package/libopenssl: security bump to version 3.6.1

Fixes the following vulnerabilities:

CVE-2025-11187 - Improper validation of PBMAC1 parameters in PKCS#12 MAC verification.
CVE-2025-15467 - Stack buffer overflow in CMS AuthEnvelopedData parsing.
CVE-2025-15468 - NULL dereference in SSL_CIPHER_find() function on unknown cipher ID.
CVE-2025-15469 - ‘openssl dgst’ one-shot codepath silently truncates inputs >16MB.
CVE-2025-66199 - TLS 1.3 CompressedCertificate excessive memory allocation.
CVE-2025-68160 - Heap out-of-bounds write in BIO_f_linebuffer on short writes.
CVE-2025-69418 - Unauthenticated/unencrypted trailing bytes with low-level OCB function calls
CVE-2025-69419 - Out of bounds write in PKCS12_get_friendlyname() UTF-8 conversion.
CVE-2025-69420 - Missing ASN1_TYPE validation in TS_RESP_verify_response() function.
CVE-2025-69421 - NULL Pointer Dereference in PKCS12_item_decrypt_d2i_ex function
CVE-2026-22795 - Missing ASN1_TYPE validation in PKCS#12 parsing
CVE-2026-22796 - ASN1_TYPE Type Confusion in the PKCS7_digest_from_attributes() function

For more details, see the announcement:
https://openssl-library.org/post/2026-01-27-release-announcement/

Drop now upstreamed 0004-Scope-aes_cfb128_vaes_encdec_wrapper-to-x64.patch:
f529d26591

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>

package/libopenssl/0004-Scope-aes_cfb128_vaes_encdec_wrapper-to-x64.patch

@@ -1,36 +0,0 @@
-From a37d316e643a4c2be4708d504cc3ecbf37ec1773 Mon Sep 17 00:00:00 2001
-From: Kai Pastor <dg0yt@darc.de>
-Date: Wed, 8 Oct 2025 18:50:33 +0200
-Subject: [PATCH] Scope aes_cfb128_vaes_encdec_wrapper to x64
-
-This function is only used on x64 and relies on other functions which
-are only implemented for x64.
-Fixes #28745.
-
-Upstream: https://github.com/openssl/openssl/pull/28792
-
-Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
----
- providers/implementations/ciphers/cipher_aes_cfb_hw_aesni.inc | 2 ++
- 1 file changed, 2 insertions(+)
-
-diff --git a/providers/implementations/ciphers/cipher_aes_cfb_hw_aesni.inc b/providers/implementations/ciphers/cipher_aes_cfb_hw_aesni.inc
-index d5577d00f132e..eb8e0164ac9ed 100644
---- a/providers/implementations/ciphers/cipher_aes_cfb_hw_aesni.inc
-+++ b/providers/implementations/ciphers/cipher_aes_cfb_hw_aesni.inc
-@@ -30,6 +30,7 @@
- static int ossl_aes_cfb8_vaes_eligible(void) { return 0; }
- static int ossl_aes_cfb1_vaes_eligible(void) { return 0; }
- 
-+#if (defined(__x86_64) || defined(__x86_64__) || defined(_M_AMD64) || defined(_M_X64))
- /* active in 64-bit builds when AES-NI, AVX512F, and VAES are detected */
- static int aes_cfb128_vaes_encdec_wrapper(
-     PROV_CIPHER_CTX* dat,
-@@ -56,6 +57,7 @@ static int aes_cfb128_vaes_encdec_wrapper(
- 
-     return 1;
- }
-+#endif
-  
- /* generates AES round keys for AES-NI and VAES implementations */
- static int cipher_hw_aesni_initkey(PROV_CIPHER_CTX *dat,

package/libopenssl/libopenssl.hash

@@ -1,5 +1,5 @@
-# From https://github.com/openssl/openssl/releases/download/openssl-3.6.0/openssl-3.6.0.tar.gz.sha256
-sha256  b6a5f44b7eb69e3fa35dbf15524405b44837a481d43d81daddde3ff21fcbb8e9  openssl-3.6.0.tar.gz
+# From https://github.com/openssl/openssl/releases/download/openssl-3.6.1/openssl-3.6.1.tar.gz.sha256
+sha256  b1bfedcd5b289ff22aee87c9d600f515767ebf45f77168cb6d64f231f518a82e  openssl-3.6.1.tar.gz
 
 # License files
 sha256  7d5450cb2d142651b8afa315b5f238efc805dad827d91ba367d8516bc9d49e7a  LICENSE.txt

package/libopenssl/libopenssl.mk

@@ -4,7 +4,7 @@
 #
 ################################################################################
 
-LIBOPENSSL_VERSION = 3.6.0
+LIBOPENSSL_VERSION = 3.6.1
 LIBOPENSSL_SITE = https://github.com/openssl/openssl/releases/download/openssl-$(LIBOPENSSL_VERSION)
 LIBOPENSSL_SOURCE = openssl-$(LIBOPENSSL_VERSION).tar.gz
 LIBOPENSSL_LICENSE = Apache-2.0