From mboxrd@z Thu Jan 1 00:00:00 1970 Delivery-date: Sat, 03 Oct 2026 15:44:46 +0200 Received: from metis.whiteo.stw.pengutronix.de ([2a0a:edc0:2:b01:1d::104]) by lore.white.stw.pengutronix.de with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.96) (envelope-from ) id 1xD02f-009IAO-36 for lore@lore.pengutronix.de; Sat, 03 Oct 2026 15:44:45 +0200 Received: from [127.0.0.1] (helo=metis.whiteo.stw.pengutronix.de) by metis.whiteo.stw.pengutronix.de with esmtp (Exim 4.92) (envelope-from ) id 1xD02f-0007gS-9b; Sat, 03 Oct 2026 15:44:45 +0200 Received: from mx1.white.stw.pengutronix.de ([2a0a:edc0:0:b01:1d::107]) by metis.whiteo.stw.pengutronix.de with esmtp (Exim 4.92) (envelope-from ) id 1xD02W-0007gG-AZ for ptxdist@pengutronix.de; Sat, 03 Oct 2026 15:44:36 +0200 Received: from MRWPR03CU001.outbound.protection.outlook.com (mail-francesouthazlp170110003.outbound.protection.outlook.com [IPv6:2a01:111:f403:c207::3]) by mx1.white.stw.pengutronix.de (Postfix) with ESMTPS id C66D5200757 for ; Sat, 03 Oct 2026 15:44:35 +0200 (CEST) ARC-Seal: i=2; s=20260414; d=pengutronix.de; t=1791035075; a=rsa-sha256; cv=pass; b=RTqCgQK0qoQ1Dg0hWvlHZZBdHkV7Fm6vssFbEZS2sSQjw233vYxmTaY/fwR/DzXf8k81ar wZTCfN/2ZxCfHIo93b/L05v7U/fzafWR2DGJ2SJY77wOu9oef0zoiB6Aw106zu/gE/nEpK rki7AQCZ66OE34n3rqUi2i04OABK1INp57/gr9h/4UWhbn5/srMNWHPJ7OmJDc6qk4djaF vktsjS8siShDMxFaaGhY3VNl/+Zs1w9qVKtiEKhWrOPUJAZbLPBR0Pu4fFKcCng+cztoaA V05N0KF8olYdPj2wIfJhNPzcJxb8ZNh0OEQ3c2XAQhWbcgLEGLhfue4iCnR9CQ== ARC-Authentication-Results: i=2; mx1.white.stw.pengutronix.de; dkim=pass header.d=t2datacom.onmicrosoft.com header.s=selector1-t2datacom-onmicrosoft-com header.b="DVTHrs/H"; spf=pass (mx1.white.stw.pengutronix.de: domain of christian.melki@t2data.com designates 2a01:111:f403:c207::3 as permitted sender) smtp.mailfrom=christian.melki@t2data.com; arc=pass ("microsoft.com:s=arcselector10001:i=1"); dmarc=pass (policy=none) header.from=t2data.com ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=pengutronix.de; s=20260414; t=1791035075; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding:dkim-signature; bh=IpOrD+7AcjwRZnjgIFiDvFOb6BXt2mDo7nD4jP6Dfgo=; b=ZQ7ZG/Zly8BWdfoCsjsV3UIAWxFOd5J+U5zoVYVSN+HG7n+lDoP2Snrhg8Mf9OFHyBucei WZbSnVUp1hSUsRCTJjrQJgARWs4pxWowgc4oGTexYrl5YviuQqCWuhY2PyzNoKsD3w6StO m2NO1450LFw80PVFciWy+iohRdiIk+p6L1xOczulfkSr1OZ0m4RrbWFhjW7Psa8JPJ1UL5 GPn3z0oWlCQxHGVVyjeNtI6PCm2iw1BmgK2fIXdJ+WUhDWCHoUGAgvjWwy17e5Bmh2nn1n 9tT/hD83xs9m5GknVnRapu3SJDUXe6m0639LrEUzdvninVbSlnjGuPk24qPVzw== ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=Pv0lFTDYyP1ngGhVaVcEtFoP+YsLrAaRnP2K/6+L0oQiFg9TcgutERJQtQZ8X0ygaT0bkLNq+9eITB9Gnv8zYn0LwdkYj+cKN/F8hZaAWgYRFzq1iZDzuBtxUrt9EcsYpBSnZxdbYCfJgEYqB71XiDK3+4jvjwGD7Af1yaQa9Km2YExSteJbG/E6MHlovqVZLl1Rnpk96nqVVzp/dzwfT7X92KW998Rkl7vKZlV3mbvUALxh3FWZxDJi5Y6JEDg9EgDKdpdQ80iSvAbU/4R+HGo8PXXt2qjSs3OSyE3BX4+FglUvPYIZAPAWhqzynB1DEqusMsKF3Sh11v8XVqmi4g== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=IpOrD+7AcjwRZnjgIFiDvFOb6BXt2mDo7nD4jP6Dfgo=; b=ToiviUUBJvwbi6u5t8eldwA9DRmxJN8U3YR6gPTGyy33Kg0I3fMpo5CgL5hXvJl2tG3mLlocezmUAPlBCWoOgu8Bo9lm2VL40gu01YP+rBpnJB3saxdkbdVhe9xmJ3MeMj1WmKHyR42KEYtXc5nWHZAxP1VeDlMgrJ+yDNbacxq6wDgq864q0kSZW7OtxKaC/ABuEwD4X8wN8bcXdgoxZiERG7cJGiGnf7n3a+g9+A7h8CYInHw15coJpWQ4r962+66nUlcajnhkoCEgM9Jhms0bSZz4lKUVspk9fZ8c1c0WZVPH8QFsRlvds4Z8YN1sCegZw757O2xdxSwWALWuPw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=t2data.com; dmarc=pass action=none header.from=t2data.com; dkim=pass header.d=t2data.com; arc=none Received: from DB9P251MB0618.EURP251.PROD.OUTLOOK.COM (2603:10a6:10:334::22) by PAXP251MB0012.EURP251.PROD.OUTLOOK.COM (2603:10a6:102:1db::23) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.472.18; Sat, 3 Oct 2026 13:44:33 +0000 Received: from DB9P251MB0618.EURP251.PROD.OUTLOOK.COM ([fe80::a4b2:58d7:8549:4b19]) by DB9P251MB0618.EURP251.PROD.OUTLOOK.COM ([fe80::a4b2:58d7:8549:4b19%3]) with mapi id 15.21.0472.016; Sat, 3 Oct 2026 13:44:32 +0000 From: Christian Melki To: ptxdist@pengutronix.de Date: Sat, 3 Oct 2026 15:44:26 +0200 Message-ID: <20261003134426.3006946-1-christian.melki@t2data.com> X-Mailer: git-send-email 2.43.0 Content-Transfer-Encoding: 8bit Content-Type: text/plain X-ClientProxiedBy: MM0P280CA0068.SWEP280.PROD.OUTLOOK.COM (2603:10a6:190:8::35) To DB9P251MB0618.EURP251.PROD.OUTLOOK.COM (2603:10a6:10:334::22) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: DB9P251MB0618:EE_|PAXP251MB0012:EE_ X-MS-Office365-Filtering-Correlation-Id: afe5c829-fadf-4637-7261-08df21547444 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; ARA:13230040|1800799024|376014|366016|52116014|23010399003|18002099003|10067099003|38350700014|56012099006; X-Microsoft-Antispam-Message-Info: IPC7VzxOrjUXJhK5FkTanh3Kx4OOLKASird+CTXCcCl2Ke90HTbv233TUyQpnpY28hXU72WJMt1qhSk/F4J81LaK/3CaukGU45oz+jK+SCA0t6chESpfOdcUtwGG2D6SlsjAKF6nuP/R59uMbFuuylzMIcswtHKRWiaYepmVNni7fK49owmtHC5dEop0z5a8hmOa/EM7/TTiDEBnlzUrfFwVigNED/vn9Lm9hm1C0Mduk/Hv3dBwPj++MUKiJ05uu7NZzNj5fW7iMrxXQ9p/L19grc6RmPZK3DS0iJUvX8tyaGGn3Olla1UxY//movOWgvKyqPXDFAKgeIBhiRfLmiSw1z987hfntQ7OQvGOzcBybKFpqG5ejxYwEvulWQN7ZACBbgy6C37Rmccc7umxb7xsE2TNdms55x95195qKc5iFtAH3lp7oKfi0Xk3JHFQakn/hQ3M/QIb2Jn9+xSeKsV0qrjxOuquPcxW1brt9d0GaGcy4DJKesaUkcMygwMAH2blcU+blJSJ2aKam2CfzMmXiQfQX8HCuedt1eHLCSWZ0cYCE18/2CHua+BTPgVtkvp73gEsHkH9v/i0yaRV65hfdoOuBl0m83JYnCB/UtAcRWecc4QcsPk8uMs+PejXC0iZFW8SJKFtSqyHQVHUS/QvzeFfp+Cvu8MUA8U38Z/pbc6ajPowa6Ko5JP3dlRNyufAIFI1hGTFC49+g+k9uzQKkTXgcaWXy0NjHgpBP44= X-Forefront-Antispam-Report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:DB9P251MB0618.EURP251.PROD.OUTLOOK.COM; PTR:; CAT:NONE; SFS:(13230040)(1800799024)(376014)(366016)(52116014)(23010399003)(18002099003)(10067099003)(38350700014)(56012099006); DIR:OUT; SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?s4JSNIcfxy0GGmrFYMVvGUvN6Fn+3DW86VAiD6O5p9RLE/07ysTr0De/qpCT?= =?us-ascii?Q?9t1h/sZ8ixE6qTx8C4fMRTF6eC6BRTxJVOY6QPXdi6r6Y4FxpPjEXhyjF4rK?= =?us-ascii?Q?6NUl6mc++DSnm0IxVbA4sE9vXkaQ9ayvws34itHSDCKWxm8bSTqzw0iImfGM?= =?us-ascii?Q?dQs0xqITAOBDQUIsVN1+aG16KYxhFYlTTYngWljsGqG/fn4k9Up+ofwKnW5G?= =?us-ascii?Q?fsxEKyCSy94/qUJhl3uapdestqGaOzlxSpDLvUwAmYYrc9ZoYPst+sX9wFkO?= =?us-ascii?Q?LN0f2aIrUxSBHm5Z5O50+Yan3AQDx0DmPMKNNTGlI20DfLZdz8s8fBJsfBSz?= =?us-ascii?Q?bjKI0iEZrthjrZMM5qljkH+8Y9Wl4kshnpjY/V8AukYHq9XAty6Ev4HP/Oek?= =?us-ascii?Q?Jr02WDdSZtckW1PHNMbFK1vreeU2uYAG1QR/2VjbMKFe+Ab5oqHhqKJ9XAWH?= =?us-ascii?Q?ZvSGr4aYRbKmOX4X+HRYNyQr6mmNRczO6gGN1PP0UKsDuZUodnbp7o43riQI?= =?us-ascii?Q?PdYUpmHxV3hjknSt2+XQV7p/FPT6LA47zzstZoi/0mXezBuiP1RLAWpdcJPI?= =?us-ascii?Q?Jszl69q7fFkq0wnT0MwUM6lJkziVdbx0BzRlNqBsCwpNoWVPMSewrbABaVCT?= =?us-ascii?Q?tohuVn1vkMaY/2vtBOOOMDiRqGUXbHaAG6oFbfHg0qMEDaWlrb8iuKou0BUu?= =?us-ascii?Q?eF7TxONG/bLfl5kYDdpuLasP4xgNybjtM3ljLsWBOD+HrfLg4ahXFGFFYrBt?= =?us-ascii?Q?y0RTDwJ9eFD+wW6p0jH1fKf7iQKaefqeE9iO4oSF4JLUDQ9d+xi5wagyB0+E?= =?us-ascii?Q?sovg7N+2gG7paeJqDjm5b6MJCWvctq9Z8IXxc6AuHQiACj99B5BRpk/Sof1g?= =?us-ascii?Q?fXccysvNjhOuLdISfKsRkCx1MiFTt1qlRoZplWUyrheRjuScCn3s47Z1wxDN?= =?us-ascii?Q?8hEfNqcQGDqRF3tv9xtjaRzH6z9bnRqgCt9I4s40QdNxOkddPhsWzDf5eA3z?= =?us-ascii?Q?cCR593iVnKb7xgB3mp5OAUdcTOK3ke9uOo2stapu4RZ0iri1hr4WlIxVQaBY?= =?us-ascii?Q?GC+lgNbulUxB808FETTbP7r0/blO7sEkfyzoiT4eFYY5ImcBTt7VayRgxFKI?= =?us-ascii?Q?geuPAWtDfwdP0pC9vm1M1hGH1uLZZbZ58i74uhlrE+NEElfdkF1xtzIKuBei?= =?us-ascii?Q?++3mrWXaCr7grtxjih3F5qd4oDT2tvfi2Dy9LDmIuHRhoSeRtUIcTyD2asgE?= =?us-ascii?Q?ED4EGrVpn1n5xyQvVQDXjbD5WWIw6sMScB4V+12+eM8oTRVh7OP09gpsHW6n?= =?us-ascii?Q?bvts0Y52woblOFiaQksUfYojKeky4phHsnOeOfF2fw7FE+F2Fk/W6XsIM6I3?= =?us-ascii?Q?2g9QF0TF5TtyCeKCqhTHlCrFK3mqxnL1y/bmwm0XqqvqxlXKTFnlI3yqM/Pp?= =?us-ascii?Q?qY2mgqffpvCgIeymFYBfy7x2e6faoJcmZfhQ//A4C/KLz6hcnJcjnvEfCKL4?= =?us-ascii?Q?0TSPZlKSfzsZIwfOhwXyiQlwLChfk/P7xjJjzYm3Q8WCV3Ql/uSGLAELhbcg?= =?us-ascii?Q?rVktmIiN4GWveldDQpsNEtLFTwbGemWXHepfV5m1QFKoic+czy3iwjWc7TPt?= =?us-ascii?Q?GBM7pDAeWdnMuCNhh4ubDJN6aIr4dYhy0l7LlcDeJWvj3nYw6w17EeJlqnXi?= =?us-ascii?Q?pSK4h1gAAlRaH4Qtl1eogIRxadzkBp8g68Q7dXlHNj7AETZzsD8Qt8+NLe8J?= =?us-ascii?Q?dm5NYHvJ0gGinkegjyAMoghhh4QO46s=3D?= X-OriginatorOrg: t2data.com X-MS-Exchange-CrossTenant-Network-Message-Id: afe5c829-fadf-4637-7261-08df21547444 X-MS-Exchange-CrossTenant-AuthSource: DB9P251MB0618.EURP251.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 03 Oct 2026 13:44:32.2602 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 27928da5-aacd-4ba1-9566-c748a6863e6c X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: 6qeYxmkjWzuXf1eWNCMUn6fjhgCgXBEljCiifEPO7oWbNFcEjXY2PoVFFPDK6H2P9fnET4jt5zqjkH03t7o7huoQL8GfmlQCJM8g7+V4A/w= X-MS-Exchange-Transport-CrossTenantHeadersStamped: PAXP251MB0012 X-Spamd-Result: default: False [-3.50 / 15.00]; BAYES_HAM(-3.00)[100.00%]; MID_CONTAINS_FROM(1.00)[]; ARC_ALLOW(-1.00)[microsoft.com:s=arcselector10001:i=1]; R_MISSING_CHARSET(0.50)[]; DMARC_POLICY_ALLOW(-0.50)[t2data.com,none]; R_SPF_ALLOW(-0.20)[+ip6:2a01:111:f403:c000::/51]; R_DKIM_ALLOW(-0.20)[t2datacom.onmicrosoft.com:s=selector1-t2datacom-onmicrosoft-com]; MIME_GOOD(-0.10)[text/plain]; TO_MATCH_ENVRCPT_ALL(0.00)[]; ASN(0.00)[asn:8075, ipnet:2a01:111:f000::/36, country:US]; RCPT_COUNT_ONE(0.00)[1]; MIME_TRACE(0.00)[0:+]; FROM_HAS_DN(0.00)[]; RCVD_TLS_LAST(0.00)[]; FROM_EQ_ENVFROM(0.00)[]; NEURAL_HAM(-0.00)[-1.000]; RCVD_COUNT_TWO(0.00)[2]; ARC_SIGNED(0.00)[pengutronix.de:s=20260414:i=2]; TO_DN_NONE(0.00)[]; DKIM_TRACE(0.00)[t2datacom.onmicrosoft.com:+] X-Rspamd-Action: no action X-Rspamd-Server: mx1 X-Rspamd-Queue-Id: C66D5200757 X-Stat-Signature: 68e4brisqun1849uqhjfs4zfrmgayrua Subject: [ptxdist] [PATCH] openssl: Version bump. 3.5.8 -> 3.5.9 X-BeenThere: ptxdist@pengutronix.de X-Mailman-Version: 2.1.29 Precedence: list List-Id: PTXdist Development Mailing List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: ptxdist@pengutronix.de Sender: "ptxdist" X-SA-Exim-Connect-IP: 127.0.0.1 X-SA-Exim-Mail-From: ptxdist-bounces@pengutronix.de X-SA-Exim-Scanned: No (on metis.whiteo.stw.pengutronix.de); SAEximRunCond expanded to false Security patch release. https://github.com/openssl/openssl/releases/tag/openssl-3.5.9 Plugs CVEs: CVE-2026-84782: Fixed DTLS retransmissions of handshake messages from a stale buffer offset. CVE-2026-35189: Fixed excessive memory allocation in relative CRLDP processing. CVE-2026-35191: Fixed QUIC unvalidated amplification credit may be over-accounted. CVE-2026-42772: Fixed potential CPU DoS via O(n^2) fragment reassembly in QUIC. CVE-2026-54872: Fixed a timing side-channel in scalar multiplication for mon-NIST EC curves. CVE-2026-54873: Fixed QUIC STREAM fragment metadata DoS. CVE-2026-54875: Fixed non-constant-time SM2 scalar multiplication on ARM64 and RISC-V. CVE-2026-72897: Fixed out-of-bounds access after SSL_set_SSL_CTX() during a handshake. CVE-2026-75804: Fixed QUIC connection-level flow control was not enforced for streams. CVE-2026-75805: Fixed a NULL pointer dereference in CMP client revocation response handling. CVE-2026-75806: Fixed an unauthenticated and undersized DTLS 1.2 AEAD record causing DoS. CVE-2026-77696: Fixed a timing side-channel in SM2 signature generation. CVE-2026-84784: Fixed an unbounded RETIRE_CONNECTION_ID backlog in QUIC stack implementation. Signed-off-by: Christian Melki --- .../0001-debian-targets.patch | 0 patches/{openssl-3.5.8 => openssl-3.5.9}/0002-pic.patch | 0 ...Configure-allow-to-enable-ktls-if-target-does-not-st.patch | 0 .../0004-conf-Serialize-allocation-free-of-ssl_names.patch | 0 patches/{openssl-3.5.8 => openssl-3.5.9}/series | 0 rules/openssl.make | 4 ++-- 6 files changed, 2 insertions(+), 2 deletions(-) rename patches/{openssl-3.5.8 => openssl-3.5.9}/0001-debian-targets.patch (100%) rename patches/{openssl-3.5.8 => openssl-3.5.9}/0002-pic.patch (100%) rename patches/{openssl-3.5.8 => openssl-3.5.9}/0003-Configure-allow-to-enable-ktls-if-target-does-not-st.patch (100%) rename patches/{openssl-3.5.8 => openssl-3.5.9}/0004-conf-Serialize-allocation-free-of-ssl_names.patch (100%) rename patches/{openssl-3.5.8 => openssl-3.5.9}/series (100%) diff --git a/patches/openssl-3.5.8/0001-debian-targets.patch b/patches/openssl-3.5.9/0001-debian-targets.patch similarity index 100% rename from patches/openssl-3.5.8/0001-debian-targets.patch rename to patches/openssl-3.5.9/0001-debian-targets.patch diff --git a/patches/openssl-3.5.8/0002-pic.patch b/patches/openssl-3.5.9/0002-pic.patch similarity index 100% rename from patches/openssl-3.5.8/0002-pic.patch rename to patches/openssl-3.5.9/0002-pic.patch diff --git a/patches/openssl-3.5.8/0003-Configure-allow-to-enable-ktls-if-target-does-not-st.patch b/patches/openssl-3.5.9/0003-Configure-allow-to-enable-ktls-if-target-does-not-st.patch similarity index 100% rename from patches/openssl-3.5.8/0003-Configure-allow-to-enable-ktls-if-target-does-not-st.patch rename to patches/openssl-3.5.9/0003-Configure-allow-to-enable-ktls-if-target-does-not-st.patch diff --git a/patches/openssl-3.5.8/0004-conf-Serialize-allocation-free-of-ssl_names.patch b/patches/openssl-3.5.9/0004-conf-Serialize-allocation-free-of-ssl_names.patch similarity index 100% rename from patches/openssl-3.5.8/0004-conf-Serialize-allocation-free-of-ssl_names.patch rename to patches/openssl-3.5.9/0004-conf-Serialize-allocation-free-of-ssl_names.patch diff --git a/patches/openssl-3.5.8/series b/patches/openssl-3.5.9/series similarity index 100% rename from patches/openssl-3.5.8/series rename to patches/openssl-3.5.9/series diff --git a/rules/openssl.make b/rules/openssl.make index 2c60f127a..c92a7e2c0 100644 --- a/rules/openssl.make +++ b/rules/openssl.make @@ -16,8 +16,8 @@ PACKAGES-$(PTXCONF_OPENSSL) += openssl # # Paths and names # -OPENSSL_VERSION := 3.5.8 -OPENSSL_SHA256 := a8f84a39918ec6415ce765d9b429d313ba97b8143169c172e734b9514464f5b2 +OPENSSL_VERSION := 3.5.9 +OPENSSL_SHA256 := 603f5602e2eef00d77fbd429d34dcd5822bb301757a1bc9cdb24c670f1eb859a OPENSSL := openssl-$(OPENSSL_VERSION) OPENSSL_SUFFIX := tar.gz OPENSSL_URL := \ -- 2.43.0