From bf2d5380808bb3e0ad470e7853e3ae20617bbfd6 Mon Sep 17 00:00:00 2001 From: Yue Tao Date: Mon, 19 May 2014 15:00:38 +0800 Subject: openssl: fix for CVE-2010-5298 Race condition in the ssl3_read_bytes function in s3_pkt.c in OpenSSL through 1.0.1g, when SSL_MODE_RELEASE_BUFFERS is enabled, allows remote attackers to inject data across sessions or cause a denial of service (use-after-free and parsing error) via an SSL connection in a multithreaded environment. http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2010-5298 (From OE-Core master rev: 751f81ed8dc488c500837aeb3eb41ebf3237e10b) Signed-off-by: Yue Tao Signed-off-by: Roy Li Signed-off-by: Saul Wold Signed-off-by: Richard Purdie Signed-off-by: Paul Eggleton --- meta/recipes-connectivity/openssl/openssl_1.0.1e.bb | 1 + 1 file changed, 1 insertion(+) (limited to 'meta/recipes-connectivity/openssl/openssl_1.0.1e.bb') diff --git a/meta/recipes-connectivity/openssl/openssl_1.0.1e.bb b/meta/recipes-connectivity/openssl/openssl_1.0.1e.bb index 279a4fb385..d2a11a00cc 100644 --- a/meta/recipes-connectivity/openssl/openssl_1.0.1e.bb +++ b/meta/recipes-connectivity/openssl/openssl_1.0.1e.bb @@ -41,6 +41,7 @@ SRC_URI += "file://configure-targets.patch \ file://openssl-1.0.1e-cve-2014-0221.patch \ file://openssl-1.0.1e-cve-2014-0224.patch \ file://openssl-1.0.1e-cve-2014-3470.patch \ + file://openssl-CVE-2010-5298.patch \ " SRC_URI[md5sum] = "66bf6f10f060d561929de96f9dfe5b8c" -- cgit 1.2.3-korg