<div dir="ltr"><div class="gmail_extra"><br><div class="gmail_quote">On 9 December 2015 at 02:03, Fan Xin <span dir="ltr"><<a href="mailto:fan.xin@jp.fujitsu.com" target="_blank">fan.xin@jp.fujitsu.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><div id=":2x2" class="" style="overflow:hidden">+++ b/meta/recipes-connectivity/openssl/openssl/Fix-seg-fault-with-0-p-val-in-SKE.patch<br>
@@ -0,0 +1,101 @@<br>
+Upstream-Status: Backport<br>
+<br>
+From ada57746b6b80beae73111fe1291bf8dd89af91c Mon Sep 17 00:00:00 2001<br>
+From: Guy Leaver (guleaver) <<a href="mailto:guleaver@cisco.com">guleaver@cisco.com</a>><br>
+Date: Fri, 7 Aug 2015 15:45:21 +0100<br>
+Subject: [PATCH] Fix seg fault with 0 p val in SKE<br>
+<br>
+If a client receives a ServerKeyExchange for an anon DH ciphersuite with the<br>
+value of p set to 0 then a seg fault can occur. This commits adds a test to<br>
+reject p, g and pub key parameters that have a 0 value (in accordance with<br>
+RFC 5246)<br>
+<br>
+The security vulnerability only affects master and 1.0.2, but the fix is<br>
+additionally applied to 1.0.1 for additional confidence.<br>
+<br>
+CVE-2015-1794<br>
+<br>
+Reviewed-by: Richard Levitte <<a href="mailto:levitte@openssl.org">levitte@openssl.org</a>><br>
+Reviewed-by: Matt Caswell <<a href="mailto:matt@openssl.org">matt@openssl.org</a>></div></blockquote></div><br>This patch needs to have your (or whoever actually did the work) signed-off-by inside the patch, alongside the Upstream-Status.</div><div class="gmail_extra"><br></div><div class="gmail_extra">Thanks,</div><div class="gmail_extra">Ross</div></div>