svn commit: r314126 - in releng/10.3: . crypto/openssl/crypto/evp sys/conf

[Xin LI]

Author: delphij
Date: Thu Feb 23 07:12:18 2017
New Revision: 314126
URL: https://svnweb.freebsd.org/changeset/base/314126

Log:
  Fix OpenSSL RC4_MD5 cipher vulnerability.
  
  Approved by:	so

Modified:
  releng/10.3/UPDATING
  releng/10.3/crypto/openssl/crypto/evp/e_rc4_hmac_md5.c
  releng/10.3/sys/conf/newvers.sh

Modified: releng/10.3/UPDATING
==============================================================================
--- releng/10.3/UPDATING	Thu Feb 23 07:11:48 2017	(r314125)
+++ releng/10.3/UPDATING	Thu Feb 23 07:12:18 2017	(r314126)
@@ -16,6 +16,10 @@ from older versions of FreeBSD, try WITH
 stable/10, and then rebuild without this option. The bootstrap process from
 older version of current is a bit fragile.
 
+20170223	p17	FreeBSD-SA-17:02.openssl
+
+	Fix OpenSSL RC4_MD5 cipher vulnerability.
+
 20170111	p16	FreeBSD-SA-17:01.openssh
 
 	Fix multiple vulnerabilities of OpenSSH.

Modified: releng/10.3/crypto/openssl/crypto/evp/e_rc4_hmac_md5.c
==============================================================================
--- releng/10.3/crypto/openssl/crypto/evp/e_rc4_hmac_md5.c	Thu Feb 23 07:11:48 2017	(r314125)
+++ releng/10.3/crypto/openssl/crypto/evp/e_rc4_hmac_md5.c	Thu Feb 23 07:12:18 2017	(r314126)
@@ -267,6 +267,8 @@ static int rc4_hmac_md5_ctrl(EVP_CIPHER_
             len = p[arg - 2] << 8 | p[arg - 1];
 
             if (!ctx->encrypt) {
+                if (len < MD5_DIGEST_LENGTH)
+                    return -1;
                 len -= MD5_DIGEST_LENGTH;
                 p[arg - 2] = len >> 8;
                 p[arg - 1] = len;

Modified: releng/10.3/sys/conf/newvers.sh
==============================================================================
--- releng/10.3/sys/conf/newvers.sh	Thu Feb 23 07:11:48 2017	(r314125)
+++ releng/10.3/sys/conf/newvers.sh	Thu Feb 23 07:12:18 2017	(r314126)
@@ -32,7 +32,7 @@
 
 TYPE="FreeBSD"
 REVISION="10.3"
-BRANCH="RELEASE-p16"
+BRANCH="RELEASE-p17"
 if [ "X${BRANCH_OVERRIDE}" != "X" ]; then
 	BRANCH=${BRANCH_OVERRIDE}
 fi