Changes between 1.0.1e and 1.0.1f [6 Jan 2014]
*) Fix for TLS record tampering bug. A carefully crafted invalid
handshake could crash OpenSSL with a NULL pointer exception.
Thanks to Anton Johansson for reporting this issues.
(CVE-2013-4353)
*) Keep original DTLS digest and encryption contexts in retransmission
structures so we can use the previous session parameters if they need
to be resent. (CVE-2013-6450)
[Steve Henson]
*) Add option SSL_OP_SAFARI_ECDHE_ECDSA_BUG (part of SSL_OP_ALL) which
avoids preferring ECDHE-ECDSA ciphers when the client appears to be
Safari on OS X. Safari on OS X 10.8..10.8.3 advertises support for
several ECDHE-ECDSA ciphers, but fails to negotiate them. The bug
is fixed in OS X 10.8.4, but Apple have ruled out both hot fixing
10.8..10.8.3 and forcing users to upgrade to 10.8.4 or newer.
[Rob Stradling, Adam Langley]
Note:
We need to inject '-std=c99' because the reference implementation of blake2
is using C99 specific semantics.
------------------------------------------------------------------------------
crypto_generichash/blake2/ref/blake2b-ref.c: In function 'blake2b_init0':
crypto_generichash/blake2/ref/blake2b-ref.c:143:3: error: 'for' loop initial declarations are only allowed in C99 mode
crypto_generichash/blake2/ref/blake2b-ref.c:143:3: note: use option -std=c99 or -std=gnu99 to compile your code
crypto_generichash/blake2/ref/blake2b-ref.c: In function 'crypto_generichash_blake2b__init_param':
crypto_generichash/blake2/ref/blake2b-ref.c:155:3: error: 'for' loop initial declarations are only allowed in C99 mode
crypto_generichash/blake2/ref/blake2b-ref.c: In function 'crypto_generichash_blake2b__final':
crypto_generichash/blake2/ref/blake2b-ref.c:328:3: error: 'for' loop initial declarations are only allowed in C99 mode
------------------------------------------------------------------------------
Note:
This is an "unofficial" patch which was not provided by the vserver folks,
but to be able to proceed with updating the 3.4 kernel series we put an
adjusted version that applies on top of linux 3.4.55.
Christian Wiese
Alejandro Mery
Christian Wiese
Gernot Tenchio