mirror of
https://gitlab.com/buildroot.org/buildroot.git
synced 2026-08-01 21:23:51 -09:00
b0ea6e310f
Fixes the following security issues:
Fixed heap use-after-free in PKCS7_verify().
(CVE-2026-45447)
Fixed CMS AuthEnvelopedData processing may accept forged messages.
(CVE-2026-34182)
Fixed unbounded memory growth in the QUIC PATH_CHALLENGE handler.
(CVE-2026-34183)
Fixed double-free when checking OCSP stapled response.
(CVE-2026-35188)
Fixed NULL pointer dereference in QUIC server initial packet handling.
(CVE-2026-42764)
Fixed AES-OCB IV ignored on EVP_Cipher() path.
(CVE-2026-45445)
Fixed possible heap buffer overflow in ASN.1 multibyte string conversion.
(CVE-2026-7383)
Fixed out-of-bounds read in CMS password-based decryption.
(CVE-2026-9076)
Fixed heap buffer over-read in ASN.1 content parsing.
(CVE-2026-34180)
Fixed PKCS#12 files with PBMAC1 are accepted with short HMAC keys.
(CVE-2026-34181)
Fixed NULL dereference in certificate verification with OCSP Checking.
(CVE-2026-42765)
Fixed possible NULL dereference in password-dased CMS decryption.
(CVE-2026-42766)
Fixed NULL pointer dereference in CRMF EncryptedValue decryption.
(CVE-2026-42767)
Fixed multi-RecipientInfo Bleichenbacher Oracle in CMS_decrypt()
and PKCS7_decrypt().
(CVE-2026-42768)
Fixed trust anchor substitution via cert/issuer typo in CMP
rootCaKeyUpdate.
(CVE-2026-42769)
Fixed FFC-DH peer validation uses attacker-supplied q.
(CVE-2026-42770)
Fixed incorrect tag processing for empty messages in AES-GCM-SIV
and AES-SIV modes.
(CVE-2026-45446)
For more details, see the release notes and advisory:
https://github.com/openssl/openssl/releases/tag/openssl-3.6.3
https://openssl-library.org/news/secadv/20260609.txt
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>