat.com> 1.0.0-4 - make CA dir readable - the private keys are in private subdir (#584810) - do not move the libcrypto to /lib in the F12 package * Fri Apr 9 2010 Tomas Mraz <tmraz@redhat.com> 1.0.0-3 - a few fixes from upstream CVS - move libcrypto to /lib (#559953) * Tue Apr 6 2010 Tomas Mraz <tmraz@redhat.com> 1.0.0-2 - set UTC timezone on pod2man run (#578842) - make X509_NAME_hash_old work in FIPS mode * Tue Mar 30 2010 Tomas Mraz <tmraz@redhat.com> 1.0.0-1 - update to final 1.0.0 upstream release * Tue Feb 16 2010 Tomas Mraz <tmraz@redhat.com> 1.0.0-0.22.beta5 - make TLS work in the FIPS mode * Fri Feb 12 2010 Tomas Mraz <tmraz@redhat.com> 1.0.0-0.21.beta5 - gracefully handle zero length in assembler implementations of OPENSSL_cleanse (#564029) - do not fail in s_server if client hostname not resolvable (#561260) * Wed Jan 20 2010 Tomas Mraz <tmraz@redhat.com> 1.0.0-0.20.beta5 - new upstream release * Thu Jan 14 2010 Tomas Mraz <tmraz@redhat.com> 1.0.0-0.19.beta4 - fix CVE-2009-4355 - leak in applications incorrectly calling CRYPTO_free_all_ex_data() before application exit (#546707) - upstream fix for future TLS protocol version handling * Wed Jan 13 2010 Tomas Mraz <tmraz@redhat.com> 1.0.0-0.18.beta4 - add support for Intel AES-NI * Thu Jan 7 2010 Tomas Mraz <tmraz@redhat.com> 1.0.0-0.17.beta4 - upstream fix compression handling on session resumption - various null checks and other small fixes from upstream - upstream changes for the renegotiation info according to the latest draft * Mon Nov 23 2009 Tomas Mraz <tmraz@redhat.com> 1.0.0-0.16.beta4 - fix non-fips mingw build (patch by Kalev Lember) - add IPV6 fix for DTLS * Fri Nov 20 2009 Tomas Mraz <tmraz@redhat.com> 1.0.0-0.15.beta4 - add better error reporting for the unsafe renegotiation * Fri Nov 20 2009 Tomas Mraz <tmraz@redhat.com> 1.0.0-0.14.beta4 - fix build on s390x * Wed Nov 18 2009 Tomas Mraz <tmraz@redhat.com> 1.0.0-0.13.beta4 - disable enforcement of the renegotiation extension on the client (#537962) - add fixes from the current upstream snapshot * Fri Nov 13 2009 Tomas Mraz <tmraz@redhat.com> 1.0.0-0.12.beta4 - keep the beta status in version number at 3 so we do not have to rebuild openssh and possibly other dependencies with too strict version check * Thu Nov 12 2009 Tomas Mraz <tmraz@redhat.com> 1.0.0-0.11.beta4 - update to new upstream version, no soname bump needed - fix CVE-2009-3555 - note that the fix is bypassed if SSL_OP_ALL is used so the compatibility with unfixed clients is not broken. The protocol extension is also not final. -------------------------------------------------------------------------------- References: [ 1 ] Bug #598738 - CVE-2010-0742 openssl: invalid ASN1 module definition for CMS https://bugzilla.redhat.com/show_bug.cgi?id=598738 [ 2 ] Bug #598732 - CVE-2010-1633 openssl: information leak due to invalid Return value check https://bugzilla.redhat.com/show_bug.cgi?id=598732 -------------------------------------------------------------------------------- This update can be installed with the "yum" update program. Use su -c 'yum update openssl' at the command line. For more information, refer to "Managing Software with yum", available at http://docs.fedoraproject.org/yum/. All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/keys -------------------------------------------------------------------------------- _______________________________________________ package-announce mailing list package-announce@lists.fedoraproject.org https://admin.fedoraproject.org/mailman/listinfo/package-... (Log in to post comments)
|
|||||||||||||||||||