Bug 227455 - [maintainer-update] security/botan2: update to 2.6.0
Summary: [maintainer-update] security/botan2: update to 2.6.0
Status: Closed FIXED
Alias: None
Product: Ports & Packages
Classification: Unclassified
Component: Individual Port(s) (show other bugs)
Version: Latest
Hardware: Any Any
: --- Affects Some People
Assignee: freebsd-ports-bugs mailing list
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2018-04-12 07:34 UTC by Ralf van der Enden
Modified: 2018-04-12 12:02 UTC (History)
0 users

See Also:


Attachments
Update to 2.6.0 (1.31 KB, patch)
2018-04-12 07:34 UTC, Ralf van der Enden
tremere: maintainer-approval+
Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Ralf van der Enden 2018-04-12 07:34:50 UTC
Created attachment 192444 [details]
Update to 2.6.0

Bugfixes and some new features. Most notable fix:
- CVE-2018-9860 Fix a bug decrypting TLS CBC ciphertexts which could for a malformed ciphertext cause the decryptor to read and HMAC an additional 64K bytes of data which is not part of the record. This could cause a crash if the read went into unmapped memory. No information leak or out of bounds write occurs.

Full changelog:
https://botan.randombit.net/news.html#version-2-6-0-2018-04-10
Comment 1 commit-hook freebsd_committer 2018-04-12 11:52:24 UTC
A commit references this bug:

Author: krion
Date: Thu Apr 12 11:51:30 UTC 2018
New revision: 467146
URL: https://svnweb.freebsd.org/changeset/ports/467146

Log:
  Update to 2.6.0

  Bugfixes and some new features. Most notable fix:
  - CVE-2018-9860 Fix a bug decrypting TLS CBC ciphertexts which could
    for a malformed ciphertext cause the decryptor to read and HMAC an
    additional 64K bytes of data which is not part of the record. This
    could cause a crash if the read went into unmapped memory. No
    information leak or out of bounds write occurs.

  PR:		227455
  Submitted by:	maintainer

Changes:
  head/security/botan2/Makefile
  head/security/botan2/distinfo
  head/security/botan2/pkg-plist