Overview Repositories Revisions Requests Users Attributes Meta

Secure Sockets and Transport Layer Security

Edit Package openssl

The OpenSSL Project is a collaborative effort to develop a robust,
commercial-grade, full-featured, and open source toolkit implementing
the Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS
v1) protocols with full-strength cryptography. The project is managed
by a worldwide community of volunteers that use the Internet to
communicate, plan, and develop the OpenSSL toolkit and its related
documentation.

Derivation and License

OpenSSL is based on the excellent SSLeay library developed by Eric A.
Young and Tim J. Hudson. The OpenSSL toolkit is licensed under an
Apache-style license, which basically means that you are free to get it
and to use it for commercial and noncommercial purposes.

Refresh
Refresh
Source Files
Filename Size Changed
0001-Axe-builtin-printf-implementation-use-glibc-instead.patch 0000022482 22 KB
0001-libcrypto-Hide-library-private-symbols.patch 0000031989 31.2 KB
0005-libssl-Hide-library-private-symbols.patch 0000004308 4.21 KB
README-FIPS.txt 0000009637 9.41 KB
README.SuSE 0000000370 370 Bytes
VIA_padlock_support_on_64systems.patch 0000007419 7.25 KB
baselibs.conf 0000000295 295 Bytes
bug610223.patch 0000000431 431 Bytes
compression_methods_switch.patch 0000002044 2 KB
merge_from_0.9.8k.patch 0000002655 2.59 KB
openssl-1.0.0-c_rehash-compat.diff 0000001241 1.21 KB
openssl-1.0.1c-default-paths.patch 0000002698 2.63 KB
openssl-1.0.1c-ipv6-apps.patch 0000013486 13.2 KB
openssl-1.0.1e-add-suse-default-cipher-header.patch 0000001149 1.12 KB
openssl-1.0.1e-add-suse-default-cipher.patch 0000001941 1.9 KB
openssl-1.0.1e-add-test-suse-default-cipher-suite.patch 0000000925 925 Bytes
openssl-1.0.1e-fips-ctor.patch 0000004523 4.42 KB
openssl-1.0.1e-fips-ec.patch 0000056956 55.6 KB
openssl-1.0.1e-fips.patch 0000599582 586 KB
openssl-1.0.1e-new-fips-reqs.patch 0000033993 33.2 KB
openssl-1.0.1e-truststore.diff 0000000625 625 Bytes
openssl-1.0.1h.tar.gz 0004475692 4.27 MB
openssl-1.0.1h.tar.gz.asc 0000000836 836 Bytes
openssl-fips-hidden.patch 0000000932 932 Bytes
openssl-fix-pod-syntax.diff 0000007682 7.5 KB
openssl-gcc-attributes.patch 0000002101 2.05 KB
openssl-libssl-noweakciphers.patch 0000000588 588 Bytes
openssl-no-egd.patch 0000000721 721 Bytes
openssl-ocloexec.patch 0000005400 5.27 KB
openssl-pkgconfig.patch 0000001358 1.33 KB
openssl.changes 0000071682 70 KB
openssl.keyring 0000009426 9.21 KB
openssl.spec 0000016809 16.4 KB
openssl.test 0000000063 63 Bytes
Revision 118 (latest revision is 171)
Stephan Kulow's avatar Stephan Kulow (coolo) accepted request 236989 from Marcus Meissner's avatar Marcus Meissner (msmeissn) (revision 118) 
NOTE: 

I submitted perl-Net-SSLeay 1.64 update to devel:languages:perl which
fixes its regression.



- updated openssl to 1.0.1h (bnc#880891):
  - CVE-2014-0224: Fix for SSL/TLS MITM flaw. An attacker using a carefully crafted
    handshake can force the use of weak keying material in OpenSSL
    SSL/TLS clients and servers.
  - CVE-2014-0221: Fix DTLS recursion flaw. By sending an invalid DTLS handshake to an
    OpenSSL DTLS client the code can be made to recurse eventually crashing
    in a DoS attack.
  - CVE-2014-0195: Fix DTLS invalid fragment vulnerability. A buffer
    overrun attack can be triggered by sending invalid DTLS fragments to
    an OpenSSL DTLS client or server. This is potentially exploitable to
    run arbitrary code on a vulnerable client or server.
  - CVE-2014-3470: Fix bug in TLS code where clients enable anonymous
    ECDH ciphersuites are subject to a denial of service attack.
- openssl-buffreelistbug-aka-CVE-2010-5298.patch: removed, upstream
- CVE-2014-0198.patch: removed, upstream
- 0009-Fix-double-frees.patch: removed, upstream
- 0012-Fix-eckey_priv_encode.patch: removed, upstream
- 0017-Double-free-in-i2o_ECPublicKey.patch: removed, upstream
- 0018-fix-coverity-issues-966593-966596.patch: removed, upstream
- 0020-Initialize-num-properly.patch: removed, upstream
- 0022-bignum-allow-concurrent-BN_MONT_CTX_set_locked.patch: removed, upstream
- 0023-evp-prevent-underflow-in-base64-decoding.patch: removed, upstream
- 0024-Fixed-NULL-pointer-dereference-in-PKCS7_dataDecode-r.patch: removed, upstream
- 0025-fix-coverity-issue-966597-error-line-is-not-always-i.patch: removed, upstream
- 0001-libcrypto-Hide-library-private-symbols.patch: disabled heartbeat testcase
- openssl-1.0.1c-ipv6-apps.patch: refreshed
- openssl-fix-pod-syntax.diff: some stuff merged upstream, refreshed

- Added new SUSE default cipher suite
  openssl-1.0.1e-add-suse-default-cipher.patch
Comments 10
Thiru Shetty's avatar
Thiru Shetty (ntshetty) -

Can anyone explain, openssl-1.0.2i-new-fips-reqs.patch is for what and which code based ? I'm unable to map to any code base either openssl-1.0.2i nor openssl-fips which found in https://www.openssl.org/

Marcus Meissner's avatar
Marcus Meissner (msmeissn) -

It is from a seperate FIPS patchset which we used for FIPS certification of openssl in SLES 12 and SLES 12 SP2.

Thiru Shetty's avatar
Thiru Shetty (ntshetty) -

Can i get the source copy of it ?

Marcus Meissner's avatar
Marcus Meissner (msmeissn) -

check out these sources: SUSE:SLE-12-SP2:Update openssl

Thiru Shetty's avatar
Thiru Shetty (ntshetty) -

I'm sorry, couldn't able to locate the exact link. If you don't mind can you help me to point the link ?

Marcus Meissner's avatar
Marcus Meissner (msmeissn) -

https://build.opensuse.org/package/show/SUSE:SLE-12:Update/openssl

Thiru Shetty's avatar
Thiru Shetty (ntshetty) -

Thanks a lot. anyway i can't find openssl-1.0.2i-new-fips-reqs.patch in this path of any updation. I think it's been deleted, prior to this can find openssl-1.0.1i-new-fips-reqs.patch.

Marcus Meissner's avatar
Marcus Meissner (msmeissn) -

make that https://build.opensuse.org/package/show/SUSE:SLE-12-SP2:Update/openssl

Thiru Shetty's avatar
Thiru Shetty (ntshetty) -

Thank you, got it. Basically the New requirements of FIPS 140-2 RSA/DSA were adopted from Red Hat Inc right ?

Marcus Meissner's avatar
Marcus Meissner (msmeissn) -

The patchset is largely from Redhat, we did some small adaptions to even stricter FIPS requirements but I do not recall the details.

openSUSE Build Service is sponsored by
Places