aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorColin Percival <cperciva@FreeBSD.org>2006-09-29 13:46:41 +0000
committerColin Percival <cperciva@FreeBSD.org>2006-09-29 13:46:41 +0000
commit69563d3a52a724e304ed378c595c4c76e21f976a (patch)
tree17284960827f65120c31c905444b28e27d8ffa50
parentd5b71cdd0551039af065f4f013585737a26e6fac (diff)
downloadsrc-69563d3a52a724e304ed378c595c4c76e21f976a.tar.gz
src-69563d3a52a724e304ed378c595c4c76e21f976a.zip
Correct problem in the 2006-09-28 patch concerning the handling of
excessively large DH moduli. Reported by: Steve Kiernan (Juniper SIRT) Security: FreeBSD-SA-06:23.openssl Approved by: so (cperciva)
Notes
Notes: svn path=/releng/5.4/; revision=162788
-rw-r--r--UPDATING4
-rw-r--r--crypto/openssl/crypto/dh/dh_key.c2
-rw-r--r--sys/conf/newvers.sh2
3 files changed, 6 insertions, 2 deletions
diff --git a/UPDATING b/UPDATING
index 8e0d90d0fd7e..164266c9d08b 100644
--- a/UPDATING
+++ b/UPDATING
@@ -8,6 +8,10 @@ Items affecting the ports and packages system can be found in
/usr/ports/UPDATING. Please read that file before running
portupgrade. Important recent entries: 20040724 (default X changes).
+20060929: p21 FreeBSD-SA-06:23.openssl
+ Correct problem in the 2006-09-28 patch concerning the handling of
+ excessively large DH moduli.
+
20060928: p20 FreeBSD-SA-06:23.openssl
Correct multiple vulnerabilities in crypto(3).
Limit the size of public keys used in order to protect applications
diff --git a/crypto/openssl/crypto/dh/dh_key.c b/crypto/openssl/crypto/dh/dh_key.c
index f735fa78f1a5..51bfc76ca418 100644
--- a/crypto/openssl/crypto/dh/dh_key.c
+++ b/crypto/openssl/crypto/dh/dh_key.c
@@ -167,7 +167,7 @@ static int compute_key(unsigned char *key, const BIGNUM *pub_key, DH *dh)
if (BN_num_bits(dh->p) > OPENSSL_DH_MAX_MODULUS_BITS)
{
DHerr(DH_F_DH_COMPUTE_KEY,DH_R_MODULUS_TOO_LARGE);
- goto err;
+ return -1;
}
ctx = BN_CTX_new();
diff --git a/sys/conf/newvers.sh b/sys/conf/newvers.sh
index 0ff8d1f0e7bf..59022921d095 100644
--- a/sys/conf/newvers.sh
+++ b/sys/conf/newvers.sh
@@ -32,7 +32,7 @@
TYPE="FreeBSD"
REVISION="5.4"
-BRANCH="RELEASE-p20"
+BRANCH="RELEASE-p21"
RELEASE="${REVISION}-${BRANCH}"
VERSION="${TYPE} ${RELEASE}"