package/cryptopp: security bump to version 8.3.0
authorFabrice Fontaine <fontaine.fabrice@gmail.com>
Sun, 20 Dec 2020 17:55:56 +0000 (18:55 +0100)
committerPeter Korsgaard <peter@korsgaard.com>
Mon, 21 Dec 2020 09:45:08 +0000 (10:45 +0100)
commite7c789d48fe10265a392a7af42cf3439a7c726c9
tree69acff2da1ad4388dd9ccf2268fd1a25f7049ef8
parent78dc1dddd0ad8e182cf65ca7b5247adebde135ee
package/cryptopp: security bump to version 8.3.0

- Fix CVE-2019-14318: Crypto++ 8.2.0 and earlier contains a timing side
  channel in ECDSA signature generation. This allows a local or remote
  attacker, able to measure the duration of hundreds to thousands of
  signing operations, to compute the private key used. The issue occurs
  because scalar multiplication in ecp.cpp (prime field curves, small
  leakage) and algebra.cpp (binary field curves, large leakage) is not
  constant time and leaks the bit length of the scalar among other
  information. For details, see:
  https://github.com/weidai11/cryptopp/issues/869

- Update license hash due to the addition of ARM SHA1 and SHA256 asm
  implementation from Cryptogams
  https://github.com/weidai11/cryptopp/commit/1a63112faf5af60e0ebcc60654eef806e7f6f11a
  https://github.com/weidai11/cryptopp/commit/4c9ca6b723b5ec5aab7eec720ad4d22598abe941

https://www.cryptopp.com/release830.html

[Peter: adjust CVE info, issue is fixes in 8.3.0]
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
package/cryptopp/cryptopp.hash
package/cryptopp/cryptopp.mk