[Pkg-openssl-devel] openssl wheezy update

[Kurt Roeckx]

On Tue, Jan 31, 2017 at 11:13:55PM +0100, Emilio Pozuelo Monfort wrote:
> Hi Kurt,
> 
> I have prepared an update of openssl for wheezy based on 1.0.1t-1+deb8u6. I have
> done some smoke testing on it and it seems fine, but I haven't been able to
> verify the three fixes as I can't find exploits for them (there is mention of
> one for CVE-2016-8610 in [1] but I can't find the actual file).
> 
> Do you have any suggestion for how to verify / test the update?
> 
> Do you want to upload this or should I take care of it?

Feel free to upload this.

The usptream version in jessie and wheezy, so the patches should
just apply.

I only have a test for the 32 bit crashes. It would require to get
the fuzzers working in the 1.0.1 version, which should be that
hard.

The other would be a cache timing attack, and I really have no
good way to test that.

I suggest you just upload it.


Kurt