From mboxrd@z Thu Jan 1 00:00:00 1970 Delivery-date: Thu, 15 Oct 2026 07:58:16 +0200 Received: from metis.whiteo.stw.pengutronix.de ([2a0a:edc0:2:b01:1d::104]) by lore.white.stw.pengutronix.de with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.96) (envelope-from ) id 1xHETo-00DnPy-0k for lore@lore.pengutronix.de; Thu, 15 Oct 2026 07:58:16 +0200 Received: from [127.0.0.1] (helo=metis.whiteo.stw.pengutronix.de) by metis.whiteo.stw.pengutronix.de with esmtp (Exim 4.92) (envelope-from ) id 1xHETn-0006Rl-9g; Thu, 15 Oct 2026 07:58:15 +0200 Received: from mx1.white.stw.pengutronix.de ([185.203.200.13]) by metis.whiteo.stw.pengutronix.de with esmtp (Exim 4.92) (envelope-from ) id 1xHETW-0006Ff-Fe for ptxdist@pengutronix.de; Thu, 15 Oct 2026 07:57:58 +0200 Received: from dude05.red.stw.pengutronix.de (dude05.red.stw.pengutronix.de [IPv6:2a0a:edc0:0:1101:1d::54]) (Authenticated sender: relay-from-dude05.red.stw.pengutronix.de) by mx1.white.stw.pengutronix.de (Postfix) with ESMTPSA id 69E06201D35; Thu, 15 Oct 2026 07:57:58 +0200 (CEST) ARC-Seal: i=1; s=20260414; d=pengutronix.de; t=1792043878; a=rsa-sha256; cv=none; b=MQ6p1/h52fa9yxW3Cwt4QSxAiRaM2KL8ypHM7w1RnoKJEHaXjwvw9rF29LQdQcPycyptGp TbgKzuCRcrSauFiq9IXfRENa9m/tR4lefvGuntApjwOOxwXiqv5o7mQkewjQAK7iIF5q0W vit7SZWBtWi8QUAxKEaGHWx/ZnaJxNp3MfO2r2raxSKm0x2ENpjXdAFKD9g8sF5vVZ49yd ohQiibZpnc57n2IJS3G9SQU+9Kb61/SUsDI7KJ/zwO9AV9Fxk6JHl4bkI1hF14Pw8K/zE2 7wwSfb9lihn6eZL88D1y35gczHH8vyFEHuRNhyJqI5AGVbaNzY1FY058RpHdCw== ARC-Authentication-Results: i=1; ORIGINATING; auth=pass smtp.auth=relay-from-dude05.red.stw.pengutronix.de smtp.mailfrom=mol@pengutronix.de ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=pengutronix.de; s=20260414; t=1792043878; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=UKbmpZbaiaOPEira63oDxYztul85sXUqpOZWBoxhhQI=; b=JJQ3krnsZ7UDWoxp2CIvEJyFKND74MYP+7p8+1KgEtkt4vLqXlQAWoYNfk0mnV3iYsHz2V 8gr6DXifQk2wlREeWwxozKthfKz/KSF0bv+cvV5pVtS2juJ4pXS1urYZSIfw5txhchD+Wm 4eMO7jZprCGmg6FqLP2jVaxJo4HC9XXSfrFkKhVZrcSOZ7RzUfd75zURfloCPzZG/d3xcn vO56Lk8fqhDfuTE2n0dzKnjUgFBCfE0IyaCe2U6dD5yMQgXCMAkIH5jvq3dN1h8ULvXCIW AAUz36/00oOjQ2EMknFCR77q48MWmOemVG4TQmf3buEXmfW12RCGQo+HmyxOGg== Received: by dude05.red.stw.pengutronix.de (Postfix, from userid 1014) id 5A9FE741297; Thu, 15 Oct 2026 07:57:58 +0200 (CEST) From: Michael Olbrich To: ptxdist@pengutronix.de Date: Thu, 15 Oct 2026 07:57:58 +0200 Message-ID: <20261015055758.1415487-1-m.olbrich@pengutronix.de> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20261003134426.3006946-1-christian.melki@t2data.com> References: <20261003134426.3006946-1-christian.melki@t2data.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on metis.whiteo.stw.pengutronix.de X-Spam-Level: X-Spam-Status: No, score=-3.3 required=5.0 tests=ALL_TRUSTED,AWL,BAYES_00, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU autolearn=ham autolearn_force=no version=3.4.2 Subject: Re: [ptxdist] [APPLIED] openssl: Version bump. 3.5.8 -> 3.5.9 X-BeenThere: ptxdist@pengutronix.de X-Mailman-Version: 2.1.29 Precedence: list List-Id: PTXdist Development Mailing List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: ptxdist@pengutronix.de Cc: Christian Melki Sender: "ptxdist" X-SA-Exim-Connect-IP: 127.0.0.1 X-SA-Exim-Mail-From: ptxdist-bounces@pengutronix.de X-SA-Exim-Scanned: No (on metis.whiteo.stw.pengutronix.de); SAEximRunCond expanded to false Thanks, applied as 4ddd1e95705a17b1846d9cb340d65709735f945b. Michael [sent from post-receive hook] On Thu, 15 Oct 2026 07:57:58 +0200, Christian Melki wrote: > Security patch release. > https://github.com/openssl/openssl/releases/tag/openssl-3.5.9 > > Plugs CVEs: > CVE-2026-84782: Fixed DTLS retransmissions of handshake messages from a stale buffer offset. > CVE-2026-35189: Fixed excessive memory allocation in relative CRLDP processing. > CVE-2026-35191: Fixed QUIC unvalidated amplification credit may be over-accounted. > CVE-2026-42772: Fixed potential CPU DoS via O(n^2) fragment reassembly in QUIC. > CVE-2026-54872: Fixed a timing side-channel in scalar multiplication for mon-NIST EC curves. > CVE-2026-54873: Fixed QUIC STREAM fragment metadata DoS. > CVE-2026-54875: Fixed non-constant-time SM2 scalar multiplication on ARM64 and RISC-V. > CVE-2026-72897: Fixed out-of-bounds access after SSL_set_SSL_CTX() during a handshake. > CVE-2026-75804: Fixed QUIC connection-level flow control was not enforced for streams. > CVE-2026-75805: Fixed a NULL pointer dereference in CMP client revocation response handling. > CVE-2026-75806: Fixed an unauthenticated and undersized DTLS 1.2 AEAD record causing DoS. > CVE-2026-77696: Fixed a timing side-channel in SM2 signature generation. > CVE-2026-84784: Fixed an unbounded RETIRE_CONNECTION_ID backlog in QUIC stack implementation. > > Signed-off-by: Christian Melki > Message-Id: <20261003134426.3006946-1-christian.melki@t2data.com> > Signed-off-by: Michael Olbrich > > diff --git a/patches/openssl-3.5.8/0001-debian-targets.patch b/patches/openssl-3.5.9/0001-debian-targets.patch > similarity index 100% > rename from patches/openssl-3.5.8/0001-debian-targets.patch > rename to patches/openssl-3.5.9/0001-debian-targets.patch > diff --git a/patches/openssl-3.5.8/0002-pic.patch b/patches/openssl-3.5.9/0002-pic.patch > similarity index 100% > rename from patches/openssl-3.5.8/0002-pic.patch > rename to patches/openssl-3.5.9/0002-pic.patch > diff --git a/patches/openssl-3.5.8/0003-Configure-allow-to-enable-ktls-if-target-does-not-st.patch b/patches/openssl-3.5.9/0003-Configure-allow-to-enable-ktls-if-target-does-not-st.patch > similarity index 100% > rename from patches/openssl-3.5.8/0003-Configure-allow-to-enable-ktls-if-target-does-not-st.patch > rename to patches/openssl-3.5.9/0003-Configure-allow-to-enable-ktls-if-target-does-not-st.patch > diff --git a/patches/openssl-3.5.8/0004-conf-Serialize-allocation-free-of-ssl_names.patch b/patches/openssl-3.5.9/0004-conf-Serialize-allocation-free-of-ssl_names.patch > similarity index 100% > rename from patches/openssl-3.5.8/0004-conf-Serialize-allocation-free-of-ssl_names.patch > rename to patches/openssl-3.5.9/0004-conf-Serialize-allocation-free-of-ssl_names.patch > diff --git a/patches/openssl-3.5.8/series b/patches/openssl-3.5.9/series > similarity index 100% > rename from patches/openssl-3.5.8/series > rename to patches/openssl-3.5.9/series > diff --git a/rules/openssl.make b/rules/openssl.make > index 2c60f127a1fb..c92a7e2c0140 100644 > --- a/rules/openssl.make > +++ b/rules/openssl.make > @@ -16,8 +16,8 @@ PACKAGES-$(PTXCONF_OPENSSL) += openssl > # > # Paths and names > # > -OPENSSL_VERSION := 3.5.8 > -OPENSSL_SHA256 := a8f84a39918ec6415ce765d9b429d313ba97b8143169c172e734b9514464f5b2 > +OPENSSL_VERSION := 3.5.9 > +OPENSSL_SHA256 := 603f5602e2eef00d77fbd429d34dcd5822bb301757a1bc9cdb24c670f1eb859a > OPENSSL := openssl-$(OPENSSL_VERSION) > OPENSSL_SUFFIX := tar.gz > OPENSSL_URL := \