package/openssl: security bump to 3.5.7
PATCH 1/1 package/openssl: security bump to 3.5.7
See here for changes:
https://github.com/openssl/openssl/releases/tag/openssl-3.5.7
This release incorporates the following bug fixes and mitigations:
Fixed heap use-after-free in PKCS7_verify().
(CVE-2026-45447)
Fixed CMS AuthEnvelopedData processing may accept forged messages. (CVE-2026-34182)
Fixed unbounded memory growth in the QUIC PATH_CHALLENGE handler. (CVE-2026-34183)
Fixed NULL pointer dereference in QUIC server initial packet handling. (CVE-2026-42764)
Fixed AES-OCB IV ignored on EVP_Cipher() path. (CVE-2026-45445)
Fixed possible heap buffer overflow in ASN.1 multibyte string conversion. (CVE-2026-7383)
Fixed out-of-bounds read in CMS password-based decryption. (CVE-2026-9076)
Fixed heap buffer over-read in ASN.1 content parsing. (CVE-2026-34180)
Fixed PKCS#12 files with PBMAC1 are accepted with short HMAC keys. (CVE-2026-34181)
Fixed possible NULL dereference in password-dased CMS decryption. (CVE-2026-42766)
Fixed NULL pointer dereference in CRMF EncryptedValue decryption. (CVE-2026-42767)
Fixed multi-RecipientInfo Bleichenbacher Oracle in CMS_decrypt() and PKCS7_decrypt().
(CVE-2026-42768)
Fixed trust anchor substitution via cert/issuer typo in CMP rootCaKeyUpdate.
(CVE-2026-42769)
Fixed FFC-DH peer validation uses attacker-supplied q. (CVE-2026-42770)
Fixed incorrect tag processing for empty messages in AES-GCM-SIV and AES-SIV modes.
(CVE-2026-45446)
--- package/libopenssl/libopenssl.hash | 4 ++-- package/libopenssl/libopenssl.mk | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-)
package/libopenssl/libopenssl.hash +2 -2
@@ -1,5 +1,5 @@ -# From https://github.com/openssl/openssl/releases/download/openssl-3.5.6/openssl-3.5.6.tar.gz.sha256 -sha256 deae7c80cba99c4b4f940ecadb3c3338b13cb77418409238e57d7f31f2a3b736 openssl-3.5.6.tar.gz +# From https://github.com/openssl/openssl/releases/download/openssl-3.5.7/openssl-3.5.7.tar.gz.sha256 +sha256 a8c0d28a529ca480f9f36cf5792e2cd21984552a3c8e4aa11a24aa31aeac98e8 openssl-3.5.7.tar.gz # License files sha256 7d5450cb2d142651b8afa315b5f238efc805dad827d91ba367d8516bc9d49e7a LICENSE.txt
package/libopenssl/libopenssl.mk +1 -1
@@ -4,7 +4,7 @@ # ################################################################################ -LIBOPENSSL_VERSION = 3.5.6 +LIBOPENSSL_VERSION = 3.5.7 LIBOPENSSL_SITE = https://github.com/openssl/openssl/releases/download/openssl-$(LIBOPENSSL_VERSION) LIBOPENSSL_SOURCE = openssl-$(LIBOPENSSL_VERSION).tar.gz LIBOPENSSL_LICENSE = Apache-2.0
Signature · 6 lines
2.47.3 _______________________________________________ buildroot mailing list [email protected] https://lists.buildroot.org/mailman/listinfo/buildroot
Hi Waldemar,
Will apply https://lore.kernel.org/r/<[email protected]>
with your comment.
Thanks for sending the update.
PERALE Thomas
In reply of:
Quoted 92 lines
See here for changes:
https://github.com/openssl/openssl/releases/tag/openssl-3.5.7This release incorporates the following bug fixes and mitigations:
Fixed heap use-after-free in
PKCS7_verify().
(CVE-2026-45447)Fixed CMS AuthEnvelopedData processing may accept forged messages. (CVE-2026-34182)
Fixed unbounded memory growth in the QUIC
PATH_CHALLENGEhandler. (CVE-2026-34183)Fixed NULL pointer dereference in QUIC server initial packet handling. (CVE-2026-42764)
Fixed AES-OCB IV ignored on
EVP_Cipher()path. (CVE-2026-45445)Fixed possible heap buffer overflow in ASN.1 multibyte string conversion. (CVE-2026-7383)
Fixed out-of-bounds read in CMS password-based decryption. (CVE-2026-9076)
Fixed heap buffer over-read in ASN.1 content parsing. (CVE-2026-34180)
Fixed PKCS#12 files with PBMAC1 are accepted with short HMAC keys. (CVE-2026-34181)
Fixed possible NULL dereference in password-dased CMS decryption. (CVE-2026-42766)
Fixed NULL pointer dereference in CRMF EncryptedValue decryption. (CVE-2026-42767)
Fixed multi-RecipientInfo Bleichenbacher Oracle in
CMS_decrypt()andPKCS7_decrypt().
(CVE-2026-42768)Fixed trust anchor substitution via cert/issuer typo in CMP rootCaKeyUpdate.
(CVE-2026-42769)Fixed FFC-DH peer validation uses attacker-supplied q. (CVE-2026-42770)
Fixed incorrect tag processing for empty messages in AES-GCM-SIV and AES-SIV modes.
(CVE-2026-45446)Signed-off-by Waldemar Brodkorb <[email protected]>--- package/libopenssl/libopenssl.hash | 4 ++-- package/libopenssl/libopenssl.mk | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-)package/libopenssl/libopenssl.hash +2
-2@@ -1,5 +1,5 @@ -# From https://github.com/openssl/openssl/releases/download/openssl-3.5.6/openssl-3.5.6.tar.gz.sha256 -sha256 deae7c80cba99c4b4f940ecadb3c3338b13cb77418409238e57d7f31f2a3b736 openssl-3.5.6.tar.gz +# From https://github.com/openssl/openssl/releases/download/openssl-3.5.7/openssl-3.5.7.tar.gz.sha256 +sha256 a8c0d28a529ca480f9f36cf5792e2cd21984552a3c8e4aa11a24aa31aeac98e8 openssl-3.5.7.tar.gz # License files sha256 7d5450cb2d142651b8afa315b5f238efc805dad827d91ba367d8516bc9d49e7a LICENSE.txtpackage/libopenssl/libopenssl.mk +1
-1@@ -4,7 +4,7 @@ # ################################################################################ -LIBOPENSSL_VERSION = 3.5.6 +LIBOPENSSL_VERSION = 3.5.7 LIBOPENSSL_SITE = https://github.com/openssl/openssl/releases/download/openssl-$(LIBOPENSSL_VERSION) LIBOPENSSL_SOURCE = openssl-$(LIBOPENSSL_VERSION).tar.gz LIBOPENSSL_LICENSE = Apache-2.0Signature · 6 lines
2.47.3 _______________________________________________ buildroot mailing list [email protected] https://lists.buildroot.org/mailman/listinfo/buildroot
_______________________________________________
buildroot mailing list
[email protected]
https://lists.buildroot.org/mailman/listinfo/buildroot
Hi Thomas,
oh, there was already a patch, I missed it.
Thanks for applying the openssl update.
best regards
Waldemar
Thomas Perale wrote,
Quoted 97 lines
Hi Waldemar,
Will apply https://lore.kernel.org/r/<[email protected]>
with your comment.Thanks for sending the update.
PERALE ThomasIn reply of:
Quoted 88 lines
See here for changes:
https://github.com/openssl/openssl/releases/tag/openssl-3.5.7This release incorporates the following bug fixes and mitigations:
Fixed heap use-after-free in
PKCS7_verify().
(CVE-2026-45447)Fixed CMS AuthEnvelopedData processing may accept forged messages. (CVE-2026-34182)
Fixed unbounded memory growth in the QUIC
PATH_CHALLENGEhandler. (CVE-2026-34183)Fixed NULL pointer dereference in QUIC server initial packet handling. (CVE-2026-42764)
Fixed AES-OCB IV ignored on
EVP_Cipher()path. (CVE-2026-45445)Fixed possible heap buffer overflow in ASN.1 multibyte string conversion. (CVE-2026-7383)
Fixed out-of-bounds read in CMS password-based decryption. (CVE-2026-9076)
Fixed heap buffer over-read in ASN.1 content parsing. (CVE-2026-34180)
Fixed PKCS#12 files with PBMAC1 are accepted with short HMAC keys. (CVE-2026-34181)
Fixed possible NULL dereference in password-dased CMS decryption. (CVE-2026-42766)
Fixed NULL pointer dereference in CRMF EncryptedValue decryption. (CVE-2026-42767)
Fixed multi-RecipientInfo Bleichenbacher Oracle in
CMS_decrypt()andPKCS7_decrypt().
(CVE-2026-42768)Fixed trust anchor substitution via cert/issuer typo in CMP rootCaKeyUpdate.
(CVE-2026-42769)Fixed FFC-DH peer validation uses attacker-supplied q. (CVE-2026-42770)
Fixed incorrect tag processing for empty messages in AES-GCM-SIV and AES-SIV modes.
(CVE-2026-45446)Signed-off-by Waldemar Brodkorb <[email protected]>--- package/libopenssl/libopenssl.hash | 4 ++-- package/libopenssl/libopenssl.mk | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-)package/libopenssl/libopenssl.hash +2
-2@@ -1,5 +1,5 @@ -# From https://github.com/openssl/openssl/releases/download/openssl-3.5.6/openssl-3.5.6.tar.gz.sha256 -sha256 deae7c80cba99c4b4f940ecadb3c3338b13cb77418409238e57d7f31f2a3b736 openssl-3.5.6.tar.gz +# From https://github.com/openssl/openssl/releases/download/openssl-3.5.7/openssl-3.5.7.tar.gz.sha256 +sha256 a8c0d28a529ca480f9f36cf5792e2cd21984552a3c8e4aa11a24aa31aeac98e8 openssl-3.5.7.tar.gz # License files sha256 7d5450cb2d142651b8afa315b5f238efc805dad827d91ba367d8516bc9d49e7a LICENSE.txtpackage/libopenssl/libopenssl.mk +1
-1@@ -4,7 +4,7 @@ # ################################################################################ -LIBOPENSSL_VERSION = 3.5.6 +LIBOPENSSL_VERSION = 3.5.7 LIBOPENSSL_SITE = https://github.com/openssl/openssl/releases/download/openssl-$(LIBOPENSSL_VERSION) LIBOPENSSL_SOURCE = openssl-$(LIBOPENSSL_VERSION).tar.gz LIBOPENSSL_LICENSE = Apache-2.0Signature · 1 line
2.47.3
Quoted 5 lines
Quoted 4 lines
_______________________________________________
buildroot mailing list
[email protected]
https://lists.buildroot.org/mailman/listinfo/buildroot
_______________________________________________
buildroot mailing list
[email protected]
https://lists.buildroot.org/mailman/listinfo/buildroot