[pkgsrc/pkgsrc-2019Q4]: pkgsrc/security/mbedtls Pullup ticket #6140 - request...

[bsiegert <bsiegert%pkgsrc.org@localhost>]

details:   https://anonhg.NetBSD.org/pkgsrc/rev/8dd976585e06
branches:  pkgsrc-2019Q4
changeset: 412485:8dd976585e06
user:      bsiegert <bsiegert%pkgsrc.org@localhost>
date:      Sun Mar 08 09:49:18 2020 +0000

description:
Pullup ticket #6140 - requested by nia
security/mbedtls: security fix

Revisions pulled up:
- security/mbedtls/Makefile                                     1.12
- security/mbedtls/PLIST                                        1.6
- security/mbedtls/distinfo                                     1.8

---
   Module Name:    pkgsrc
   Committed By:   nia
   Date:           Sat Feb 29 11:45:02 UTC 2020

   Modified Files:
           pkgsrc/security/mbedtls: Makefile PLIST distinfo

   Log Message:
   mbedtls: Update to 2.16.5

   = mbed TLS 2.16.5 branch released 2020-02-20

   Security
      * Fix potential memory overread when performing an ECDSA signature
        operation. The overread only happens with cryptographically low
        probability (of the order of 2^-n where n is the bitsize of the curve)
        unless the RNG is broken, and could result in information disclosure or
        denial of service (application crash or extra resource consumption).
        Found by Auke Zeilstra and Peter Schwabe, using static analysis.
      * To avoid a side channel vulnerability when parsing an RSA private key,
        read all the CRT parameters from the DER structure rather than
        reconstructing them. Found by Alejandro Cabrera Aldaya and Billy Bob
        Brumley. Reported and fix contributed by Jack Lloyd.
        ARMmbed/mbed-crypto#352

   Bugfix
      * Fix an unchecked call to mbedtls_md() in the x509write module.
      * Fix a bug in mbedtls_pk_parse_key() that would cause it to accept some
        RSA keys that would later be rejected by functions expecting private
        keys. Found by Catena cyber using oss-fuzz (issue 20467).
      * Fix a bug in mbedtls_pk_parse_key() that would cause it to accept some
        RSA keys with invalid values by silently fixing those values.

diffstat:

 security/mbedtls/Makefile |   4 ++--
 security/mbedtls/distinfo |  10 +++++-----
 2 files changed, 7 insertions(+), 7 deletions(-)

diffs (28 lines):

diff -r a8d081cc9b69 -r 8dd976585e06 security/mbedtls/Makefile
--- a/security/mbedtls/Makefile Sun Feb 23 18:33:03 2020 +0000
+++ b/security/mbedtls/Makefile Sun Mar 08 09:49:18 2020 +0000
@@ -1,6 +1,6 @@
-# $NetBSD: Makefile,v 1.9 2019/10/01 17:44:11 nia Exp $
+# $NetBSD: Makefile,v 1.9.4.1 2020/03/08 09:49:18 bsiegert Exp $
 
-DISTNAME=      mbedtls-2.16.3-apache
+DISTNAME=      mbedtls-2.16.5-apache
 PKGNAME=       ${DISTNAME:-apache=}
 CATEGORIES=    security devel
 MASTER_SITES=  https://tls.mbed.org/download/
diff -r a8d081cc9b69 -r 8dd976585e06 security/mbedtls/distinfo
--- a/security/mbedtls/distinfo Sun Feb 23 18:33:03 2020 +0000
+++ b/security/mbedtls/distinfo Sun Mar 08 09:49:18 2020 +0000
@@ -1,7 +1,7 @@
-$NetBSD: distinfo,v 1.6 2019/10/01 17:44:11 nia Exp $
+$NetBSD: distinfo,v 1.6.4.1 2020/03/08 09:49:18 bsiegert Exp $
 
-SHA1 (mbedtls-2.16.3-apache.tgz) = dce8550f8f9465f3aea44cb7d0f9d0ba8140034a
-RMD160 (mbedtls-2.16.3-apache.tgz) = 611635dce5ac99372272dd5c6edcb64d886f6e3b
-SHA512 (mbedtls-2.16.3-apache.tgz) = 62b984d04570334e740ff8b857b4dad73804a4d0aec22b224cb813eb8a6a4b2ec9bff3126c198552e030da94201fd98ed764e8b9f53056e2f94a51dfdbb47cdd
-Size (mbedtls-2.16.3-apache.tgz) = 2553709 bytes
+SHA1 (mbedtls-2.16.5-apache.tgz) = c36962183e05467aa1dadafcaacf90216a737866
+RMD160 (mbedtls-2.16.5-apache.tgz) = 92e0ffc42f519518472048109c0caa138a7ebe81
+SHA512 (mbedtls-2.16.5-apache.tgz) = 89a6a2cc6fe8b568396caed5fe8428ff5debf833c643b0e4c3144fdc474b127d156d8f5e5ea47a8b5d6522a2689e91a57abc533390b3f54aaa2c756ef6d3baf7
+Size (mbedtls-2.16.5-apache.tgz) = 2695416 bytes
 SHA1 (patch-library_net__sockets.c) = cd8f9cf84947800eb73d004847789626511ceb35