mirror/openvpn
0
0
Fork 0
mirror of https://github.com/OpenVPN/openvpn.git synced 2024-09-20 12:02:28 +02:00
Code
ccee09d147
openvpn/contrib
History
Lev Stipakov 84d5079b0f contrib/vcpkg-ports: add openssl port with --no-autoload-config option set (CVE-2121-3606) 
In default configuration OpenSSL loads config from
certain location on disk, for example

  c:\vcpkg\packages\openssl_x64-windows\openvpn.cnf

which may pose a security risk.

There is "no-autoload-config" config option for OpenSSL
which disables this functionality:

https://github.com/openssl/openssl/pull/5959

however it is not "exported" to vcpkg.

This adds openssl port overlay which sets "no-autoload-config"
config option. Here is the diff (indented with "!" to avoid
confusing "git am"):

! diff --git a/ports/openssl/windows/portfile.cmake
! b/ports/openssl/windows/portfile.cmake
! index 7a3bf08ed..c873eb756 100644
! --- a/ports/openssl/windows/portfile.cmake
! +++ b/ports/openssl/windows/portfile.cmake
! @@ -21,6 +21,7 @@ set(CONFIGURE_OPTIONS
!      enable-capieng
!      no-ssl2
!      no-tests
! +    no-autoload-config
!      -utf-8
!      ${OPENSSL_SHARED}
! )

There is also corresponsing PR to vcpkg:

https://github.com/microsoft/vcpkg/pull/18389

When above PR is merged, this port overlay can be removed.

CVE: 2121-3606
Signed-off-by: Lev Stipakov <lev@openvpn.net>
Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <20210617061259.297-1-lstipakov@gmail.com>
URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg22569.html
2021-06-17 10:44:17 +02:00
..
extract-crl Add CRL extractor script for --crl-verify dir mode 2021-05-05 22:09:04 +02:00
OCSP_check Fix OCSP_check.sh 2016-02-25 16:03:19 +01:00
openvpn-fwmarkroute-1.00 This is the start of the BETA21 branch. 2005-09-26 05:28:27 +00:00
pull-resolv-conf Update copyright to include 2018 plus company name change 2018-02-01 08:29:21 +01:00
vcpkg-ports contrib/vcpkg-ports: add openssl port with --no-autoload-config option set (CVE-2121-3606) 2021-06-17 10:44:17 +02:00
vcpkg-triplets msvc: standalone building 2021-06-15 10:52:51 +02:00
multilevel-init.patch This is the start of the BETA21 branch. 2005-09-26 05:28:27 +00:00
README This is the start of the BETA21 branch. 2005-09-26 05:28:27 +00:00

README 

This directory contains scripts and patches contributed
by users.