diff mbox series

openssl: Update to version 3.6.4

Message ID 20260908195241.2909132-14-adolf.belka@ipfire.org
State Staged
Commit 1eb8a776c797f92a758e33571083cfc42ab5b765
Headers
Series openssl: Update to version 3.6.4 |

Commit Message

Adolf Belka 8 Sep 2026, 7:52 p.m. UTC 
- Update from version 3.6.3 to 3.6.4
- Update of rootfile
- 11 CVE fixes
- Changelog
3.6.4
OpenSSL 3.6.4 is a security patch release.  The most severe CVE fixed
in this release is Moderate.
This release incorporates the following bug fixes and mitigations:
  * Fixed QUIC server being able to trigger double free when processing
    `INITIAL` packet.
    ([CVE-2026-18798])
  * Fixed heap buffer overflow in CMS key unwrapping.
    ([CVE-2026-63072])
  * Fixed invalid pointer dereference in CMP server via crafted `protectionAlg`.
    ([CVE-2026-63076])
  * Fixed unbounded memory growth in QUIC server incoming channel queue.
    ([CVE-2026-14456])
  * Fixed RPK server signature algorithm selection being able to dereference
    a missing certificate.
    ([CVE-2026-14457])
  * Fixed excessive memory use buffering DTLS records for a future epoch.
    ([CVE-2026-54874])
  * Fixed client-side nemory leak in OCSP response checking.
    ([CVE-2026-54876])
  * Fixed untrusted Sender DN being used as a format string in CMP response
    validation.
    ([CVE-2026-63073])
  * Fixed CMP indefinite cache growth of `extraCerts`.
    ([CVE-2026-63074])
  * Fixed QUIC ACK-only packet retention being able to cause memory exhaustion.
    ([CVE-2026-63075])
  * Fixed possibility of AEAD forgeries with empty ciphertext when using
    `EVP_Cipher()`.
    ([CVE-2026-75803])
  * Fixed checking of authentication tags for empty ciphertexts for AEAD ciphers
    in CCM cipher mode.

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
---
 config/rootfiles/common/openssl | 6 ++++++
 lfs/openssl                     | 4 ++--
 2 files changed, 8 insertions(+), 2 deletions(-)
diff mbox series

Patch

diff --git a/config/rootfiles/common/openssl b/config/rootfiles/common/openssl
index 9b07e091d..cda9b5571 100644
--- a/config/rootfiles/common/openssl
+++ b/config/rootfiles/common/openssl
@@ -503,6 +503,7 @@  usr/lib/ossl-modules/legacy.so
 #usr/share/doc/openssl/html/man3/HMAC.html
 #usr/share/doc/openssl/html/man3/MD5.html
 #usr/share/doc/openssl/html/man3/MDC2_Init.html
+#usr/share/doc/openssl/html/man3/NAME_CONSTRAINTS_check.html
 #usr/share/doc/openssl/html/man3/NCONF_new_ex.html
 #usr/share/doc/openssl/html/man3/OBJ_nid2obj.html
 #usr/share/doc/openssl/html/man3/OCSP_REQUEST_new.html
@@ -515,6 +516,7 @@  usr/lib/ossl-modules/legacy.so
 #usr/share/doc/openssl/html/man3/OPENSSL_FILE.html
 #usr/share/doc/openssl/html/man3/OPENSSL_LH_COMPFUNC.html
 #usr/share/doc/openssl/html/man3/OPENSSL_LH_stats.html
+#usr/share/doc/openssl/html/man3/OPENSSL_armcap.html
 #usr/share/doc/openssl/html/man3/OPENSSL_config.html
 #usr/share/doc/openssl/html/man3/OPENSSL_fork_prepare.html
 #usr/share/doc/openssl/html/man3/OPENSSL_gmtime.html
@@ -3620,6 +3622,8 @@  usr/lib/ossl-modules/legacy.so
 #usr/share/man/man3/MDC2_Final.3ossl
 #usr/share/man/man3/MDC2_Init.3ossl
 #usr/share/man/man3/MDC2_Update.3ossl
+#usr/share/man/man3/NAME_CONSTRAINTS_check.3ossl
+#usr/share/man/man3/NAME_CONSTRAINTS_check_CN.3ossl
 #usr/share/man/man3/NAME_CONSTRAINTS_free.3ossl
 #usr/share/man/man3/NAME_CONSTRAINTS_new.3ossl
 #usr/share/man/man3/NAMING_AUTHORITY.3ossl
@@ -3790,6 +3794,7 @@  usr/lib/ossl-modules/legacy.so
 #usr/share/man/man3/OPENSSL_VERSION_TEXT.3ossl
 #usr/share/man/man3/OPENSSL_aligned_alloc.3ossl
 #usr/share/man/man3/OPENSSL_aligned_alloc_array.3ossl
+#usr/share/man/man3/OPENSSL_armcap.3ossl
 #usr/share/man/man3/OPENSSL_atexit.3ossl
 #usr/share/man/man3/OPENSSL_buf2hexstr.3ossl
 #usr/share/man/man3/OPENSSL_buf2hexstr_ex.3ossl
@@ -5676,6 +5681,7 @@  usr/lib/ossl-modules/legacy.so
 #usr/share/man/man3/SSL_VALUE_EVENT_HANDLING_MODE_IMPLICIT.3ossl
 #usr/share/man/man3/SSL_VALUE_EVENT_HANDLING_MODE_INHERIT.3ossl
 #usr/share/man/man3/SSL_VALUE_QUIC_IDLE_TIMEOUT.3ossl
+#usr/share/man/man3/SSL_VALUE_QUIC_MAX_PENDING_CONNS.3ossl
 #usr/share/man/man3/SSL_VALUE_QUIC_STREAM_BIDI_LOCAL_AVAIL.3ossl
 #usr/share/man/man3/SSL_VALUE_QUIC_STREAM_BIDI_REMOTE_AVAIL.3ossl
 #usr/share/man/man3/SSL_VALUE_QUIC_STREAM_UNI_LOCAL_AVAIL.3ossl
diff --git a/lfs/openssl b/lfs/openssl
index ef2e5891c..3eb2c85b5 100644
--- a/lfs/openssl
+++ b/lfs/openssl
@@ -24,7 +24,7 @@ 
 
 include Config
 
-VER        = 3.6.3
+VER        = 3.6.4
 
 THISAPP    = openssl-$(VER)
 DL_FILE    = $(THISAPP).tar.gz
@@ -72,7 +72,7 @@  objects = $(DL_FILE)
 
 $(DL_FILE) = $(DL_FROM)/$(DL_FILE)
 
-$(DL_FILE)_BLAKE2 = 12dcbd977c3ccbeefd0310c23a8398d91395896b0d23e3e630d1318e96d650ee7dadd91c8ea1876458076b2d19d1fa72c70ae76669ce97d315aa813a0b826745
+$(DL_FILE)_BLAKE2 = 93d5fcd284a52963b476f98e9915359a1025a9487cb2d15d7437e9b9a8058050ae249f0b76b5627f589036cecda62c69aebfab6c8be2ddcf82ae7e3a6ff87804
 
 install : $(TARGET)