libressl

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revision Previous revision
Next revision		 Previous revision
libressl [2015/12/05 11:11] – Add 2.2.4 and 2.3.1 BernardSpillibressl [2022/05/15 15:36] (current) – Add link for LibreSSL 3.5 BernardSpil
Line 13: Line 13:
 ====== How to use LibreSSL ====== ====== How to use LibreSSL ======
  
-===== LibreSSL versions =====+You can use %%LibreSSL%% with all of your [[#Ports|ports]], or to replace %%OpenSSL%% in [[#Base|base]].
  
-The %%OpenBSD%% project has multiple branches of %%LibreSSL%%. This chapter describes how the upstream project and the %%FreeBSD%% ports correlate.+After switching the %%OpenSSL%% provider you **//MUST//** rebuild all ports.
  
-<callout type="warning"> +===== Problems you'll run into =====
-**Work in progress**+
  
-The ports are currently being refactored to reflect what's in this chapter +After switching this will most likely hit you with cURL 
-</callout>+  * GSS-API: If you need this you must select one of the ports implementations, you cannot combine ports Open-/%%LibreSSL%% with base GSS-API 
 +  * Secure Remote Password (TLS-SRP): //Must// be disabled
  
-==== Stable ====+===== Ports =====
  
-Not to be confused with %%FreeBSD%%'s -STABLE+Using %%LibreSSL%% instead of %%OpenSSL%% has been integrated in the %%FreeBSD%% ports framework. Simply set one of the following in your /etc/make.conf (or corresponding make.conf for poudriere)
  
-The stable versions correspond to a version of %%OpenBSD%% (planned versions/dates in parentheses)+For the current [[#Stable|stable]] branch
  
-| %%LibreSSL%% version | %%OpenBSD%% version | Branched | Release | End-of-support | +<code> 
-| 2.0.(5) | 5.6 | 2014-07-12 | 2014-11-01 | 2015-11-01 | +DEFAULT_VERSIONS+= ssl=libressl 
-| 2.1.(5) | 5.7 | 2014-10-13 | 2015-05-01 | 2016-05-01 | +</code>
-| 2.2.(2) | (5.8) | 2015-06-11 | (2015-11-01) | (2016-11-01) | +
-| 2.3.x | (5.9) | 2015-09-23 | (2016-05-01) | (2017-05-01) |+
  
-%%OpenBSD%% releases happen every 6 months and the project will provide updates for stable versions for one year after release of the corresponding %%OpenBSD%% version. With the release of the next %%OpenBSD%% version, the ABI will remain stable and the major shared library versions do not change.+For the current [[#Next|next]] branch
  
-==== Next ====+<code> 
 +DEFAULT_VERSIONS+= ssl=libressl-devel 
 +</code>
  
-These are point versions for the next %%OpenBSD%% release. Up to the release of the corresponding %%OpenBSD%% version, the ABI and major shared library version keep changing. The snapshot version contains features that are not found in the stable version. To use the latest %%LibreSSL%% features, this is the branch to follow.+after setting this, rebuild all your ports.
  
-**The snapshots are considered to be secure just like the stable versions**+==== Binary distribution ====
  
-==== In ports ====+The standard packages from %%FreeBSD%% are still being built with %%OpenSSL%% from base and for some packages requiring a newer %%OpenSSL%% with %%OpenSSL%% from ports.
  
-To stay in line with the upstream %%OpenBSD%% project, the ports tree will (as of version 2.2/2.3) contain the stable version and the next/snapshot version for early adopters.+The following %%FreeBSD%% derivatives are known to use %%LibreSSL%% 
 +  - [[https://trueos.org|TrueOS]] by default since %%TrueOS%% 10.1.2((%%TrueOS%%® is a user friendly desktop Operating System based on %%FreeBSD%%)) 
 +  - [[https://wiki.opnsense.org/index.php/LibreSSL|OPNsense]] available since OPNsense 15.7((OPNsense is an open source, easy-to-use and easy-to-build %%FreeBSD%% based firewall and routing platform.))
  
-| Date | stable | devel | +===== Base =====
-| 2015-11-01 | 2.2 | 2.3 | +
-| 2016-05-01 | 2.3 | 2.4 |+
  
-As %%OpenBSD%% releases their next version of %%LibreSSL%%-Portable, the libressl-devel port will link to that next-stable version and you must rebuild all your ports.+There are several ways to get a base system without %%OpenSSL%%, currently only from source, but soon using binary distributions as well!
  
-===== Binary distribution =====+==== Build world/kernel from source ====
  
-The standard packages from %%FreeBSD%% are still being built with %%OpenSSL%% from base and for some packages requiring a newer %%OpenSSL%% with %%OpenSSL%% from ports.+The files and an svn-diff can be found on [[https://github.com/Sp1l/LibreBSD|LibreBSD]]. You can use the files as an overlay to the /usr/src directory or apply the patch-set. The 11-stable patches are being maintained, the 10-stable patch is no longer maintained (as of 11.0-RC1). You will have to add the %%LibreSSL%% sources yourself.
  
-The following %%FreeBSD%% derivatives are known to use %%LibreSSL%% +The procedure is documented in the Github Repo so we'll not repeat that here.
-  - [[https://pcbsd.org|PC-BSD]] by default since PC-BSD 10.1.2((PC-BSD® is a user friendly desktop Operating System based on %%FreeBSD%%)) +
-  - [[https://wiki.opnsense.org/index.php/LibreSSL|OPNsense]] available since OPNsense 15.7((OPNsense is an open source, easy-to-use and easy-to-build %%FreeBSD%% based firewall and routing platform.))+
  
-===== Using LibreSSL with ports =====+==== Other sources ====
  
-To build ports against %%LibreSSL%%, add the following lines to ''%%/etc/make.conf%%''+Currently there are no binary distributions for %%LibreSSL%%-in-base but this is to change with the release of %%FreeBSD%% 11.
  
-<code> +=== FreeBSD 10 ===
-# Build ports against security/libressl +
-WITH_OPENSSL_PORT= yes +
-OPENSSL_PORT= security/libressl +
-</code>+
  
-Most ports will build without issue, some need fixing. See following paragraphs for the most notable.+There's a complete repo for [[https://github.com/attilagyorffy/freebsd/tree/10.3-libressl|10.3 from Attila Györffy]] containing a working version.
  
-If you require the latest features %%LibreSSL%% provides or wish to use the previous stable version, use the following in ''%%/etc/make.conf%%''+There's a [[https://github.com/HardenedBSD/hardenedBSD/tree/hardened/10-stable/master-libressl|HardenedBSD repo containing sources for 10-stable]] which adds a lot of additional security features.
  
-<code> +==== Upcoming FreeBSD versions ====
-WITH_OPENSSL_PORT= yes +
-# Use the latest release with frequently changing API +
-OPENSSL_PORT= security/libressl-devel +
-</code>+
  
-==== cURL ====+There's a [[https://github.com/HardenedBSD/hardenedBSD/tree/hardened/11-stable/master-libressl|HardenedBSD repo for 11-stable (11.0-RC1)]] containing %%LibreSSL%% and the additional %%HardenedBSD%% security features.
  
-After switching this will most likely hit you. +The [[https://github.com/TrueOS/freebsd/tree/drm-next-4.7|repo for the upgoming TrueOS 11 release]] which includes %%LibreSSL%% and is great for desktops and laptops.
-  * GSS-API: If you need this you must select one of the ports implementations, you cannot combine ports Open-/%%LibreSSL%% with base GSS-API +
-  * Secure Remote Password (TLS-SRP): //Must// be disabled+
  
-==== Python ====+===== LibreSSL versions =====
  
-As of python27-2.7.10 and python34-3.4.3 Python has included fixes for %%LibreSSL%%.\\  +The %%OpenBSD%% project has multiple branches of %%LibreSSL%%. This chapter describes how the upstream project and the %%FreeBSD%% ports correlate.
-Python 3.2 and 3.3 have not been fixed yet but you can find patches in [[LibreSSL#Ports|this section]]+
  
-===== Using LibreSSL with base/world =====+**Stable** corresponds to ''%%security/libressl%%''\\  
 +**Upcoming** corresponds to ''%%security/libressl-devel%%''
  
-Currently there's no solution available to create a %%FreeBSD%% installation where %%LibreSSL%% replaces the default %%OpenSSL%% libraries. [[LibreSSL/Base|Work is undergoing]] to see if this is viable.+During the release cycle of %%OpenBSD%%, there are times when there's no "Upcoming" version. At these times, the ''%%security/libressl%%'' and ''%%security/libressl-devel%%'' ports will be the same version. 
 + 
 +==== In ports ==== 
 + 
 +To stay in line with the upstream %%OpenBSD%% project, the ports tree will (as of version 2.2/2.3) contain the stable version and the next/snapshot version for early adopters. 
 + 
 +| Date | stable | devel | 
 +| 2015-11-01 | 2.2 | 2.3 | 
 +| 2016-05-01 | 2.3 | 2.4 | 
 + 
 +As %%OpenBSD%% releases their next version of %%LibreSSL%%-Portable, the libressl-devel port will link to that next-stable version and you must rebuild all your ports.
  
 ===== Known problems/quirks ===== ===== Known problems/quirks =====
Line 107: Line 105:
  
 | **Version** | **Release** | days | libssl/crypto/tls | | **Version** | **Release** | days | libssl/crypto/tls |
-| [[LibreSSL/History#LibreSSL_2.0.0|2.0.0]] | 12 Jul 2014 | 1 | 27/30/- | +|  %%LibreSSL%% 2.0 branch (%%OpenBSD%% 5.6)  |||| 
-| [[LibreSSL/History#LibreSSL_2.0.1|2.0.1]] | 13 Jul 2014 | 3 | 27/30/- | +| [[LibreSSL/History#LibreSSL_2.0.0|2.0.0]] | 2014-07-12 | 1 | 27/30/- | 
-| [[LibreSSL/History#LibreSSL_2.0.2|2.0.2]] | 16 Jul 2014 | 6 | 27/30/- | +| [[LibreSSL/History#LibreSSL_2.0.1|2.0.1]] | 2014-07-13 | 3 | 27/30/- | 
-| [[LibreSSL/History#LibreSSL_2.0.3|2.0.3]] | 22 Jul 2014 | 12 | 27/30/- | +| [[LibreSSL/History#LibreSSL_2.0.2|2.0.2]] | 2014-07-16 | 6 | 27/30/- | 
-| [[LibreSSL/History#LibreSSL_2.0.4|2.0.4]] | 03 Aug 2014 | 14 | 27/30/- | +| [[LibreSSL/History#LibreSSL_2.0.3|2.0.3]] | 2014-07-22 | 12 | 27/30/- | 
-| [[LibreSSL/History#LibreSSL_2.0.5|2.0.5]] | 17 Aug 2014 | 57 | 27/30/- | +| [[LibreSSL/History#LibreSSL_2.0.4|2.0.4]] | 2014-08-03 | 14 | 27/30/- | 
-| [[LibreSSL/History#LibreSSL_2.1.0|2.1.0]] | 13 Oct 2014 | 4 | 27/30/- | +| [[LibreSSL/History#LibreSSL_2.0.5|2.0.5]] | 2014-08-17 | 57 | 27/30/- | 
-| [[LibreSSL/History#LibreSSL_2.1.1|2.1.1]] | 17 Oct 2014 | 60 | 29/30/- | +|  %%LibreSSL%% 2.1 (%%OpenBSD%% 5.7)  |||| 
-| [[LibreSSL/History#LibreSSL_2.1.2|2.1.2]] | 16 Dec 2014 | 37 | 29/30/- | +| [[LibreSSL/History#LibreSSL_2.1.0|2.1.0]] | 2014-10-13 | 4 | 27/30/- | 
-| [[LibreSSL/History#LibreSSL_2.1.3|2.1.3]] | 22 Jan 2015 | 40 | 30/30/- | +| [[LibreSSL/History#LibreSSL_2.1.1|2.1.1]] | 2014-10-17 | 60 | 29/30/- | 
-| [[LibreSSL/History#LibreSSL_2.1.4|2.1.4]] | 04 Mar 2015 | 41 | 32/32/- | +| [[LibreSSL/History#LibreSSL_2.1.2|2.1.2]] | 2014-12-16 | 37 | 29/30/- | 
-| [[LibreSSL/History#LibreSSL_2.1.5|2.1.5]] | 17 Mar 2015 | 13 | 32/32/3 | +| [[LibreSSL/History#LibreSSL_2.1.3|2.1.3]] | 2015-01-22 | 40 | 30/30/- | 
-| [[LibreSSL/History#LibreSSL_2.1.6|2.1.6]] | 19 Mar 2015 | 2 | 32/32/3 | +| [[LibreSSL/History#LibreSSL_2.1.4|2.1.4]] | 2015-03-04 | 41 | 32/32/- | 
-| [[LibreSSL/History#LibreSSL_2.2.0|2.2.0]] | 11 Jun 2015 | 84 | 32/33/3 | +| [[LibreSSL/History#LibreSSL_2.1.5|2.1.5]] | 2015-03-17 | 13 | 32/32/3 | 
-| [[LibreSSL/History#LibreSSL_2.2.1|2.2.1]] | 08 Jul 2015 | 27 | 33/34/4 | +| [[LibreSSL/History#LibreSSL_2.1.6|2.1.6]] | 2015-03-19 | 2 | 32/32/3 | 
-| [[LibreSSL/History#LibreSSL_2.2.2|2.2.2]] | 06 Aug 2015 | 29 | 35/35/6 | +| [[LibreSSL/History#LibreSSL_2.1.7|2.1.7]] | 2015-06-11 | 84 | 32/32/3 | 
-| [[LibreSSL/History#LibreSSL_2.2.3|2.2.3]] | 29 Aug 2015 | 23 | 35/35/6 | +| [[LibreSSL/History#LibreSSL_2.1.8|2.1.8]] | 2015-10-15 | 126 | 32/32/3 | 
-| [[LibreSSL/History#LibreSSL_2.2.4|2.2.4]] | 29 Aug 2015 | 23 | 35/35/6 | +| [[LibreSSL/History#LibreSSL_2.1.9|2.1.9]] | 2015-12-08 | 54 | 32/32/3 | 
-| [[LibreSSL/History#LibreSSL_2.3.0|2.3.0]] | 23 Sep 2015 | 29 | 36/37/9 | +|  %%LibreSSL%% 2.2 (%%OpenBSD%% 5.8)  |||| 
-| [[LibreSSL/History#LibreSSL_2.3.1|2.3.1]] | 23 Sep 2015 | 29 | 36/37/9 |+| [[LibreSSL/History#LibreSSL_2.2.0|2.2.0]] | 2015-06-11 | 84 | 32/33/3 | 
 +| [[LibreSSL/History#LibreSSL_2.2.1|2.2.1]] | 2015-07-08 | 27 | 33/34/4 | 
 +| [[LibreSSL/History#LibreSSL_2.2.2|2.2.2]] | 2015-08-06 | 29 | 35/35/6 | 
 +| [[LibreSSL/History#LibreSSL_2.2.3|2.2.3]] | 2015-08-29 | 23 | 35/35/6 | 
 +| [[LibreSSL/History#LibreSSL_2.2.4|2.2.4]] | 2015-10-15 | 47 | 35/35/6 | 
 +| [[LibreSSL/History#LibreSSL_2.2.5|2.2.5]] | 2015-12-08 | 54 | 35/35/6 | 
 +| [[LibreSSL/History#LibreSSL_2.2.6|2.2.6]] | 2016-01-28 | 86 | 35/35/6 | 
 +| [[LibreSSL/History#LibreSSL_2.2.7|2.2.7]] | 2016-05-03 | 96 | 35/35/6 | 
 +| [[LibreSSL/History#LibreSSL_2.2.8|2.2.8]] | 2016-05-31 | 28 | 35/35/6 | 
 +| [[LibreSSL/History#LibreSSL_2.2.9|2.2.9]] | 2016-06-09 | 9 | 35/35/6 | 
 +|  %%LibreSSL%% 2.3 (%%OpenBSD%% 5.9)  |||| 
 +| [[LibreSSL/History#LibreSSL_2.3.0|2.3.0]] | 2015-09-23 | 29 | 36/37/9 | 
 +| [[LibreSSL/History#LibreSSL_2.3.1|2.3.1]] | 2015-11-03 | 41 | 36/37/9 | 
 +| [[LibreSSL/History#LibreSSL_2.3.2|2.3.2]] | 2016-01-28 | 86 | 37/38/10 | 
 +| [[LibreSSL/History#LibreSSL_2.3.3|2.3.3]] | 2016-03-23 | 55 | 37/38/10 | 
 +| [[LibreSSL/History#LibreSSL_2.3.4|2.3.4]] | 2016-05-03 | 41 | 37/38/10 | 
 +| [[LibreSSL/History#LibreSSL_2.3.5|2.3.5]] | 2016-05-31 | 28 | 37/38/10 | 
 +| [[LibreSSL/History#LibreSSL_2.3.6|2.3.6]] | 2016-06-09 | 9 | 37/38/10 | 
 +| [[LibreSSL/History#LibreSSL_2.3.7|2.3.7]] | 2016-08-01 | 53 | 37/38/10 | 
 +| [[LibreSSL/History#LibreSSL_2.3.8|2.3.8]] | 2016-09-27 | 57 | 37/38/10 | 
 +| [[LibreSSL/History#LibreSSL_2.3.9|2.3.9]] | 2016-11-06 | 40 | 37/38/10 | 
 +| [[LibreSSL/History#LibreSSL_2.3.10|2.3.10]] | 2017-02-01 | 87 | 37/38/10 | 
 +|  %%LibreSSL%% 2.4 (%%OpenBSD%% 6.0)  |||| 
 +| [[LibreSSL/History#LibreSSL_2.4.0|2.4.0]] | 2016-05-31 | 28 | 38/39/11 | 
 +| [[LibreSSL/History#LibreSSL_2.4.1|2.4.1]] | 2016-06-09 | 9 | 38/39/11 | 
 +| [[LibreSSL/History#LibreSSL_2.4.2|2.4.2]] | 2016-08-01 | 53 | 38/39/11 | 
 +| [[LibreSSL/History#LibreSSL_2.4.3|2.4.3]] | 2016-09-27 | 57 | 38/39/11 | 
 +| [[LibreSSL/History#LibreSSL_2.4.4|2.4.4]] | 2016-11-06 | 40 | 38/39/11 | 
 +| [[LibreSSL/History#LibreSSL_2.4.5|2.4.5]] | 2017-02-01 | 87 | 38/39/11 | 
 +|  %%LibreSSL%% 2.5 (%%OpenBSD%% 6.1)  |||| 
 +| [[LibreSSL/History#LibreSSL_2.5.0|2.5.0]] | 2016-09-27 | 57 | 38/39/11 | 
 +| [[LibreSSL/History#LibreSSL_2.5.1|2.5.1]] | 2017-02-01 | 127 | 41/43/15 | 
 +| [[LibreSSL/History#LibreSSL_2.5.2|2.5.2]] | 2017-03-26 | 53 | 41/43/15 | 
 +| [[LibreSSL/History#LibreSSL_2.5.3|2.5.3]] | 2017-04-11 | 16 | 41/43/15 | 
 +| [[LibreSSL/History#LibreSSL_2.5.4|2.5.4]] | 2017-05-01 | 20 | 41/43/15 | 
 +| [[LibreSSL/History#LibreSSL_2.5.5|2.5.5]] | 2017-07-12 | 72 | 41/43/15 | 
 +|  %%LibreSSL%% 2.6 (%%OpenBSD%% 6.2)  |||| 
 +| [[LibreSSL/History#LibreSSL_2.6.0|2.6.0]] | 2017-07-12 | 72 | 41/43/15 | 
 +| [[LibreSSL/History#LibreSSL_2.6.1|2.6.1]] | 2017-09-06 | 56 | 42/44/16 | 
 +| [[LibreSSL/History#LibreSSL_2.6.2|2.6.2]] | 2017-09-26 | 20 | 42/44/16 | 
 +| [[LibreSSL/History#LibreSSL_2.6.3|2.6.3]] | 2017-11-06 | 41 | 42/44/16 | 
 +| [[LibreSSL/History#LibreSSL_2.6.4|2.6.4]] | 2017-12-19 | 43 | 42/44/16 | 
 +| [[LibreSSL/History#LibreSSL_2.6.5|2.6.5]] | 2018-06-13 | 176 | 42/44/16 | 
 +|  %%LibreSSL%% 2.7 (%%OpenBSD%% 6.3)  |||| 
 +| [[LibreSSL/History#LibreSSL_2.7.0|2.7.0]] | 2018-03-21 | 92 | 43/45/17 | 
 +| [[LibreSSL/History#LibreSSL_2.7.1|2.7.1]] | 2018-03-23 | 2 | 43/45/17 | 
 +| [[LibreSSL/History#LibreSSL_2.7.2|2.7.2]] | 2018-04-01 | 9 | 43/45/17 | 
 +| [[LibreSSL/History#LibreSSL_2.7.3|2.7.3]] | 2018-05-05 | 34 | 43/45/17 | 
 +| [[LibreSSL/History#LibreSSL_2.7.4|2.7.4]] | 2018-06-13 | 39 | 43/45/17 | 
 +|  %%LibreSSL%% 2.8 (%%OpenBSD%% 6.4)  |||| 
 +| [[LibreSSL/History#LibreSSL_2.8.0|2.8.0]] | 2018-08-06 | 54 | 43/45/17 | 
 +| [[LibreSSL/History#LibreSSL_2.8.1|2.8.1]] | 2018-09-25 | 50 | 44/46/18 |
  
 The detailed version history was moved to the [[LibreSSL/History|LibreSSL history sub-page]] The detailed version history was moved to the [[LibreSSL/History|LibreSSL history sub-page]]
Line 132: Line 181:
 ====== Ports ====== ====== Ports ======
  
-Detailed information on specific ports can now be found in the [[LibreSSL/Ports|sub-page]]+Detailed information on specific ports can now be found in the [[LibreSSL/Ports|sub-page]].\\  
 +Fixes for specific versions can be found in separate pages 
 + 
 +  * [[LibreSSL/Ports#PC-BSD_10.1.2_ports_build|LibreSSL 2.1]] Initial import 
 +  * %%LibreSSL%% 2.2 SSLv3 disabled 
 +  * [[LibreSSL/Ports#SSLv3_.2F_SHA-0_removal|LibreSSL 2.3]] SSLv3 removed 
 +  * [[LibreSSL/2.5|LibreSSL 2.5]] (opaque structures) 
 +  * [[LibreSSL/2.6|LibreSSL 2.6]] (more opaque structures) 
 +  * [[LibreSSL/2.7|LibreSSL 2.7]] (%%OpenSSL%% 1.1 API) 
 +  * ... 
 +  * [[LibreSSL/3.5|LibreSSL 3.5]] (more %%OpenSSL%% 1.1 API and opaque structures)
  
 The first build of all ports with %%LibreSSL%% for [[https://pcbsd.org|PC-BSD]] revealed 81 ports which require patching to work properly. The first build of all ports with %%LibreSSL%% for [[https://pcbsd.org|PC-BSD]] revealed 81 ports which require patching to work properly.
Line 144: Line 203:
 ^ Problem ^ Description ^ Count ^  PRs  ^^ Unsolved ^ ^ Problem ^ Description ^ Count ^  PRs  ^^ Unsolved ^
 | ::: | ::: | ::: | Open | Closed | ::: | | ::: | ::: | ::: | Open | Closed | ::: |
-| **[[LibreSSL/PatchingPorts#EGD|EGD]]** | uses RAND_egd methods that no longer exist in %%LibreSSL%% |  32 |  12 |  16 |  0 | +| **[[LibreSSL/PatchingPorts#EGD|EGD]]** | uses RAND_egd methods that no longer exist in %%LibreSSL%% |  38 |  12 |  16 |  0 | 
-| **[[LibreSSL/PatchingPorts#Deprecated_des_ methods|DES]]** | Uses deprecated des_ methods (replaced by DES_ methods) |  19 |  4 |  15 |  0 | +| **[[LibreSSL/PatchingPorts#Deprecated_des_ methods|DES]]** | Uses deprecated des_ methods (replaced by DES_ methods) |  29 |  4 |  15 |  0 | 
-| **[[LibreSSL/PatchingPorts#SSLv2.2FSSLv3_method_failures|SSLv2]]** | Uses SSLv2 methods that no longer exist in %%LibreSSL%% |  5 |  2 |  3 |  0 |+| **[[LibreSSL/PatchingPorts#SSLv2.2FSSLv3_method_failures|SSLv2]]** | Uses SSLv2 methods that no longer exist in %%LibreSSL%% |  7 |  2 |  3 |  0 |
 | **[[LibreSSL/PatchingPorts#Uses_removed_Compression|COMP]]** | Wants SSL compression |  10 |  7 |  4 |  1 | | **[[LibreSSL/PatchingPorts#Uses_removed_Compression|COMP]]** | Wants SSL compression |  10 |  7 |  4 |  1 |
-| **arc4rand** | conflict in %%FreeBSD%%/%%LibreSSL%% libs |  3 |  0 |  0 |  3 | +| **arc4rand** | conflict in %%FreeBSD%%/%%LibreSSL%% libs |  4 |  0 |  0 |  4 | 
-| **CMS** | Uses deprecated S/MIME methods |  2 |  0 |  2 |  0 | +| **CMS** | Uses deprecated S/MIME methods |  3 |  0 |  3 |  0 | 
-| **[[LibreSSL/PatchingPorts#GOST_engine|GOST]]** | Uses removed GOST methods |  2 |  0 |  2 |  0 | +| **[[LibreSSL/PatchingPorts#GOST_engine|GOST]]** | Uses removed GOST methods |  2 |  0 |  0 |  2 | 
-| **PSK** | Uses PSK methods |  3 |  1 |  0 |  2 | +| **PSK** | Uses PSK methods |  4 |  1 |  0 |  2 | 
-| **[[LibreSSL/PatchingPorts#SSLv2.2FSSLv3_method_failures|SSLv3]]** | Uses SSLv3 methods that no longer exist in %%LibreSSL%% 2.3 |  73 |  10 |  0 |  5 | +| **[[LibreSSL/PatchingPorts#SSLv2.2FSSLv3_method_failures|SSLv3]]** | Uses SSLv3 methods that no longer exist in %%LibreSSL%% 2.3 |  85 |  10 |  0 |  5 | 
-| **[[LibreSSL/PatchingPorts#SHA-0|SHA-0]]** | Uses SHA-0 methods |  7 |  0 |  0 |  4 | +| **[[LibreSSL/PatchingPorts#SHA-0|SHA-0]]** | Uses SHA-0 methods |  8 |  0 |  0 |  4 | 
-| **Other** | Other issues |  34 |  2 |  13 |  8 | +| **Other** | Other issues |  25 |  2 |  13 |  8 | 
-| **TOTAL** ||  186 |  30 |  51 |  33 |+| **TOTAL** ||  204 |  30 |  51 |  33 |
  
 The net-p2p/bitcoin and other virtual currency applications will/can not be fixed, they require bug-compatible %%OpenSSL%% libaries. The net-p2p/bitcoin and other virtual currency applications will/can not be fixed, they require bug-compatible %%OpenSSL%% libaries.
Line 168: Line 227:
  
 ^  Severity  ^  %%LibreSSL%%  ^  %%OpenSSL%%  ^ ^  Severity  ^  %%LibreSSL%%  ^  %%OpenSSL%%  ^
 +| Critical<sup>+</sup> |   |   |
 | High |  0 |  5 | | High |  0 |  5 |
-| Medium<sup>*</sup> |  15 |  28 | +| Medium<sup>*</sup> |  16 |  31 | 
-| Low |  7 |  10 |+| Low |  7 |  12 |
 | Total |  19 |  36 | | Total |  19 |  36 |
  
-<sup>*</sup> NVD Medium + %%OpenSSL%% Moderate+<sup>*</sup> NVD Medium + %%OpenSSL%% Moderate\\  
 +<sup>+</sup> %%OpenSSL%% added Critical level in [[https://www.openssl.org/policies/secpolicy.html|revised severity rating]] 2015-09-28
  
-==== 13 July 2014 ==== +The list of vulnerabilities of %%OpenSSL%% and %%LibreSSL%% is kept up-to-date in the 
-%%LibreSSL%% PRNG [[https://www.agwa.name/blog/post/libressls_prng_is_unsafe_on_linux|found to be unsafe]]. %%LibreSSL%% refers to this as the 'Linux forking and PID wrap issue'. +[[https://en.wikipedia.org/wiki/LibreSSL#Security_and_vulnerabilities|Wikipedia LibreSSL article]]
- +
-This was [[http://marc.info/?l=openbsd-tech&m=140548206911600&w=2|fixed in 2.0.2]] +
- +
-^  CVE reference  ^  Description  ^  Severity  ^  Comment  ^ +
-|  | Linux forking and PID wrap issue | low | Fixed in 2.0.2 | +
- +
-No official rating, rated low for the counts above +
- +
-==== 06 August 2014 ==== +
-%%OpenSSL%% [[https://www.openssl.org/news/secadv_20140806.txt|published 9 vulnerabilities]] +
- +
-^  CVE reference  ^  Description  ^  Severity  ^  Comment  ^ +
-| CVE-2014-3510 | Flaw handling DTLS anonymous EC(DH) ciphersuites | medium |  | +
-| CVE-2014-3508 | Information leak in pretty printing functions | medium | partially vulnerable | +
-| CVE-2014-3509 | Race condition in ssl_parse_serverhello_tlsext | medium |  | +
-| CVE-2014-3505 | Double Free when processing DTLS packets | medium |  | +
-| CVE-2014-3506 | DTLS memory exhaustion | medium |  | +
-| CVE-2014-3507 | DTLS memory leak from zero-length fragments | medium |  | +
-| CVE-2014-3511 | %%OpenSSL%% TLS protocol downgrade attack | medium |  | +
-| <del>CVE-2014-5139</del> | Crash with SRP ciphersuite in Server Hello message | medium | Not vulnerable | +
-| <del>CVE-2014-3512</del> | SRP buffer overrun | high | Not vulnerable | +
- +
-==== 15 October 2014 ==== +
-%%OpenSSL%% responds to the **POODLE** attack and [[https://www.openssl.org/news/secadv_20141015.txt|published 4 vulerabilities]] +
- +
-**NB:** As of this advisory, %%OpenSSL%% includes severity ratings to vulnerabilities +
- +
-^  CVE reference  ^  Description  ^  Severity  ^  Comment  ^ +
-|  | SSL 3.0 Fallback protection | medium | %%LibreSSL%% [[http://marc.info/?l=openbsd-cvs&m=141339479327258&w=2|disabled SSLv3]]\\ Adds TLS_SCSV_FALLBACK in 2.1.4 | +
-| CVE-2014-3568 | Build option no-ssl3 is incomplete | low |  | +
-| <del>CVE-2014-3513</del> | SRTP Memory Leak | high | Not vulnerable | +
-| <del>CVE-2014-3567</del> | Session Ticket Memory Leak | medium | Not vulnerable | +
- +
-==== 08 January 2015 ==== +
-%%OpenSSL%% [[https://www.openssl.org/news/secadv_20150108.txt|published 8 vulerabilities]] +
- +
-^  CVE reference  ^  Description  ^  Severity  ^  Comment  ^ +
-| CVE-2014-8275 | Certificate fingerprints can be modified | low | Fixed in 2.1.4 | +
-| CVE-2014-3572 | ECDHE silently downgrades to ECDH [Client] | low | Fixed in 2.1.4 | +
-| CVE-2014-3570 | Bignum squaring may produce incorrect results | low | Fixed in 2.1.4 | +
-| CVE-2015-0205 | DH client certificates accepted without verification [Server] | low | Fixed in 2.1.4 | +
-| <del>CVE-2015-0206</del> | DTLS memory leak in dtls1_buffer_record | moderate | Fixed in earlier release | +
-| <del>CVE-2014-3571</del> | DTLS segmentation fault in dtls1_get_record | moderate | Not vulnerable | +
-| <del>CVE-2014-3569</del> | no-ssl3 configuration sets method to NULL | low | Not vulnerable | +
-| <del>CVE-2015-0204</del> | RSA silently downgrades to EXPORT_RSA [Client] | low | Not vulnerable | +
- +
-==== 19 March 2015 ==== +
-%%OpenSSL%% [[https://www.openssl.org/news/secadv_20150319.txt|published 14 vulnerabilities]] and [[https://twitter.com/bob_beck/status/578560373961297920|LibreSSL]] confirmed that it has 5 of these vulnerabilities as well, notably not CVE-2015-0297 which has the highest possible impact rating for %%OpenSSL%%. +
- +
-^ CVE reference ^ Description ^ Severity ^ Comment ^ +
-| CVE-2015-0286 | Segmentation fault in ASN1_TYPE_cmp | moderate |  | +
-| CVE-2015-0287 | ASN.1 structure reuse memory corruption | moderate |  | +
-| CVE-2015-0288 | X509_to_X509_REQ NULL pointer deref | moderate |  | +
-| CVE-2015-0289 | PKCS7 NULL pointer dereferences | moderate |  | +
-| <del>CVE-2015-0209</del> | Use After Free following d2i_ECPrivatekey error | low | Not vulnerable, fix merged | +
-| <del>CVE-2015-0291</del> | ClientHello sigalgs %%DoS%% | high | Affected code is not present | +
-| <del>CVE-2015-0204</del> | RSA silently downgrades to EXPORT_RSA [Client] | high | Fixed in %%LibreSSL%% 2.1.2 | +
-| <del>CVE-2015-0207</del> | Segmentation fault in DTLSv1_listen | moderate | Not vulnerable | +
-| <del>CVE-2015-0208</del> | Segmentation fault for invalid PSS parameters | moderate | Affected code is not present | +
-| <del>CVE-2015-0290</del> | Multiblock corrupted pointer | moderate | Affected code is not present | +
-| <del>CVE-2015-0292</del> | Base64 decode | moderate | Fixed in %%LibreSSL%% 2.0.0 | +
-| <del>CVE-2015-0293</del> | %%DoS%% via reachable assert in SSLv2 servers | moderate | Affected code is not present | +
-| <del>CVE-2015-0285</del> | Handshake with unseeded PRNG | low | Cannot happen by the design of the %%LibreSSL%% PRNG | +
-| <del>CVE-2015-1787</del> | Empty CKE with client auth and DHE | moderate | Fixed in %%LibreSSL%% 2.0.1 | +
- +
-Links +
-  * [[https://twitter.com/iamamoose/status/577917438689443840|OpenSSL confirmed these]] +
-  * %%LibreSSL%% is said to be not vulnerable to the high rated vulnerability CVE-2015-0208 that will be published 2015/03/19 [[https://twitter.com/geeknik/status/577979794945507328|by the author]] of the high rated vulnerability.\\  +
- +
-==== 11 June 2015 ==== +
-%%OpenSSL%% [[https://www.openssl.org/news/secadv_20150611.txt|publishes 7 vulnerabilities]]. %%LibreSSL%% confirms that [[http://marc.info/?l=openbsd-announce&m=143404058913441|3 of these vulnerabilities apply to LibreSSL]] as well and one is still under review. +
- +
-^ CVE reference ^ Description ^ Severity ^ Comment ^ +
-| CVE-2015-4000 | DHE man-in-the-middle protection (Logjam) | medium | Not vulnerable | +
-| CVE-2015-1788 | Malformed ECParameters causes infinite loop | medium | Fixed in 2.1.7/2.2.0 | +
-| CVE-2015-1789 | Exploitable out-of-bounds read in X509_cmp_time | medium | Fixed in 2.1.7/2.2.0 | +
-| CVE-2015-1790 | PKCS7 crash with missing EnvelopedContent | medium | Not vulnerable | +
-| CVE-2015-1792 | CMS verify infinite loop with unknown hash function | medium | Fixed in 2.1.7/2.2.0 | +
-| CVE-2015-1791 | Race condition handling NewSessionTicket | low | In review | +
-| CVE-2014-8176 | Invalid free in DTLS | medium | Not vulnerable | +
- +
-==== 09 July 2015 ==== +
-%%OpenSSL%% [[https://www.openssl.org/news/secadv_20150709.txt|publishes]] a single vulnerability in the most recent versions of 1.0.1 and 1.0.2. [[https://twitter.com/bob_beck/status/619227680085549057|Bob Beck announces]] that this vulnerability does not apply to %%LibreSSL%%. +
- +
-^ CVE reference ^ Description ^ Severity ^ Comment ^ +
-| CVE-2015-1793 | Alternative chains certificate forgery | high | Not vulnerable | +
- +
-==== 15 October 2015 ==== +
-Qualys discovered a memory leak and a buffer overflow in %%LibreSSL%% when reviewing %%OpenSMTPD%%. [[http://www.openwall.com/lists/oss-security/2015/10/16/1|Qualys Security Advisory]] +
- +
-^ CVE reference ^ Description ^ Severity ^ Comment ^ +
-| CVE-2015-5333 | Memory leak in OBJ_obj2txt |  | +
-| CVE-2015-5334 | Buffer overflow in OBJ_obj2txt |  |+
  
 ====== Links ====== ====== Links ======
Line 278: Line 246:
   * [[http://www.openbsd.org/papers/eurobsdcon2014-libressl.html|LibreSSL: More Than 30 Days Later]] (%%EuroBSDCon%% Paper)   * [[http://www.openbsd.org/papers/eurobsdcon2014-libressl.html|LibreSSL: More Than 30 Days Later]] (%%EuroBSDCon%% Paper)
   * [[http://www.openbsd.org/papers/eurobsdcon2014_arc4random/index.html|EuroBSDCon 2014 presentation]] arc4random: 1996 to present   * [[http://www.openbsd.org/papers/eurobsdcon2014_arc4random/index.html|EuroBSDCon 2014 presentation]] arc4random: 1996 to present
 +
 +----
 +
 +{{tag>Project}}
  
  • libressl.1449313873.txt.gz
  • Last modified: 2015/12/05 11:11
  • by BernardSpil