OpenPOWER buildroot sources https://git.raptorcs.com/git/buildroot/atom?h=2017.02.1 2017-03-07T15:12:05+00:00 2017-03-07T15:12:05+00:00 Gustavo Zacarias gustavo@zacarias.com.ar 2017-03-06T14:55:06+00:00 urn:sha1:4e10b104b8c6955ad915c2a6be9ce71c7144fc72 Fixes: GNUTLS-SA-2017-3A - Addressed integer overflow resulting to invalid memory write in OpenPGP certificate parsing. GNUTLS-SA-2017-3B - Addressed crashes in OpenPGP certificate parsing, related to private key parser. No longer allow OpenPGP certificates (public keys) to contain private key sub-packets. GNUTLS-SA-2017-3C - Addressed large allocation in OpenPGP certificate parsing, that could lead in out-of-memory condition. Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com> (cherry picked from commit 6fdb2b109bdec24ea426e0a6786ced7dbb591732) Signed-off-by: Peter Korsgaard <peter@korsgaard.com> 2017-03-07T15:11:58+00:00 Peter Korsgaard peter@korsgaard.com 2017-02-13T22:17:27+00:00 urn:sha1:abab5b94cd815b13b042d1d89688eb260265081b Signed-off-by: Peter Korsgaard <peter@korsgaard.com> (cherry picked from commit 743f5076df0a852f25d55c3bcb1d3e33eec07055) Signed-off-by: Peter Korsgaard <peter@korsgaard.com> 2017-01-09T15:39:50+00:00 Gustavo Zacarias gustavo@zacarias.com.ar 2017-01-09T14:32:20+00:00 urn:sha1:9b347c4acd15afd1368c2d1d24ca73557cb43ceb The 3.5.x has been promoted to stable, hence 3.4.x is deprecated and 3.3.x kept as old-stable. libdane now specifies LGPLv2.1+ so drop the README kludge (which is also gone regarding licensing). libunistring is a new dependency, even though gnutls ships a builtin version we prefer to use unbundled to avoid duplication with other users and target size growth. Fixes: GNUTLS-SA-2017-01 - It was found using the OSS-FUZZ fuzzer infrastructure that decoding a specially crafted X.509 certificate with Proxy Certificate Information extension present could lead to a double free. GNUTLS-SA-2017-02 - It was found using the OSS-FUZZ fuzzer infrastructure that decoding a specially crafted OpenPGP certificate could lead to heap and stack overflows. Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Peter Korsgaard <peter@korsgaard.com> 2016-12-09T17:11:24+00:00 Gustavo Zacarias gustavo@zacarias.com.ar 2016-12-09T12:51:36+00:00 urn:sha1:455487dbd1e6d616c1d82bafd4c6be6191d0c7b2 Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Peter Korsgaard <peter@korsgaard.com> 2016-10-13T06:05:51+00:00 Gustavo Zacarias gustavo@zacarias.com.ar 2016-10-10T13:03:48+00:00 urn:sha1:881b7bd31e0c306f1dfa317ec958b4ee4456f435 Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Peter Korsgaard <peter@korsgaard.com> 2016-09-08T17:47:05+00:00 Gustavo Zacarias gustavo@zacarias.com.ar 2016-09-08T12:40:29+00:00 urn:sha1:fc56a9ea3f4c4f468e4a7a25253afc01a885d820 Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Peter Korsgaard <peter@korsgaard.com> 2016-07-14T10:53:28+00:00 Gustavo Zacarias gustavo@zacarias.com.ar 2016-07-13T12:56:57+00:00 urn:sha1:6606dde1d54660501ec82052af054af63332bc82 Fixes: GNUTLS-SA-2016-2 - vulnerability that affects certificate verification when GnuTLS is used in combination with the p11-kit trust module. Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com> 2016-07-04T22:10:05+00:00 Rahul Bedarkar rahul.bedarkar@imgtec.com 2016-07-04T12:46:21+00:00 urn:sha1:f2844807a7e6a590dd42642a5484baf683cef73b GnuTLS core library is licensed under LGPLv2.1+ while gnutls-openssl library is licensed under GPLv3+. Annotate the license with components. Reviewed-by: Marcin Nowakowski <marcin.nowakowski@imgtec.com> Signed-off-by: Rahul Bedarkar <rahul.bedarkar@imgtec.com> [Thomas: - add comment about the license of the "core library" since some files seems to be mistakenly under LGPLv3+ even though the library is licensed under LGPLv2.1+. - add the README file in the license information, since it contains a lot of useful details.] Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com> 2016-06-07T11:10:52+00:00 Gustavo Zacarias gustavo@zacarias.com.ar 2016-06-06T23:43:12+00:00 urn:sha1:57bb2d730b87b9e5a268ce859db71e455eacc1f1 Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com> 2016-05-22T19:35:39+00:00 Gustavo Zacarias gustavo@zacarias.com.ar 2016-05-20T17:40:16+00:00 urn:sha1:f8799db7903ebedaad220a0a60b4209a9e1701b4 Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>