From mboxrd@z Thu Jan 1 00:00:00 1970 Delivery-date: Fri, 13 Feb 2026 11:03:12 +0100 Received: from metis.whiteo.stw.pengutronix.de ([2a0a:edc0:2:b01:1d::104]) by lore.white.stw.pengutronix.de with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.96) (envelope-from ) id 1vqq11-001DGI-2Y for lore@lore.pengutronix.de; Fri, 13 Feb 2026 11:03:12 +0100 Received: from [127.0.0.1] (helo=metis.whiteo.stw.pengutronix.de) by metis.whiteo.stw.pengutronix.de with esmtp (Exim 4.92) (envelope-from ) id 1vqq11-0001Vi-QH; Fri, 13 Feb 2026 11:03:11 +0100 Received: from drehscheibe.grey.stw.pengutronix.de ([2a0a:edc0:0:c01:1d::a2]) by metis.whiteo.stw.pengutronix.de with esmtps (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1vqq0n-0000iJ-0Z; Fri, 13 Feb 2026 11:02:57 +0100 Received: from dude05.red.stw.pengutronix.de ([2a0a:edc0:0:1101:1d::54]) by drehscheibe.grey.stw.pengutronix.de with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.96) (envelope-from ) id 1vqq0l-000Yej-1a; Fri, 13 Feb 2026 11:02:56 +0100 Received: from mol by dude05.red.stw.pengutronix.de with local (Exim 4.98.2) (envelope-from ) id 1vqq0m-0000000BglQ-3Iko; Fri, 13 Feb 2026 11:02:56 +0100 From: Michael Olbrich To: ptxdist@pengutronix.de Date: Fri, 13 Feb 2026 11:02:56 +0100 Message-ID: <20260213100256.2785985-1-m.olbrich@pengutronix.de> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20260201192143.3583956-1-christian.melki@t2data.com> References: <20260201192143.3583956-1-christian.melki@t2data.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Subject: Re: [ptxdist] [APPLIED] openssl: Version bump. 3.5.4 -> 3.5.5 X-BeenThere: ptxdist@pengutronix.de X-Mailman-Version: 2.1.29 Precedence: list List-Id: PTXdist Development Mailing List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: ptxdist@pengutronix.de Cc: Christian Melki Sender: "ptxdist" X-SA-Exim-Connect-IP: 127.0.0.1 X-SA-Exim-Mail-From: ptxdist-bounces@pengutronix.de X-SA-Exim-Scanned: No (on metis.whiteo.stw.pengutronix.de); SAEximRunCond expanded to false Thanks, applied as 80bf2ab774e199ad9569d35418d01a619f65e6c8. Michael [sent from post-receive hook] On Fri, 13 Feb 2026 11:02:56 +0100, Christian Melki wrote: > Security bump. > https://github.com/openssl/openssl/releases/tag/openssl-3.5.5 > > Plugs CVEs: > CVE-2025-11187: Fixed Improper validation of PBMAC1 parameters in PKCS#12 MAC verification. > CVE-2025-15467: Fixed Stack buffer overflow in CMS AuthEnvelopedData parsing. > CVE-2025-15468: Fixed NULL dereference in SSL_CIPHER_find() function on unknown cipher ID. > CVE-2025-15469: Fixed openssl dgst one-shot codepath silently truncates inputs >16 MiB. > CVE-2025-66199: Fixed TLS 1.3 CompressedCertificate excessive memory allocation. > CVE-2025-68160: Fixed Heap out-of-bounds write in BIO_f_linebuffer on short writes. > CVE-2025-69418: Fixed Unauthenticated/unencrypted trailing bytes with low-level OCB function calls. > CVE-2025-69419: Fixed Out of bounds write in PKCS12_get_friendlyname() UTF-8 conversion. > CVE-2025-69420: Fixed Missing ASN1_TYPE validation in TS_RESP_verify_response() function. > CVE-2025-69421: Fixed NULL Pointer Dereference in PKCS12_item_decrypt_d2i_ex() function. > CVE-2026-22795: Fixed Missing ASN1_TYPE validation in PKCS#12 parsing. > CVE-2026-22796: Fixed ASN1_TYPE Type Confusion in the PKCS7_digest_from_attributes() function. > > * Forward patchset, adjusted offsets, applies cleanly. > > Signed-off-by: Christian Melki > Message-Id: <20260201192143.3583956-1-christian.melki@t2data.com> > Signed-off-by: Michael Olbrich > > diff --git a/patches/openssl-3.5.4/0001-debian-targets.patch b/patches/openssl-3.5.5/0001-debian-targets.patch > similarity index 99% > rename from patches/openssl-3.5.4/0001-debian-targets.patch > rename to patches/openssl-3.5.5/0001-debian-targets.patch > index 8b3a60e4de2d..ad7bfa4af669 100644 > --- a/patches/openssl-3.5.4/0001-debian-targets.patch > +++ b/patches/openssl-3.5.5/0001-debian-targets.patch > @@ -6,7 +6,7 @@ Imported from openssl_3.5.2-1.debian.tar.xz > > Signed-off-by: Michael Olbrich > --- > - Configurations/20-debian.conf | 163 ++++++++++++++++++++++++++++++++++ > + Configurations/20-debian.conf | 163 ++++++++++++++++++++++++++++++++++++++++++ > 1 file changed, 163 insertions(+) > create mode 100644 Configurations/20-debian.conf > > diff --git a/patches/openssl-3.5.4/0002-pic.patch b/patches/openssl-3.5.5/0002-pic.patch > similarity index 100% > rename from patches/openssl-3.5.4/0002-pic.patch > rename to patches/openssl-3.5.5/0002-pic.patch > diff --git a/patches/openssl-3.5.4/0003-Configure-allow-to-enable-ktls-if-target-does-not-st.patch b/patches/openssl-3.5.5/0003-Configure-allow-to-enable-ktls-if-target-does-not-st.patch > similarity index 100% > rename from patches/openssl-3.5.4/0003-Configure-allow-to-enable-ktls-if-target-does-not-st.patch > rename to patches/openssl-3.5.5/0003-Configure-allow-to-enable-ktls-if-target-does-not-st.patch > diff --git a/patches/openssl-3.5.4/0004-conf-Serialize-allocation-free-of-ssl_names.patch b/patches/openssl-3.5.5/0004-conf-Serialize-allocation-free-of-ssl_names.patch > similarity index 94% > rename from patches/openssl-3.5.4/0004-conf-Serialize-allocation-free-of-ssl_names.patch > rename to patches/openssl-3.5.5/0004-conf-Serialize-allocation-free-of-ssl_names.patch > index 870bc13057af..eb39b4458b72 100644 > --- a/patches/openssl-3.5.4/0004-conf-Serialize-allocation-free-of-ssl_names.patch > +++ b/patches/openssl-3.5.5/0004-conf-Serialize-allocation-free-of-ssl_names.patch > @@ -19,7 +19,7 @@ Signed-off-by: Michael Olbrich > 1 file changed, 32 insertions(+), 3 deletions(-) > > diff --git a/crypto/conf/conf_ssl.c b/crypto/conf/conf_ssl.c > -index 84c5b2afe581..d6596e60c3b5 100644 > +index c8796715c00e..2e152a1c0c2c 100644 > --- a/crypto/conf/conf_ssl.c > +++ b/crypto/conf/conf_ssl.c > @@ -12,6 +12,7 @@ > @@ -85,7 +85,7 @@ index 84c5b2afe581..d6596e60c3b5 100644 > ssl_conf_section = CONF_imodule_get_value(md); > cmd_lists = NCONF_get_section(cnf, ssl_conf_section); > if (sk_CONF_VALUE_num(cmd_lists) <= 0) { > -@@ -77,7 +105,7 @@ static int ssl_module_init(CONF_IMODULE *md, const CONF *cnf) > +@@ -76,7 +104,7 @@ static int ssl_module_init(CONF_IMODULE *md, const CONF *cnf) > goto err; > } > cnt = sk_CONF_VALUE_num(cmd_lists); > @@ -94,9 +94,9 @@ index 84c5b2afe581..d6596e60c3b5 100644 > ssl_names = OPENSSL_zalloc(sizeof(*ssl_names) * cnt); > if (ssl_names == NULL) > goto err; > -@@ -126,7 +154,8 @@ static int ssl_module_init(CONF_IMODULE *md, const CONF *cnf) > +@@ -123,7 +151,8 @@ static int ssl_module_init(CONF_IMODULE *md, const CONF *cnf) > rv = 1; > - err: > + err: > if (rv == 0) > - ssl_module_free(md); > + ssl_module_free_unlocked(md); > diff --git a/patches/openssl-3.5.4/series b/patches/openssl-3.5.5/series > similarity index 82% > rename from patches/openssl-3.5.4/series > rename to patches/openssl-3.5.5/series > index d9889f0bb825..43d793018a2e 100644 > --- a/patches/openssl-3.5.4/series > +++ b/patches/openssl-3.5.5/series > @@ -6,4 +6,4 @@ > 0003-Configure-allow-to-enable-ktls-if-target-does-not-st.patch > 0004-conf-Serialize-allocation-free-of-ssl_names.patch > #tag:upstream --start-number 100 > -# ab24a399a1a602376760e385c08ab320 - git-ptx-patches magic > +# 737c785d3b0f99ce20c6c5dd18240f8a - git-ptx-patches magic > diff --git a/rules/openssl.make b/rules/openssl.make > index 239a2436ec60..988ff36e6188 100644 > --- a/rules/openssl.make > +++ b/rules/openssl.make > @@ -16,8 +16,8 @@ PACKAGES-$(PTXCONF_OPENSSL) += openssl > # > # Paths and names > # > -OPENSSL_VERSION := 3.5.4 > -OPENSSL_MD5 := 570a7ab371147b6ba72c6d0fed93131f > +OPENSSL_VERSION := 3.5.5 > +OPENSSL_MD5 := 9c86d929c3d1067e2c88239d7d1ce81b > OPENSSL := openssl-$(OPENSSL_VERSION) > OPENSSL_SUFFIX := tar.gz > OPENSSL_URL := \