From patchwork Tue Sep 8 19:52:40 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Adolf Belka X-Patchwork-Id: 10180 Return-Path: Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (Client CN "mail01.haj.ipfire.org", Issuer "YR2" (not verified)) by web04.haj.ipfire.org (Postfix) with ESMTPS id 4hfZNt4GTnz3x2p for ; Tue, 08 Sep 2026 19:53:02 +0000 (UTC) Received: from mail02.haj.ipfire.org (mail02.haj.ipfire.org [IPv6:2001:678:b28::201]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (Client CN "mail02.haj.ipfire.org", Issuer "YE1" (not verified)) by mail01.ipfire.org (Postfix) with ESMTPS id 4hfZNr3Vtvz75Z for ; Tue, 08 Sep 2026 19:53:00 +0000 (UTC) Received: from mail02.haj.ipfire.org (localhost [IPv6:::1]) by mail02.haj.ipfire.org (Postfix) with ESMTP id 4hfZNm19W5z37DM for ; Tue, 08 Sep 2026 19:52:56 +0000 (UTC) X-Original-To: development@lists.ipfire.org Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (Client CN "mail01.haj.ipfire.org", Issuer "YR2" (not verified)) by mail02.haj.ipfire.org (Postfix) with ESMTPS id 4hfZNg1d4Wz36Wy for ; Tue, 08 Sep 2026 19:52:51 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mail01.ipfire.org (Postfix) with ESMTPSA id 4hfZNd5RJHz6wB; Tue, 08 Sep 2026 19:52:49 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003rsa; t=1788897169; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=bwMUH6kPYJUuywdVjc2xbyXhiswsidXs1/tEOKh+sqo=; b=jOud6h8mtr0HufBKEDyfEU1zt1IaTBkzTjN7mTyGJ9wUSTUOIFYNwVwaA8HnksoSfiAbUp fl6YHT+W2wOcvd7FIljaCi8Kp7jzgnQ8FJxip/bztF4INqmzZP0mJ8thy0UEiFvI1wYU1T 2M/2YWZ5vjjAIaYVs5qCISWEDytG8r6yaT2P+3n43ZQGR1PrrYIwa5Yd5yZI8OgLZq2sp4 aauSqNd58WeuQbUJ9QW13r/0Tx6Ot+wUo21tBzklCCMKHXCx0gnnU2MHfYcjIVXTWJ0t2j eWgt1FDz+HTO9oG+32AVyGd/L98AX8nYxQ4Wb+AIom3n/FFx1oCb2KQ3PfBEzw== DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003ed25519; t=1788897169; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=bwMUH6kPYJUuywdVjc2xbyXhiswsidXs1/tEOKh+sqo=; b=R7oOtd+KW1kyRJ+92j6k2mfooykdtIyQLqAlC+a2LSzAIZVQMaMOjGI2L9w6TGOrJZGJE7 c2f1W5/4PR2OEODA== From: Adolf Belka To: development@lists.ipfire.org Cc: Adolf Belka Subject: [PATCH] openssl: Update to version 3.6.4 Date: Tue, 8 Sep 2026 21:52:40 +0200 Message-ID: <20260908195241.2909132-14-adolf.belka@ipfire.org> In-Reply-To: <20260908195241.2909132-1-adolf.belka@ipfire.org> References: <20260908195241.2909132-1-adolf.belka@ipfire.org> Precedence: list List-Id: List-Subscribe: , List-Unsubscribe: , List-Post: List-Help: Sender: Mail-Followup-To: MIME-Version: 1.0 - Update from version 3.6.3 to 3.6.4 - Update of rootfile - 11 CVE fixes - Changelog 3.6.4 OpenSSL 3.6.4 is a security patch release. The most severe CVE fixed in this release is Moderate. This release incorporates the following bug fixes and mitigations: * Fixed QUIC server being able to trigger double free when processing `INITIAL` packet. ([CVE-2026-18798]) * Fixed heap buffer overflow in CMS key unwrapping. ([CVE-2026-63072]) * Fixed invalid pointer dereference in CMP server via crafted `protectionAlg`. ([CVE-2026-63076]) * Fixed unbounded memory growth in QUIC server incoming channel queue. ([CVE-2026-14456]) * Fixed RPK server signature algorithm selection being able to dereference a missing certificate. ([CVE-2026-14457]) * Fixed excessive memory use buffering DTLS records for a future epoch. ([CVE-2026-54874]) * Fixed client-side nemory leak in OCSP response checking. ([CVE-2026-54876]) * Fixed untrusted Sender DN being used as a format string in CMP response validation. ([CVE-2026-63073]) * Fixed CMP indefinite cache growth of `extraCerts`. ([CVE-2026-63074]) * Fixed QUIC ACK-only packet retention being able to cause memory exhaustion. ([CVE-2026-63075]) * Fixed possibility of AEAD forgeries with empty ciphertext when using `EVP_Cipher()`. ([CVE-2026-75803]) * Fixed checking of authentication tags for empty ciphertexts for AEAD ciphers in CCM cipher mode. Signed-off-by: Adolf Belka --- config/rootfiles/common/openssl | 6 ++++++ lfs/openssl | 4 ++-- 2 files changed, 8 insertions(+), 2 deletions(-) diff --git a/config/rootfiles/common/openssl b/config/rootfiles/common/openssl index 9b07e091d..cda9b5571 100644 --- a/config/rootfiles/common/openssl +++ b/config/rootfiles/common/openssl @@ -503,6 +503,7 @@ usr/lib/ossl-modules/legacy.so #usr/share/doc/openssl/html/man3/HMAC.html #usr/share/doc/openssl/html/man3/MD5.html #usr/share/doc/openssl/html/man3/MDC2_Init.html +#usr/share/doc/openssl/html/man3/NAME_CONSTRAINTS_check.html #usr/share/doc/openssl/html/man3/NCONF_new_ex.html #usr/share/doc/openssl/html/man3/OBJ_nid2obj.html #usr/share/doc/openssl/html/man3/OCSP_REQUEST_new.html @@ -515,6 +516,7 @@ usr/lib/ossl-modules/legacy.so #usr/share/doc/openssl/html/man3/OPENSSL_FILE.html #usr/share/doc/openssl/html/man3/OPENSSL_LH_COMPFUNC.html #usr/share/doc/openssl/html/man3/OPENSSL_LH_stats.html +#usr/share/doc/openssl/html/man3/OPENSSL_armcap.html #usr/share/doc/openssl/html/man3/OPENSSL_config.html #usr/share/doc/openssl/html/man3/OPENSSL_fork_prepare.html #usr/share/doc/openssl/html/man3/OPENSSL_gmtime.html @@ -3620,6 +3622,8 @@ usr/lib/ossl-modules/legacy.so #usr/share/man/man3/MDC2_Final.3ossl #usr/share/man/man3/MDC2_Init.3ossl #usr/share/man/man3/MDC2_Update.3ossl +#usr/share/man/man3/NAME_CONSTRAINTS_check.3ossl +#usr/share/man/man3/NAME_CONSTRAINTS_check_CN.3ossl #usr/share/man/man3/NAME_CONSTRAINTS_free.3ossl #usr/share/man/man3/NAME_CONSTRAINTS_new.3ossl #usr/share/man/man3/NAMING_AUTHORITY.3ossl @@ -3790,6 +3794,7 @@ usr/lib/ossl-modules/legacy.so #usr/share/man/man3/OPENSSL_VERSION_TEXT.3ossl #usr/share/man/man3/OPENSSL_aligned_alloc.3ossl #usr/share/man/man3/OPENSSL_aligned_alloc_array.3ossl +#usr/share/man/man3/OPENSSL_armcap.3ossl #usr/share/man/man3/OPENSSL_atexit.3ossl #usr/share/man/man3/OPENSSL_buf2hexstr.3ossl #usr/share/man/man3/OPENSSL_buf2hexstr_ex.3ossl @@ -5676,6 +5681,7 @@ usr/lib/ossl-modules/legacy.so #usr/share/man/man3/SSL_VALUE_EVENT_HANDLING_MODE_IMPLICIT.3ossl #usr/share/man/man3/SSL_VALUE_EVENT_HANDLING_MODE_INHERIT.3ossl #usr/share/man/man3/SSL_VALUE_QUIC_IDLE_TIMEOUT.3ossl +#usr/share/man/man3/SSL_VALUE_QUIC_MAX_PENDING_CONNS.3ossl #usr/share/man/man3/SSL_VALUE_QUIC_STREAM_BIDI_LOCAL_AVAIL.3ossl #usr/share/man/man3/SSL_VALUE_QUIC_STREAM_BIDI_REMOTE_AVAIL.3ossl #usr/share/man/man3/SSL_VALUE_QUIC_STREAM_UNI_LOCAL_AVAIL.3ossl diff --git a/lfs/openssl b/lfs/openssl index ef2e5891c..3eb2c85b5 100644 --- a/lfs/openssl +++ b/lfs/openssl @@ -24,7 +24,7 @@ include Config -VER = 3.6.3 +VER = 3.6.4 THISAPP = openssl-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -72,7 +72,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = 12dcbd977c3ccbeefd0310c23a8398d91395896b0d23e3e630d1318e96d650ee7dadd91c8ea1876458076b2d19d1fa72c70ae76669ce97d315aa813a0b826745 +$(DL_FILE)_BLAKE2 = 93d5fcd284a52963b476f98e9915359a1025a9487cb2d15d7437e9b9a8058050ae249f0b76b5627f589036cecda62c69aebfab6c8be2ddcf82ae7e3a6ff87804 install : $(TARGET)