summaryrefslogtreecommitdiffstats
path: root/package/mbedtls
Commit message (Collapse)AuthorAgeFilesLines
* mbedtls: security bump to version 2.7.9Fabrice Fontaine2019-01-292-4/+4
| | | | | | | | | CVE-2018-19608 is fixed by bumping mbdedtls to a version greater or equal to 2.7.8, see https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2018-03 Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* mbedtls: fix x86 PIC build with GCC < 5Peter Korsgaard2018-08-281-0/+74
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fixes: http://autobuild.buildroot.net/results/d6d/d6dc9a640aa1f6650a3e7b9397f2fe2ae3433f4d/ http://autobuild.buildroot.net/results/ab5/ab5a58ea7845f9f378454ee1aa7e872448618ba9/ ebx was recently added to the x86 inline asm MULADDC_STOP clobber list to fix #1550, but this causes the build to fail with GCC < 5 when building in PIC mode with errors like: include/mbedtls/bn_mul.h:46:13: error: PIC register clobbered by ‘ebx’ in ‘asm’ This is because older GCC versions treated the x86 ebx register (which is used for the GOT) as a fixed reserved register when building as PIC. This is fixed by an improved register allocator in GCC 5+. From the release notes: Register allocation improvements: Reuse of the PIC hard register, instead of using a fixed register, was implemented on x86/x86-64 targets. This improves generated PIC code performance as more hard registers can be used. https://www.gnu.org/software/gcc/gcc-5/changes.html As a workaround, add a patch to detect this situation and disable the inline assembly, similar to the MULADDC_CANNOT_USE_R7 logic. Patch submitted upstream: https://github.com/ARMmbed/mbedtls/pull/1986 Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* mbedtls: security bump to version 2.7.5Peter Korsgaard2018-08-242-4/+4
| | | | | | | | | | | | | | | | Fixes the following security issues: - CVE-2018-0497: Remote plaintext recovery on use of CBC based ciphersuites through a timing side-channel - CVE-2018-0498: Plaintext recovery on use of CBC based ciphersuites through a cache based side-channel For more info, see the advisory: https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2018-02 Signed-off-by: Peter Korsgaard <peter@korsgaard.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
* mbedtls: bump to version 2.7.4Fabrice Fontaine2018-07-252-4/+4
| | | | | Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
* mbedtls: security bump to version 2.7.3Fabrice Fontaine2018-05-202-4/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Extract from release announcement: - (2.9, 2.7, 2.1) Fixed an issue in the X.509 module which could lead to a buffer overread during certificate validation. Additionally, the issue could also lead to unnecessary callback checks being made or to some validation checks to be omitted. The overread could be triggered remotely, while the other issues would require a non DER-compliant certificate to be correctly signed by a trusted CA, or a trusted CA with a non DER-compliant certificate. Found by luocm. Fixes #825. - (2.9, 2.7, 2.1) Fixed the buffer length assertion in the ssl_parse_certificate_request() function which could lead to an arbitrary overread of the message buffer. The overreads could be caused by receiving a malformed algorithms section which was too short. In builds with debug output, this overread data was output with the debug data. - (2.9, 2.7, 2.1) Fixed a client-side bug in the validation of the server's ciphersuite choice which could potentially lead to the client accepting a ciphersuite it didn't offer or a ciphersuite that could not be used with the TLS or DTLS version chosen by the server. This could lead to corruption of internal data structures for some configurations. Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
* mbedtls: security bump to version 2.7.2Baruch Siach2018-04-253-37/+4
| | | | | | | | | | | | | | | | | | | | | | | | | The release announcement mentions these security fixes: Defend against Bellcore glitch attacks by verifying the results of RSA private key operations. Fix implementation of the truncated HMAC extension. The previous implementation allowed an offline 2^80 brute force attack on the HMAC key of a single, uninterrupted connection (with no resumption of the session). Reject CRLs containing unsupported critical extensions. Fix a buffer overread in ssl_parse_server_key_exchange() that could cause a crash on invalid input. (CVE-2018-9988) Fix a buffer overread in ssl_parse_server_psk_hint() that could cause a crash on invalid input. (CVE-2018-9989) Drop upstream patch. Signed-off-by: Baruch Siach <baruch@tkos.co.il> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
* mbedtls: fix API compatibilityBaruch Siach2018-02-251-0/+33
| | | | | | | | | | | | | Add upstream patch fixing API compatibility with previous releases. Fixes (hiawatha): http://autobuild.buildroot.net/results/ce6/ce6b4a50e6aafd06f82eaae688dd8720b982e9c2/ http://autobuild.buildroot.net/results/cde/cdec7ae3565d5b76a9bc50156c6244b44197534e/ http://autobuild.buildroot.net/results/9c1/9c1aec09c03f60bee9dc134da5a29e2671fc3b5e/ Cc: Thomas Petazzoni <thomas.petazzoni@bootlin.com> Signed-off-by: Baruch Siach <baruch@tkos.co.il> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
* mbedtls: security bump to version 2.7.0Baruch Siach2018-02-232-4/+4
| | | | | | | | | | | | | | | CVE-2018-0487: Remote attackers can execute arbitrary code or cause a denial of service (buffer overflow) via a crafted certificate chain that is mishandled during RSASSA-PSS signature verification within a TLS or DTLS session. CVE-2018-0488: When the truncated HMAC extension and CBC are used, allows remote attackers to execute arbitrary code or cause a denial of service (heap corruption) via a crafted application packet within a TLS or DTLS session. Signed-off-by: Baruch Siach <baruch@tkos.co.il> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* package/*/Config.in: fix help text check-package warningsThomas Petazzoni2017-12-181-4/+4
| | | | | | | | | | | | | This commit fixes the warnings reported by check-package on the help text of all package Config.in files, related to the formatting of the help text: should start with a tab, then 2 spaces, then at most 62 characters. The vast majority of warnings fixed were caused by too long lines. A few warnings were related to spaces being used instead of a tab to indent the help text. Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* mbedtls: security bump to version 2.6.0Baruch Siach2017-09-072-3/+6
| | | | | | | | | | | | Fixes CVE-2017-14032: authentication bypass. https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2017-02 Add license hash. Cc: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Baruch Siach <baruch@tkos.co.il> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* package: remove trailing whitespaceRicardo Martincoski2017-04-061-1/+1
| | | | | | | | | | | Occurrences were searched using [1]: check-package --include-only TrailingSpace $(find * -type f) and manually removed. [1] http://patchwork.ozlabs.org/patch/729666/ Signed-off-by: Ricardo Martincoski <ricardo.martincoski@gmail.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* mbedtls: security bump to verison 2.4.2Gustavo Zacarias2017-03-152-3/+3
| | | | | | | | | Fixes: CVE-2017-2784 - Freeing of memory allocated on stack when validating a public key with a secp224k1 curve. Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* package/mbedtls: make compression support a config optionJörg Krause2017-02-062-1/+13
| | | | | | | | | | | | | | | | | Enabling TLS compression may make mbedTLS vulnerable to the CRIME attack [1]. It should not be enabled unless is is sure CRIME and similar attacks are not applicable to the particulare situation. As zlib is probably enabled in most systems, the user might end up with a vulnerable system without knowing. So, instead of enabling compression support if the zlib package is available, we make the compression support a config option. This way, the user has to explicitly enable compression support and is warned by the help text about the risk. [1] https://tls.mbed.org/kb/how-to/deflate-compression-in-ssl-tls Signed-off-by: Jörg Krause <joerg.krause@embedded.rocks> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* package/mbedtls: fix zlib supportJörg Krause2017-02-061-0/+5
| | | | | | | | | | | | | | | | | To enable compression support using zlib it is necessary to uncomment the define for MBEDTLS_ZLIB_SUPPORT in config.h [1]. Note, that enabling TLS compression may make mbedTLS vulnerable to the CRIME attack [1]. It should not be enabled unless is is sure CRIME and similar attacks are not applicable to the particulare situation. As zlib is probably enabled in most systems, maybe it is best to make the compression support a user choice and add the warning from [1]? [1] https://tls.mbed.org/kb/how-to/deflate-compression-in-ssl-tls Signed-off-by: Jörg Krause <joerg.krause@embedded.rocks> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* mbedtls: bump to version 2.4.0Rahul Jain2016-12-062-2/+2
| | | | | | | | This change also fixes http://autobuild.buildroot.net/results/27b/27b35d03b576392955e21498ac1e62590ef5f5db/build-end.log Signed-off-by: Rahul Jain <Rahul.Jain@imgtec.com> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* MIPS: replace every BR2_mips_* with the new MIPS CPU optionsVicente Olivert Riera2016-10-151-1/+1
| | | | | Signed-off-by: Vicente Olivert Riera <Vincent.Riera@imgtec.com> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* mbedtls: bump to version 2.3.0Fabrice Fontaine2016-10-142-3/+3
| | | | | Signed-off-by: Fabrice Fontaine <fabrice.fontaine@orange.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* mbedtls: fix companion programs static buildBaruch Siach2016-05-281-0/+3
| | | | | | | | | | | | Set LINK_WITH_PTHREAD to explicitly add pthread to the list of libraries. Fixes: http://autobuild.buildroot.net/results/e08/e087dfa2a6057b18209cd6adff2760026a9ca1db/ http://autobuild.buildroot.net/results/615/61565f1a88b7d6eea03a355ccf8dd3fe6585c4ab/ http://autobuild.buildroot.net/results/6b2/6b267b9cba37655e7d8e6d78821f96d9a8dd7d2e/ Signed-off-by: Baruch Siach <baruch@tkos.co.il> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* mbedtls: security bump to version 2.2.1Gustavo Zacarias2016-01-082-3/+3
| | | | | | | | | Fixes: CVE-2015-7575 - Security Losses from Obsolete and Truncated Transcript Hashes (SLOTH) vulnerability. Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* mbedtls: disable assembly for some scenariosGustavo Zacarias2015-12-301-0/+18
| | | | | | | | | | It's affected in the same way as polarssl, but use an enhanced trick compared to 130ca81b since it's required by the codebase. Fixes: http://autobuild.buildroot.net/results/584/584d1d12be9f2bbf45ccbdf93b6b442524059dcc/ http://autobuild.buildroot.net/results/d13/d13a06ba3fc0d7f08a03c04fcb484761da7af3f7/ Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* mbedtls: new packageGustavo Zacarias2015-12-293-0/+68
Add the mbed TLS library, formerly known as PolarSSL. The 2.0+ version can live side-by-side with polarssl since it was renamed, hence can be added with no conflict. Use the Apache-2.0 license variant since it's somewhat more flexible, the codebase is the same as the GPLv2 variant, just copyright headers/license file changed. Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
OpenPOWER on IntegriCloud