Bug 220183 - [MAINTAINER] security/openvpn-devel: Update to 201724 snapshot
Summary: [MAINTAINER] security/openvpn-devel: Update to 201724 snapshot
Status: Closed FIXED
Alias: None
Product: Ports & Packages
Classification: Unclassified
Component: Individual Port(s) (show other bugs)
Version: Latest
Hardware: Any Any
: --- Affects Only Me
Assignee: Josh Paetzel
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2017-06-21 12:58 UTC by Eric F Crist
Modified: 2017-06-23 16:39 UTC (History)
1 user (show)

See Also:

Attachments
svn diff (3.45 KB, patch)
2017-06-21 12:58 UTC, Eric F Crist 		no flags Details | Diff
update to 201725, which includes fixes for 4 CVEs. (5.70 KB, patch)
2017-06-21 13:29 UTC, Eric F Crist 		no flags Details | Diff
Show Obsolete (1) View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Eric F Crist 2017-06-21 12:58:25 UTC 
Created attachment 183672 [details]
svn diff

Update port to 201724 source code snapshot.
Comment 1 Eric F Crist 2017-06-21 13:14:20 UTC 
I'm going to post a new diff in a bit.  There's apparently some new code that fixes security vulnerabilities that isn't in the tarball used here.
Comment 2 Eric F Crist 2017-06-21 13:29:54 UTC 
Created attachment 183675 [details]
update to 201725, which includes fixes for 4 CVEs.

New patch, includes update to 201725, which includes important security updates to OpenVPN:

CVE-2017-7508: mssfix.c remotely-triggerable ASSERT() on malformed IPv6 packet
CVE-2017-7520: ntlm.c NTLM data leak
CVE-2017-7521: issues in extract_x509_extension() leading to server memory drain/crash/double-free
CVE-2017-7522: mbedTLS/PolarSSL with --x509-track remote crash for certificate containing NULL values in subject name
Comment 3 commit-hook freebsd_committer freebsd_triage 2017-06-21 19:19:54 UTC 
A commit references this bug:

Author: jpaetzel
Date: Wed Jun 21 19:19:26 UTC 2017
New revision: 444072
URL: https://svnweb.freebsd.org/changeset/ports/444072

Log:
  Update to latest version

  PR:	220183
  Submitted by:	ecrist@secure-computing.net

Changes:
  head/security/openvpn-devel/Makefile
  head/security/openvpn-devel/distinfo
Comment 4 commit-hook freebsd_committer freebsd_triage 2017-06-23 16:39:54 UTC 
A commit references this bug:

Author: jpaetzel
Date: Fri Jun 23 16:38:50 UTC 2017
New revision: 444183
URL: https://svnweb.freebsd.org/changeset/ports/444183

Log:
  MFH: r444072

  Update to latest version

  PR:	220183
  Submitted by:	ecrist@secure-computing.net

  Approved by:	ports-secteam (delphij)

Changes:
_U  branches/2017Q2/
  branches/2017Q2/security/openvpn-devel/Makefile
  branches/2017Q2/security/openvpn-devel/distinfo