mirror of
https://github.com/openwrt/packages.git
synced 2025-08-09 05:11:46 +00:00
04d25b2bc1
This is a bugfix release containing several security fixes. Security fixes -------------- - CVE-2024-4877: Windows: harden interactive service pipe. Security scope: a malicious process with "some" elevated privileges could open the pipe a second time, tricking openvn GUI into providing user credentials (tokens), getting full access to the account openvpn-gui.exe runs as. - CVE-2024-5594: control channel: refuse control channel messages with nonprintable characters in them. Security scope: a malicious openvpn peer can send garbage to openvpn log, or cause high CPU load. - CVE-2024-28882: only call schedule_exit() once (on a given peer). Security scope: an authenticated client can make the server "keep the session" even when the server has been told to disconnect this client Bug fixes --------- - fix connect timeout when using SOCKS proxies - work around LibreSSL crashing on OpenBSD 7.5 when enumerating ciphers - Add bracket in fingerprint message and do not warn about missing verification For details refer to https://github.com/OpenVPN/openvpn/blob/v2.6.11/Changes.rst Signed-off-by: Ivan Pavlov <AuthorReflex@gmail.com>
21 lines
866 B
Diff
21 lines
866 B
Diff
--- a/src/openvpn/crypto_openssl.c
|
|
+++ b/src/openvpn/crypto_openssl.c
|
|
@@ -49,7 +49,7 @@
|
|
#include <openssl/rand.h>
|
|
#include <openssl/ssl.h>
|
|
|
|
-#if (OPENSSL_VERSION_NUMBER >= 0x10100000L) && !defined(LIBRESSL_VERSION_NUMBER)
|
|
+#if (OPENSSL_VERSION_NUMBER >= 0x10100000L) && !defined(ENABLE_CRYPTO_WOLFSSL) && !defined(LIBRESSL_VERSION_NUMBER)
|
|
#include <openssl/kdf.h>
|
|
#endif
|
|
#if OPENSSL_VERSION_NUMBER >= 0x30000000L
|
|
@@ -1398,7 +1398,7 @@ memcmp_constant_time(const void *a, cons
|
|
return CRYPTO_memcmp(a, b, size);
|
|
}
|
|
|
|
-#if (OPENSSL_VERSION_NUMBER >= 0x10100000L) && !defined(LIBRESSL_VERSION_NUMBER)
|
|
+#if (OPENSSL_VERSION_NUMBER >= 0x10100000L) && !defined(ENABLE_CRYPTO_WOLFSSL) && !defined(LIBRESSL_VERSION_NUMBER)
|
|
bool
|
|
ssl_tls1_PRF(const uint8_t *seed, int seed_len, const uint8_t *secret,
|
|
int secret_len, uint8_t *output, int output_len)
|