From fce728765632f5882d334f295586864043121cc9 Mon Sep 17 00:00:00 2001 From: Peter Korsgaard Date: Wed, 28 Jan 2026 10:06:43 +0100 Subject: [PATCH] package/libopenssl: security bump to version 3.6.1 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Fixes the following vulnerabilities: CVE-2025-11187 - Improper validation of PBMAC1 parameters in PKCS#12 MAC verification. CVE-2025-15467 - Stack buffer overflow in CMS AuthEnvelopedData parsing. CVE-2025-15468 - NULL dereference in SSL_CIPHER_find() function on unknown cipher ID. CVE-2025-15469 - ‘openssl dgst’ one-shot codepath silently truncates inputs >16MB. CVE-2025-66199 - TLS 1.3 CompressedCertificate excessive memory allocation. CVE-2025-68160 - Heap out-of-bounds write in BIO_f_linebuffer on short writes. CVE-2025-69418 - Unauthenticated/unencrypted trailing bytes with low-level OCB function calls CVE-2025-69419 - Out of bounds write in PKCS12_get_friendlyname() UTF-8 conversion. CVE-2025-69420 - Missing ASN1_TYPE validation in TS_RESP_verify_response() function. CVE-2025-69421 - NULL Pointer Dereference in PKCS12_item_decrypt_d2i_ex function CVE-2026-22795 - Missing ASN1_TYPE validation in PKCS#12 parsing CVE-2026-22796 - ASN1_TYPE Type Confusion in the PKCS7_digest_from_attributes() function For more details, see the announcement: https://openssl-library.org/post/2026-01-27-release-announcement/ Drop now upstreamed 0004-Scope-aes_cfb128_vaes_encdec_wrapper-to-x64.patch: https://github.com/openssl/openssl/commit/f529d2659155883026cc5fe1e3a560c274da86b9 Signed-off-by: Peter Korsgaard Signed-off-by: Julien Olivain --- ...es_cfb128_vaes_encdec_wrapper-to-x64.patch | 36 ------------------- package/libopenssl/libopenssl.hash | 4 +-- package/libopenssl/libopenssl.mk | 2 +- 3 files changed, 3 insertions(+), 39 deletions(-) delete mode 100644 package/libopenssl/0004-Scope-aes_cfb128_vaes_encdec_wrapper-to-x64.patch diff --git a/package/libopenssl/0004-Scope-aes_cfb128_vaes_encdec_wrapper-to-x64.patch b/package/libopenssl/0004-Scope-aes_cfb128_vaes_encdec_wrapper-to-x64.patch deleted file mode 100644 index ab4cf88a40..0000000000 --- a/package/libopenssl/0004-Scope-aes_cfb128_vaes_encdec_wrapper-to-x64.patch +++ /dev/null @@ -1,36 +0,0 @@ -From a37d316e643a4c2be4708d504cc3ecbf37ec1773 Mon Sep 17 00:00:00 2001 -From: Kai Pastor -Date: Wed, 8 Oct 2025 18:50:33 +0200 -Subject: [PATCH] Scope aes_cfb128_vaes_encdec_wrapper to x64 - -This function is only used on x64 and relies on other functions which -are only implemented for x64. -Fixes #28745. - -Upstream: https://github.com/openssl/openssl/pull/28792 - -Signed-off-by: Bernd Kuhls ---- - providers/implementations/ciphers/cipher_aes_cfb_hw_aesni.inc | 2 ++ - 1 file changed, 2 insertions(+) - -diff --git a/providers/implementations/ciphers/cipher_aes_cfb_hw_aesni.inc b/providers/implementations/ciphers/cipher_aes_cfb_hw_aesni.inc -index d5577d00f132e..eb8e0164ac9ed 100644 ---- a/providers/implementations/ciphers/cipher_aes_cfb_hw_aesni.inc -+++ b/providers/implementations/ciphers/cipher_aes_cfb_hw_aesni.inc -@@ -30,6 +30,7 @@ - static int ossl_aes_cfb8_vaes_eligible(void) { return 0; } - static int ossl_aes_cfb1_vaes_eligible(void) { return 0; } - -+#if (defined(__x86_64) || defined(__x86_64__) || defined(_M_AMD64) || defined(_M_X64)) - /* active in 64-bit builds when AES-NI, AVX512F, and VAES are detected */ - static int aes_cfb128_vaes_encdec_wrapper( - PROV_CIPHER_CTX* dat, -@@ -56,6 +57,7 @@ static int aes_cfb128_vaes_encdec_wrapper( - - return 1; - } -+#endif - - /* generates AES round keys for AES-NI and VAES implementations */ - static int cipher_hw_aesni_initkey(PROV_CIPHER_CTX *dat, diff --git a/package/libopenssl/libopenssl.hash b/package/libopenssl/libopenssl.hash index 9322a56e76..0e0dbd3926 100644 --- a/package/libopenssl/libopenssl.hash +++ b/package/libopenssl/libopenssl.hash @@ -1,5 +1,5 @@ -# From https://github.com/openssl/openssl/releases/download/openssl-3.6.0/openssl-3.6.0.tar.gz.sha256 -sha256 b6a5f44b7eb69e3fa35dbf15524405b44837a481d43d81daddde3ff21fcbb8e9 openssl-3.6.0.tar.gz +# From https://github.com/openssl/openssl/releases/download/openssl-3.6.1/openssl-3.6.1.tar.gz.sha256 +sha256 b1bfedcd5b289ff22aee87c9d600f515767ebf45f77168cb6d64f231f518a82e openssl-3.6.1.tar.gz # License files sha256 7d5450cb2d142651b8afa315b5f238efc805dad827d91ba367d8516bc9d49e7a LICENSE.txt diff --git a/package/libopenssl/libopenssl.mk b/package/libopenssl/libopenssl.mk index 28dcb9dfc2..d580947899 100644 --- a/package/libopenssl/libopenssl.mk +++ b/package/libopenssl/libopenssl.mk @@ -4,7 +4,7 @@ # ################################################################################ -LIBOPENSSL_VERSION = 3.6.0 +LIBOPENSSL_VERSION = 3.6.1 LIBOPENSSL_SITE = https://github.com/openssl/openssl/releases/download/openssl-$(LIBOPENSSL_VERSION) LIBOPENSSL_SOURCE = openssl-$(LIBOPENSSL_VERSION).tar.gz LIBOPENSSL_LICENSE = Apache-2.0