Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 595186 (CVE-2016-6309, CVE-2016-7052) - <dev-libs/openssl-1.0.2j: Multiple vulnerabilities
Summary: <dev-libs/openssl-1.0.2j: Multiple vulnerabilities
Status: RESOLVED FIXED
Alias: CVE-2016-6309, CVE-2016-7052
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: Gentoo Security
URL: https://www.openssl.org/news/secadv/2...
Whiteboard: A3 [glsa cve]
Keywords:
Depends on:
Blocks: CVE-2016-2180, CVE-2016-2183, CVE-2016-6303, CVE-2016-6304, CVE-2016-6305, CVE-2016-6306, CVE-2016-6307, CVE-2016-6308
  Show dependency tree
 
Reported: 2016-09-26 11:09 UTC by Kristian Fiskerstrand (RETIRED)
Modified: 2016-12-07 10:28 UTC (History)
2 users (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Kristian Fiskerstrand (RETIRED) gentoo-dev 2016-09-26 11:09:09 UTC
OpenSSL Security Advisory [26 Sep 2016]
========================================

This security update addresses issues that were caused by patches
included in our previous security update, released on 22nd September
2016.  Given the Critical severity of one of these flaws we have
chosen to release this advisory immediately to prevent upgrades to the
affected version, rather than delaying in order to provide our usual
public pre-notification.


Fix Use After Free for large message sizes (CVE-2016-6309)
==========================================================

Severity: Critical

This issue only affects OpenSSL 1.1.0a, released on 22nd September 2016.

The patch applied to address CVE-2016-6307 resulted in an issue where if a
message larger than approx 16k is received then the underlying buffer to store
the incoming message is reallocated and moved. Unfortunately a dangling pointer
to the old location is left which results in an attempt to write to the
previously freed location. This is likely to result in a crash, however it
could potentially lead to execution of arbitrary code.

OpenSSL 1.1.0 users should upgrade to 1.1.0b

This issue was reported to OpenSSL on 23rd September 2016 by Robert
ÅwiÄcki (Google Security Team), and was found using honggfuzz. The fix
was developed by Matt Caswell of the OpenSSL development team.

Missing CRL sanity check (CVE-2016-7052)
========================================

Severity: Moderate

This issue only affects OpenSSL 1.0.2i, released on 22nd September 2016.

A bug fix which included a CRL sanity check was added to OpenSSL 1.1.0
but was omitted from OpenSSL 1.0.2i. As a result any attempt to use
CRLs in OpenSSL 1.0.2i will crash with a null pointer exception.

OpenSSL 1.0.2i users should upgrade to 1.0.2j

The issue was reported to OpenSSL on 22nd September 2016 by Bruce Stephens and
Thomas Jakobi. The fix was developed by Matt Caswell of the OpenSSL development
team.

References
==========

URL for this Security Advisory:
https://www.openssl.org/news/secadv/20160926.txt

Note: the online version of the advisory may be updated with additional details
over time.

For details of OpenSSL severity classifications please see:
https://www.openssl.org/policies/secpolicy.html
Comment 1 Lars Wendler (Polynomial-C) (RETIRED) gentoo-dev 2016-09-26 11:49:29 UTC
commit ded8cff386884ada7760078bd10d42cb58c73bc2
Author: Lars Wendler <polynomial-c@gentoo.org>
Date:   Mon Sep 26 13:44:41 2016

    dev-libs/openssl: Sec bump to versions 1.0.2j and 1.1.0b (bug #595186).
    
    Removed old.
    
    Package-Manager: portage-2.3.1
    Signed-off-by: Lars Wendler <polynomial-c@gentoo.org>


Arches please test and mark stable =dev-libs/openssl-1.0.2j with target KEYWORDS:

alpha amd64 arm ~arm64 hppa ia64 ~m68k ~mips ppc ppc64 ~s390 ~sh sparc x86 ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~arm-linux ~x86-linux
Comment 2 Agostino Sarubbo gentoo-dev 2016-09-26 18:57:25 UTC
amd64 stable
Comment 3 Agostino Sarubbo gentoo-dev 2016-09-26 18:58:48 UTC
x86 stable
Comment 4 Jeroen Roovers (RETIRED) gentoo-dev 2016-09-27 03:26:17 UTC
Stable for HPPA PPC64.
Comment 5 Tobias Klausmann (RETIRED) gentoo-dev 2016-09-27 08:17:23 UTC
Stable on alpha.
Comment 6 Agostino Sarubbo gentoo-dev 2016-09-29 09:42:30 UTC
sparc stable
Comment 7 Agostino Sarubbo gentoo-dev 2016-09-29 12:40:10 UTC
ppc stable
Comment 8 Agostino Sarubbo gentoo-dev 2016-09-29 13:16:00 UTC
arm stable
Comment 9 Agostino Sarubbo gentoo-dev 2016-09-29 13:32:35 UTC
ia64 stable.

Maintainer(s), please cleanup.
Comment 10 Thomas Deutschmann (RETIRED) gentoo-dev 2016-11-21 11:58:29 UTC
Cleanup already done: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=246f6b0590667adffa8967d9ba41bc993119a553
Comment 11 GLSAMaker/CVETool Bot gentoo-dev 2016-12-07 10:28:27 UTC
This issue was resolved and addressed in
 GLSA 201612-16 at https://security.gentoo.org/glsa/201612-16
by GLSA coordinator Aaron Bauman (b-man).