From mboxrd@z Thu Jan 1 00:00:00 1970 Delivery-date: Tue, 25 Aug 2026 21:08:47 +0200 Received: from metis.whiteo.stw.pengutronix.de ([2a0a:edc0:2:b01:1d::104]) by lore.white.stw.pengutronix.de with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.96) (envelope-from ) id 1wywVq-007AVT-2A for lore@lore.pengutronix.de; Tue, 25 Aug 2026 21:08:47 +0200 Received: from [127.0.0.1] (helo=metis.whiteo.stw.pengutronix.de) by metis.whiteo.stw.pengutronix.de with esmtp (Exim 4.92) (envelope-from ) id 1wywVq-0008KP-Pl; Tue, 25 Aug 2026 21:08:46 +0200 Received: from mx1.white.stw.pengutronix.de ([185.203.200.13]) by metis.whiteo.stw.pengutronix.de with esmtp (Exim 4.92) (envelope-from ) id 1wywVF-0008KC-Ar for ptxdist@pengutronix.de; Tue, 25 Aug 2026 21:08:09 +0200 Received: from OSPPR02CU001.outbound.protection.outlook.com (mail-norwayeastazlp170130007.outbound.protection.outlook.com [IPv6:2a01:111:f403:c20f::7]) by mx1.white.stw.pengutronix.de (Postfix) with ESMTPS id B4DE7204AFA for ; Tue, 25 Aug 2026 21:08:04 +0200 (CEST) Authentication-Results: mx1.white.stw.pengutronix.de; dkim=pass header.d=t2datacom.onmicrosoft.com header.s=selector1-t2datacom-onmicrosoft-com header.b="Nqo46nR/"; spf=pass (mx1.white.stw.pengutronix.de: domain of christian.melki@t2data.com designates 2a01:111:f403:c20f::7 as permitted sender) smtp.mailfrom=christian.melki@t2data.com; dmarc=pass (policy=none) header.from=t2data.com; arc=pass ("microsoft.com:s=arcselector10001:i=1") ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=Q16YWcie/M2IwmMjxGkU+YjzKHI4W25ALLTgNxGUsb5aTi0Q4TKivrIJdBq8tEQg59z5wE64Zg+eywuivINSlNE18scknuq3c7uXKOVj3lGWPzgbw5QgyHtxdAYVuvkvqaqTLsBKnwByx7q9CjgHUySXbq2xeiPWwjqVsJ60EoLHZrqFwmej3hLij8a+VBVJ/9m7jMcM9OD00gdMXnNcUxr3Pztu0/oup5ANxwD9FfocaT8paf27sPXUQ5uuiMohC+Kxl6qfuorJPxusupa0v7Zdny9E+NnaIopE8ofY1YvPTp0DEyeZlcnSli9B1qBtrNJCa5IJZPWZEFCOOQtdRw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=ZMattB0ijiJaomROpF38pUmqxudw9PycVyAGKE2lKTk=; b=gG8shagM2kjkivXMWp83I9USL/5vy+0yRfVOhS2agObevQxseP3EG5/twoJNN8Xifj9L+1tvTKVJDkYdsPwS1COjxj+sLZkXJSDxoFOcUQ8T+pzC6BPwJXdUqSST38Ok09CHAXxidoWGS+GTyooHkqt+TlQyZSFPYS5UlWrP2txLO132UJJaaj8qYFLOnPZ8JGT26QkoDvocd28+H7Mm3ErQoURqHsf8jQl6dyPEUnv3kDHaRpVeW9vENYEG6JjMAbKQs7yXdwWnFW2GgeFmfaPHZ9e+fWxSpLGmmcZOAoPvmZ3iIQT47a6P0UH9B/NhDkqKeQpbFBuBRQ/Bb6/UVg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=t2data.com; dmarc=pass action=none header.from=t2data.com; dkim=pass header.d=t2data.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=t2datacom.onmicrosoft.com; s=selector1-t2datacom-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=ZMattB0ijiJaomROpF38pUmqxudw9PycVyAGKE2lKTk=; b=Nqo46nR/blaelucGOXmJsIHzqAqw/SXdRZl0gtt8GnNF/eaaA1K1QIZqOmPVOyHiZ0FFlE2q4qtuNKfyUWd0mYfdZ7aqE2nBJ53wxat4V4xhnmdvDRFpoPEWGiUIB1rhJdvKShYcOQqx2KY5xHHjNTk8CTYB30NJCXEiG0XSlIY= Received: from DB9P251MB0618.EURP251.PROD.OUTLOOK.COM (2603:10a6:10:334::22) by DU0P251MB0940.EURP251.PROD.OUTLOOK.COM (2603:10a6:10:3e3::16) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.360.8; Tue, 25 Aug 2026 19:08:01 +0000 Received: from DB9P251MB0618.EURP251.PROD.OUTLOOK.COM ([fe80::a4b2:58d7:8549:4b19]) by DB9P251MB0618.EURP251.PROD.OUTLOOK.COM ([fe80::a4b2:58d7:8549:4b19%3]) with mapi id 15.21.0339.012; Tue, 25 Aug 2026 19:08:00 +0000 From: Christian Melki To: ptxdist@pengutronix.de Date: Tue, 25 Aug 2026 21:07:41 +0200 Message-ID: <20260825190741.4131050-1-christian.melki@t2data.com> X-Mailer: git-send-email 2.43.0 Content-Transfer-Encoding: 8bit Content-Type: text/plain X-ClientProxiedBy: GVX0EPF0005F6C2.SWEP280.PROD.OUTLOOK.COM (2603:10a6:158:401::658) To DB9P251MB0618.EURP251.PROD.OUTLOOK.COM (2603:10a6:10:334::22) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: DB9P251MB0618:EE_|DU0P251MB0940:EE_ X-MS-Office365-Filtering-Correlation-Id: 1bcaf9b5-fab2-4608-4689-08df02dc2e63 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; ARA:13230040|366016|1800799024|23010399003|52116014|376014|18002099003|56012099006|6133799003|10067099003|38350700014; X-Microsoft-Antispam-Message-Info: KXHFfJVi3XNc9s8maVdur34aZ7XhmxH1QOOHdmX7Ug/RoIu0Z0wg+WaPF/CWInj9G0HjioQDrBSn2v1A39eRNdZzQADoStSjgN/hSzp21Mirx+ugInytcjApMO5nbCeLALneY6mCvftQlR1tJgailWTQOXjPPc5Dsv2e1wIhE84kBZzv4/HtVZx4ru2ryz8BXVPf/OPEyfE4F1w2FkgTES+mG05T4ncd7eA5KjW+7zA2f8zKAzMWP9a1bWbuExl/V5SmeFBh/ZMzBC1ozoBmkW3cBqbUPlcW4u7yLfwKNqDKJF2hqASecKeBEdynzD16fB2YuZq1JXVpCGMBZTuq5bPmOL3HjcKtEUOeLykE6kNyI6xkuib5cQ75JVw6t0ALxs7ahF1CU+r0yTxMtBgfPp81SdHgkQ8cM4LtDa7enqzQ0erwt8zLoiARNwTJQ13CMeQpRkv232DfYvE1GHqz+or3Ng5SgA1l9EyitfvooMm36TVOIV0M3iZPqexBTuFt3SlHfPRtuURX5tM9+QiXOeT/k8m+rPvIuU+9YyU9tidtS2aKBzhOvionAHfpuRoP5+D3WciOylTNPIjP3fjiq1y64MqIKHAyjWtEDGW6wwCE25uV9m8MXtpl2DIf1+WrHHmxn3SeP7VzOmIIRcDGXmknW9mwZTl0vkQkCwhd1iqjFuFQ3Amez8Spv0c0qe+ZOdudV7jOkC3793n0njcsH5eymTZoXRTNjSLJdFlD7S4= X-Forefront-Antispam-Report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:DB9P251MB0618.EURP251.PROD.OUTLOOK.COM; PTR:; CAT:NONE; SFS:(13230040)(366016)(1800799024)(23010399003)(52116014)(376014)(18002099003)(56012099006)(6133799003)(10067099003)(38350700014); DIR:OUT; SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?Hw9d1ytVK4zx0UlGrgmEKN70/IXnq017uuAaR4N4gKjDy/sYPTqIPDHDwEBz?= =?us-ascii?Q?eMT97wRPXIMmIygdnVbBqcnDFkNUM/xaGnTkIyNlS1VtVXTKV7iYjtFP8utA?= =?us-ascii?Q?vVebeuDayrPLGfhHa9fynTfAj7jz8kJVGg9XYinBrzK21O1I9Ctsq9FsVVYN?= =?us-ascii?Q?62ULkpDOD/EQhoR/XS51p/OAy1SqbfzFQTVK0/LVqDqB9yrCfgJXuBwY8vi3?= =?us-ascii?Q?vuLw7bR/vSDQ6Gix0HealJOcOW9bxbssGz6LT6s2w+tdkDLbpCJiiE/OOa5t?= =?us-ascii?Q?EcvYHMWiaNOUDVSZyEurXHCImkVL36gDoZUGyzMQ9CM6KpM7/rnteygaRwZr?= =?us-ascii?Q?ZA41mQM2XbTuDdrmCmJBYlk/au4/UCKMtqLZKuwQX4WeP3ACqZSJFBlgBT7v?= =?us-ascii?Q?oCPz7T7Gp8e0wMHnRMUxssbYtfybqu23X2KVnkjdqR5eztd6xwp1Aw1XqRVT?= =?us-ascii?Q?ZUfuN3OFw3dGTCUT2MhHpU6yJn7vzGsb/RKeHZ+TbpfVRgJ+LWzXH3WqW8cg?= =?us-ascii?Q?Qy7N3mydA3S108AsDIb95cEZJrVOB6frzziKJMGKDBUGeyYXjXxpUiO8pFRg?= =?us-ascii?Q?2xKd8inP0slwC7oEMDBAstvxl3l+DdbC0vsAQqCTvB3t5McixCm5q0eZ1NWH?= =?us-ascii?Q?ciAGhUSXtWbPbZio9sonnWc5REEdJyiqf6xHjk+1AsEK+/UZSZQgkpvtNFKl?= =?us-ascii?Q?OGOmX4m7st5ghHSeDE0mq+T+gj2c4YGQvKh8NoIIFenrhQ6MZLjDwsOw3Wdv?= =?us-ascii?Q?Dw+9J+MJ2AMO86y9MhuG/TZFypS4xLdWa1Vl9JmVk/nrYzwofEe+ULdU/PDQ?= =?us-ascii?Q?af74+s+ikcz0MV/NCfgjQZiYe2YA3Y7uj1JjtVjxj1EbzcFBVDdqv2iWRg1O?= =?us-ascii?Q?GlktDCc67NqfbI1iMQStLFwQ1S2dJRQJ/Iv6FZEf5aCRihMjqb2+YtsQH9ZQ?= =?us-ascii?Q?pKggtIyzYXTZijoRNYFFDk/UWfZ9srgIcz1OyLy3zuRMBnuwLMImep1k+XSj?= =?us-ascii?Q?Ph8VqkXxE1zwsuyh1YNwDgi/M+OOUU7kqYeDwPxtO48qlH4gxAKczXSm2QUh?= =?us-ascii?Q?D6dp0oeXugXE2j6y34K9Ej/DUmWGN7WkcOBrbSmk81vlfDafUGTbEc7fkf72?= =?us-ascii?Q?9rOgBWApCeY2u9WkR/FhjuassUcAtLJ88ZX8mPQQNpPfzcYe3jngMCE1T4+T?= =?us-ascii?Q?jMWr8YoRd0mls5DnmN0mufM0wG7DFkp7P2yMwqzEujpbe59ypMfdheDsTMAh?= =?us-ascii?Q?dtl5zPHSoBqSusSKqvT+Vt7AtgVi9jNiJyPg+MFON7FwROdftQu5lu8u3K9P?= =?us-ascii?Q?79b2PcBEsqTP6RJRy+31j+hhtv/cohK8EuJl+ukxKGqlWmG9OR/E5ceCYCy/?= =?us-ascii?Q?5Pm6OB78No5hCK27tXKAiodu0CWaEQTCwrr5cGSbxGM+ucqAT6tPIEtah4Cw?= =?us-ascii?Q?un3sN56rToSzbDxtkBDUde6QsGYE1Ud8LPptbtEP7zUoKu6bpApkuLYjedZC?= =?us-ascii?Q?rJVOZbRMpib93Ab4BJglwSgi192hsta03QWtEvfFPWLcHwo+fP32lOF2PZ8c?= =?us-ascii?Q?cDZiGnsu70AbYML6dVdP/+WV2DuJJqVlXUme6nmuUiyHI5LKRqYhW9vCgINf?= =?us-ascii?Q?uHKANQfjkU//9zyLsxZfVBJ3GoXtxiIQDZ2RyGim0Rja/+GBWTBKTmbOgKLf?= =?us-ascii?Q?WHcG1V9ethhovnri1cRF3r2XqlRZO8MBhaVQeLNaZC6Scylv4USDWjgL8AKn?= =?us-ascii?Q?Vj4zvat3JInawD9F8OCSovUAfxOj8SE=3D?= X-OriginatorOrg: t2data.com X-MS-Exchange-CrossTenant-Network-Message-Id: 1bcaf9b5-fab2-4608-4689-08df02dc2e63 X-MS-Exchange-CrossTenant-AuthSource: DB9P251MB0618.EURP251.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 25 Aug 2026 19:08:00.7825 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 27928da5-aacd-4ba1-9566-c748a6863e6c X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: CWpuhacYN9jOzix3OArr4gAbqPxFILOQKvN2mOOP6BmTaQ3G8PuprYgmT8sF9GdiaBCyDy7MACeGPzSkpS9m4FKKVqm5eaZohdhG21tI0Ik= X-MS-Exchange-Transport-CrossTenantHeadersStamped: DU0P251MB0940 X-Spamd-Result: default: False [-3.50 / 15.00]; BAYES_HAM(-3.00)[100.00%]; MID_CONTAINS_FROM(1.00)[]; ARC_ALLOW(-1.00)[microsoft.com:s=arcselector10001:i=1]; R_MISSING_CHARSET(0.50)[]; DMARC_POLICY_ALLOW(-0.50)[t2data.com,none]; R_SPF_ALLOW(-0.20)[+ip6:2a01:111:f403:c000::/51]; R_DKIM_ALLOW(-0.20)[t2datacom.onmicrosoft.com:s=selector1-t2datacom-onmicrosoft-com]; MIME_GOOD(-0.10)[text/plain]; TO_MATCH_ENVRCPT_ALL(0.00)[]; ASN(0.00)[asn:8075, ipnet:2a01:111:f000::/36, country:US]; MIME_TRACE(0.00)[0:+]; FROM_HAS_DN(0.00)[]; RCVD_TLS_LAST(0.00)[]; RCPT_COUNT_ONE(0.00)[1]; RCVD_COUNT_TWO(0.00)[2]; FROM_EQ_ENVFROM(0.00)[]; RCVD_IN_DNSWL_NONE(0.00)[2a01:111:f403:c20f::7:from]; TO_DN_NONE(0.00)[]; DKIM_TRACE(0.00)[t2datacom.onmicrosoft.com:+] X-Rspamd-Action: no action X-Rspamd-Queue-Id: B4DE7204AFA X-Rspamd-Server: mx1 X-Stat-Signature: sy8bansuer6kcxrm8ycciwz4499385yg X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on metis.whiteo.stw.pengutronix.de X-Spam-Level: X-Spam-Status: No, score=-1.5 required=5.0 tests=AWL,BAYES_00,DKIM_SIGNED, DKIM_VALID,FORGED_SPF_HELO,RCVD_IN_DNSWL_NONE,SPF_HELO_PASS autolearn=no autolearn_force=no version=3.4.2 Subject: [ptxdist] [PATCH] openssl: Version bump. 3.5.7 -> 3.5.8 X-BeenThere: ptxdist@pengutronix.de X-Mailman-Version: 2.1.29 Precedence: list List-Id: PTXdist Development Mailing List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: ptxdist@pengutronix.de Sender: "ptxdist" X-SA-Exim-Connect-IP: 127.0.0.1 X-SA-Exim-Mail-From: ptxdist-bounces@pengutronix.de X-SA-Exim-Scanned: No (on metis.whiteo.stw.pengutronix.de); SAEximRunCond expanded to false Security fix release. https://github.com/openssl/openssl/releases/tag/openssl-3.5.8 Plugs CVEs: CVE-2026-18798: Fixed QUIC server being able to trigger double free when processing INITIAL packet. CVE-2026-63072: Fixed heap buffer overflow in CMS key unwrapping. CVE-2026-63076: Fixed invalid pointer dereference in CMP server via crafted protectionAlg. CVE-2026-14456: Fixed unbounded memory growth in QUIC server incoming channel queue. CVE-2026-14457: Fixed RPK server signature algorithm selection being able to dereference a missing certificate. CVE-2026-54874: Fixed excessive memory use buffering DTLS records for a future epoch. CVE-2026-63073: Fixed untrusted Sender DN being used as a format string in CMP response validation. CVE-2026-63074: Fixed CMP indefinite cache growth of extraCerts. CVE-2026-63075: Fixed QUIC ACK-only packet retention being able to cause memory exhaustion. CVE-2026-75803: Fixed possibility of AEAD forgeries with empty ciphertext when using EVP_Cipher(). * Forward patchset, applies cleanly. Signed-off-by: Christian Melki --- .../0001-debian-targets.patch | 0 patches/{openssl-3.5.7 => openssl-3.5.8}/0002-pic.patch | 0 ...Configure-allow-to-enable-ktls-if-target-does-not-st.patch | 0 .../0004-conf-Serialize-allocation-free-of-ssl_names.patch | 0 patches/{openssl-3.5.7 => openssl-3.5.8}/series | 0 rules/openssl.make | 4 ++-- 6 files changed, 2 insertions(+), 2 deletions(-) rename patches/{openssl-3.5.7 => openssl-3.5.8}/0001-debian-targets.patch (100%) rename patches/{openssl-3.5.7 => openssl-3.5.8}/0002-pic.patch (100%) rename patches/{openssl-3.5.7 => openssl-3.5.8}/0003-Configure-allow-to-enable-ktls-if-target-does-not-st.patch (100%) rename patches/{openssl-3.5.7 => openssl-3.5.8}/0004-conf-Serialize-allocation-free-of-ssl_names.patch (100%) rename patches/{openssl-3.5.7 => openssl-3.5.8}/series (100%) diff --git a/patches/openssl-3.5.7/0001-debian-targets.patch b/patches/openssl-3.5.8/0001-debian-targets.patch similarity index 100% rename from patches/openssl-3.5.7/0001-debian-targets.patch rename to patches/openssl-3.5.8/0001-debian-targets.patch diff --git a/patches/openssl-3.5.7/0002-pic.patch b/patches/openssl-3.5.8/0002-pic.patch similarity index 100% rename from patches/openssl-3.5.7/0002-pic.patch rename to patches/openssl-3.5.8/0002-pic.patch diff --git a/patches/openssl-3.5.7/0003-Configure-allow-to-enable-ktls-if-target-does-not-st.patch b/patches/openssl-3.5.8/0003-Configure-allow-to-enable-ktls-if-target-does-not-st.patch similarity index 100% rename from patches/openssl-3.5.7/0003-Configure-allow-to-enable-ktls-if-target-does-not-st.patch rename to patches/openssl-3.5.8/0003-Configure-allow-to-enable-ktls-if-target-does-not-st.patch diff --git a/patches/openssl-3.5.7/0004-conf-Serialize-allocation-free-of-ssl_names.patch b/patches/openssl-3.5.8/0004-conf-Serialize-allocation-free-of-ssl_names.patch similarity index 100% rename from patches/openssl-3.5.7/0004-conf-Serialize-allocation-free-of-ssl_names.patch rename to patches/openssl-3.5.8/0004-conf-Serialize-allocation-free-of-ssl_names.patch diff --git a/patches/openssl-3.5.7/series b/patches/openssl-3.5.8/series similarity index 100% rename from patches/openssl-3.5.7/series rename to patches/openssl-3.5.8/series diff --git a/rules/openssl.make b/rules/openssl.make index fb8355dbd..53d3ee5f3 100644 --- a/rules/openssl.make +++ b/rules/openssl.make @@ -16,8 +16,8 @@ PACKAGES-$(PTXCONF_OPENSSL) += openssl # # Paths and names # -OPENSSL_VERSION := 3.5.7 -OPENSSL_SHA256 := a8c0d28a529ca480f9f36cf5792e2cd21984552a3c8e4aa11a24aa31aeac98e8 +OPENSSL_VERSION := 3.5.8 +OPENSSL_SHA256 := a8f84a39918ec6415ce765d9b429d313ba97b8143169c172e734b9514464f5b2 OPENSSL := openssl-$(OPENSSL_VERSION) OPENSSL_SUFFIX := tar.gz OPENSSL_URL := \ -- 2.43.0