BSD PortsLibreSSL -- Multiple vulnerabilities
The LibreSSL project reports: Ensure verify callbacks always returning 1 can see a hostname mismatch Correct botched size check in dtls1_preprocess_fragment() Limit size of buffered DTLS handshake messages Avoid potential overread on interrupted retransmission in DTLS Fix OCSP responder authorization bypass in libtls and ocspcheck(8)
Affected versions
- libressl < 4.3.3
- libressl-devel < 4.3.3
By system
0 still vulnerable, 2 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.
| System | Port | Version | State | Fixed |
|---|---|---|---|---|
| FreeBSD | security/libressl | 4.4.0 | fixed | |
| NetBSD | security/libressl | 4.1.0 | not listed | |
| MidnightBSD | security/libressl | 4.3.3 | out of range, by version | |
| FreeBSD | security/libressl-devel | 4.4.0 | fixed |