[git.ipfire.org] IPFire 2.x development tree branch, master, updated. 9b7ed567ddf73cd131ff54d0d34a0d54400bcd0d

[git.ipfire.org] IPFire 2.x development tree branch, master, updated. 9b7ed567ddf73cd131ff54d0d34a0d54400bcd0d

[Michael Tremer]

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "IPFire 2.x development tree".

The branch, master has been updated
       via  9b7ed567ddf73cd131ff54d0d34a0d54400bcd0d (commit)
       via  68123f1375024c0665eaad726ef920298cabd06c (commit)
      from  e9a5fbb3505de68a357a90bfce1f9965f88b3622 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 9b7ed567ddf73cd131ff54d0d34a0d54400bcd0d
Author: Michael Tremer <michael.tremer@ipfire.org>
Date:   Sun Jun 14 12:26:48 2026 +0000

    core203: Shop OpenSSL
    
    Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

commit 68123f1375024c0665eaad726ef920298cabd06c
Author: Adolf Belka <adolf.belka@ipfire.org>
Date:   Fri Jun 12 19:30:44 2026 +0200

    openssl: Update to version 3.6.3
    
    - Update from version 3.6.2 to 3.6.3
    - Update of rootfile
    - Changelog
    3.6.3
    OpenSSL 3.6.3 is a security patch release. The most severe CVE fixed
    in this release is High.
    This release incorporates the following bug fixes and mitigations:
        Fixed heap use-after-free in PKCS7_verify().
    	(CVE-2026-45447)
        Fixed CMS AuthEnvelopedData processing may accept forged messages.
    	(CVE-2026-34182)
        Fixed unbounded memory growth in the QUIC PATH_CHALLENGE handler.
    	(CVE-2026-34183)
        Fixed double-free when checking OCSP stapled response.
    	(CVE-2026-35188)
        Fixed NULL pointer dereference in QUIC server initial packet handling.
    	(CVE-2026-42764)
        Fixed AES-OCB IV ignored on EVP_Cipher() path.
    	(CVE-2026-45445)
        Fixed possible heap buffer overflow in ASN.1 multibyte string conversion.
    	(CVE-2026-7383)
        Fixed out-of-bounds read in CMS password-based decryption.
    	(CVE-2026-9076)
        Fixed heap buffer over-read in ASN.1 content parsing.
    	(CVE-2026-34180)
        Fixed PKCS#12 files with PBMAC1 are accepted with short HMAC keys.
    	(CVE-2026-34181)
        Fixed NULL dereference in certificate verification with OCSP Checking.
    	(CVE-2026-42765)
        Fixed possible NULL dereference in password-dased CMS decryption.
    	(CVE-2026-42766)
        Fixed NULL pointer dereference in CRMF EncryptedValue decryption.
    	(CVE-2026-42767)
        Fixed multi-RecipientInfo Bleichenbacher Oracle in CMS_decrypt()
        and PKCS7_decrypt().
    	(CVE-2026-42768)
        Fixed trust anchor substitution via cert/issuer typo in CMP
        rootCaKeyUpdate.
    	(CVE-2026-42769)
        Fixed FFC-DH peer validation uses attacker-supplied q.
    	(CVE-2026-42770)
        Fixed incorrect tag processing for empty messages in AES-GCM-SIV
        and AES-SIV modes.
    	(CVE-2026-45446)
    
    Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
    Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

-----------------------------------------------------------------------

Summary of changes:
 config/rootfiles/common/openssl                              | 6 ++++++
 config/rootfiles/{oldcore/100 => core/203}/filelists/openssl | 0
 lfs/openssl                                                  | 4 ++--
 3 files changed, 8 insertions(+), 2 deletions(-)
 copy config/rootfiles/{oldcore/100 => core/203}/filelists/openssl (100%)

Difference in files:
diff --git a/config/rootfiles/common/openssl b/config/rootfiles/common/openssl
index bbdfd8cab..9b07e091d 100644
--- a/config/rootfiles/common/openssl
+++ b/config/rootfiles/common/openssl
@@ -1558,6 +1558,10 @@ usr/lib/ossl-modules/legacy.so
 #usr/share/man/man3/BIO_new_ssl.3ossl
 #usr/share/man/man3/BIO_new_ssl_connect.3ossl
 #usr/share/man/man3/BIO_next.3ossl
+#usr/share/man/man3/BIO_nread.3ossl
+#usr/share/man/man3/BIO_nread0.3ossl
+#usr/share/man/man3/BIO_nwrite.3ossl
+#usr/share/man/man3/BIO_nwrite0.3ossl
 #usr/share/man/man3/BIO_parse_hostserv.3ossl
 #usr/share/man/man3/BIO_pending.3ossl
 #usr/share/man/man3/BIO_pop.3ossl
@@ -1993,10 +1997,12 @@ usr/lib/ossl-modules/legacy.so
 #usr/share/man/man3/CRYPTO_mem_leaks_cb.3ossl
 #usr/share/man/man3/CRYPTO_mem_leaks_fp.3ossl
 #usr/share/man/man3/CRYPTO_memcmp.3ossl
+#usr/share/man/man3/CRYPTO_memdup.3ossl
 #usr/share/man/man3/CRYPTO_new_ex_data.3ossl
 #usr/share/man/man3/CRYPTO_realloc.3ossl
 #usr/share/man/man3/CRYPTO_realloc_array.3ossl
 #usr/share/man/man3/CRYPTO_realloc_fn.3ossl
+#usr/share/man/man3/CRYPTO_secure_actual_size.3ossl
 #usr/share/man/man3/CRYPTO_secure_allocated.3ossl
 #usr/share/man/man3/CRYPTO_secure_calloc.3ossl
 #usr/share/man/man3/CRYPTO_secure_clear_free.3ossl
diff --git a/config/rootfiles/core/203/filelists/openssl b/config/rootfiles/core/203/filelists/openssl
new file mode 120000
index 000000000..e011a9266
--- /dev/null
+++ b/config/rootfiles/core/203/filelists/openssl
@@ -0,0 +1 @@
+../../../common/openssl
\ No newline at end of file
diff --git a/lfs/openssl b/lfs/openssl
index a91e16700..ef2e5891c 100644
--- a/lfs/openssl
+++ b/lfs/openssl
@@ -24,7 +24,7 @@
 
 include Config
 
-VER        = 3.6.2
+VER        = 3.6.3
 
 THISAPP    = openssl-$(VER)
 DL_FILE    = $(THISAPP).tar.gz
@@ -72,7 +72,7 @@ objects = $(DL_FILE)
 
 $(DL_FILE) = $(DL_FROM)/$(DL_FILE)
 
-$(DL_FILE)_BLAKE2 = 21a23c53d16e9fbfb4c6d606d6056e7bb72e15c964c43a7f02837d805584bc34917fb2527cbc7fa75de63f3b5f840c693e7b43ac95e4bf9c10dce27f130bf69f
+$(DL_FILE)_BLAKE2 = 12dcbd977c3ccbeefd0310c23a8398d91395896b0d23e3e630d1318e96d650ee7dadd91c8ea1876458076b2d19d1fa72c70ae76669ce97d315aa813a0b826745
 
 install : $(TARGET)
 


hooks/post-receive
--
IPFire 2.x development tree