openbsd 7.9 · errata 024
Fix a variety of bugs in libressl:
- Remove RelativeDistinguishedName support for CRL distribution points
- Ensure verify callbacks always returning 1 can see a hostname mismatch
- Correct botched size check in dtls1_preprocess_fragment()
- Limit size of buffered DTLS handshake messages
- Avoid potential overread on interrupted retransmission in DTLS
- Fix OCSP responder authorization bypass in libtls and ocspcheck(8)
installera
# syspatch
källpatch
signify -Vep /etc/signify/openbsd-79-base.pub -x 024_libressl.patch.sig \
-m - | (cd /usr/src && patch -p0)
And then rebuild and install libcrypto, libssl, libtls, and ocspcheck:
cd /usr/src/lib/libcrypto
make obj
make
make install
cd /usr/src/lib/libssl
make obj
make
make install
cd /usr/src/lib/libtls
make obj
make
make install
cd /usr/src/usr.sbin/ocspcheck
make obj
make
make install