From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail02.haj.ipfire.org (localhost [IPv6:::1]) by mail02.haj.ipfire.org (Postfix) with ESMTP id 4gdXZ11rLpz2ylc for ; Sun, 14 Jun 2026 12:27:05 +0000 (UTC) Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (Client CN "mail01.haj.ipfire.org", Issuer "YR2" (not verified)) by mail02.haj.ipfire.org (Postfix) with ESMTPS id 4gdXZ11fXFz2xP7 for ; Sun, 14 Jun 2026 12:27:05 +0000 (UTC) Received: from people01.haj.ipfire.org (people01.haj.ipfire.org [IPv6:2001:678:b28::161]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (Client CN "people01.haj.ipfire.org", Issuer "E8" (not verified)) by mail01.ipfire.org (Postfix) with ESMTPS id 4gdXZ05t48z12S for ; Sun, 14 Jun 2026 12:27:04 +0000 (UTC) DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003ed25519; t=1781440024; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc; bh=hvH5DhcRVHND7YtCQUte0DW9CVPSXJdJ7vCuirhQBg4=; b=6rsY0oa5CrPzQ2+3zFDBXi6F5UYaRkaKUDMfqcaqQoXPFmBReEKrD6OjnQAWCMpKXOH2+E W5iFb3oVnQPKa3DA== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003rsa; t=1781440024; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc; bh=hvH5DhcRVHND7YtCQUte0DW9CVPSXJdJ7vCuirhQBg4=; b=rCoDV3V4VeGR76hRLf8I9RyqmmU6GkvzsNN99k8lkHWEVseIppq+IUhOHgnU91LN2a+29r tPaIva6X80mJ/hjl/OIEQNE4ku6/yVADsFxYDCm30GCh1BiI7J4IUd7DiCfvIZluMT0ySw 3LsSfUbmythOT7PyVoffEgfEP8P1lIEhCxKFBoIeCiCAS3c0iX+b1HIyKWbDbDIZduiBn+ ssxSslSwcPto0MDYAb6FiUZfZmHdoCL/DYuReWoZiTBRvuc9Q/2s13i87ESPbF5WehtKPQ s2qn+igtTuigW3ZMdnhHV2DiHXxCTzP1Ea8N71qQYL6kXHEpYjDtq1AgKyHFvw== Received: by people01.haj.ipfire.org (Postfix, from userid 1000) id 4gdXZ05QdGz2xP6; Sun, 14 Jun 2026 12:27:04 +0000 (UTC) To: ipfire-scm@lists.ipfire.org Subject: [git.ipfire.org] IPFire 2.x development tree branch, master, updated. 9b7ed567ddf73cd131ff54d0d34a0d54400bcd0d X-Git-Refname: refs/heads/master X-Git-Reftype: branch X-Git-Oldrev: e9a5fbb3505de68a357a90bfce1f9965f88b3622 X-Git-Newrev: 9b7ed567ddf73cd131ff54d0d34a0d54400bcd0d Message-Id: <4gdXZ05QdGz2xP6@people01.haj.ipfire.org> Date: Sun, 14 Jun 2026 12:27:04 +0000 (UTC) From: Michael Tremer Precedence: list List-Id: List-Subscribe: , List-Unsubscribe: , List-Post: List-Help: Sender: Mail-Followup-To: This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, master has been updated via 9b7ed567ddf73cd131ff54d0d34a0d54400bcd0d (commit) via 68123f1375024c0665eaad726ef920298cabd06c (commit) from e9a5fbb3505de68a357a90bfce1f9965f88b3622 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 9b7ed567ddf73cd131ff54d0d34a0d54400bcd0d Author: Michael Tremer Date: Sun Jun 14 12:26:48 2026 +0000 core203: Shop OpenSSL Signed-off-by: Michael Tremer commit 68123f1375024c0665eaad726ef920298cabd06c Author: Adolf Belka Date: Fri Jun 12 19:30:44 2026 +0200 openssl: Update to version 3.6.3 - Update from version 3.6.2 to 3.6.3 - Update of rootfile - Changelog 3.6.3 OpenSSL 3.6.3 is a security patch release. The most severe CVE fixed in this release is High. This release incorporates the following bug fixes and mitigations: Fixed heap use-after-free in PKCS7_verify(). (CVE-2026-45447) Fixed CMS AuthEnvelopedData processing may accept forged messages. (CVE-2026-34182) Fixed unbounded memory growth in the QUIC PATH_CHALLENGE handler. (CVE-2026-34183) Fixed double-free when checking OCSP stapled response. (CVE-2026-35188) Fixed NULL pointer dereference in QUIC server initial packet handling. (CVE-2026-42764) Fixed AES-OCB IV ignored on EVP_Cipher() path. (CVE-2026-45445) Fixed possible heap buffer overflow in ASN.1 multibyte string conversion. (CVE-2026-7383) Fixed out-of-bounds read in CMS password-based decryption. (CVE-2026-9076) Fixed heap buffer over-read in ASN.1 content parsing. (CVE-2026-34180) Fixed PKCS#12 files with PBMAC1 are accepted with short HMAC keys. (CVE-2026-34181) Fixed NULL dereference in certificate verification with OCSP Checking. (CVE-2026-42765) Fixed possible NULL dereference in password-dased CMS decryption. (CVE-2026-42766) Fixed NULL pointer dereference in CRMF EncryptedValue decryption. (CVE-2026-42767) Fixed multi-RecipientInfo Bleichenbacher Oracle in CMS_decrypt() and PKCS7_decrypt(). (CVE-2026-42768) Fixed trust anchor substitution via cert/issuer typo in CMP rootCaKeyUpdate. (CVE-2026-42769) Fixed FFC-DH peer validation uses attacker-supplied q. (CVE-2026-42770) Fixed incorrect tag processing for empty messages in AES-GCM-SIV and AES-SIV modes. (CVE-2026-45446) Signed-off-by: Adolf Belka Signed-off-by: Michael Tremer ----------------------------------------------------------------------- Summary of changes: config/rootfiles/common/openssl | 6 ++++++ config/rootfiles/{oldcore/100 => core/203}/filelists/openssl | 0 lfs/openssl | 4 ++-- 3 files changed, 8 insertions(+), 2 deletions(-) copy config/rootfiles/{oldcore/100 => core/203}/filelists/openssl (100%) Difference in files: diff --git a/config/rootfiles/common/openssl b/config/rootfiles/common/openssl index bbdfd8cab..9b07e091d 100644 --- a/config/rootfiles/common/openssl +++ b/config/rootfiles/common/openssl @@ -1558,6 +1558,10 @@ usr/lib/ossl-modules/legacy.so #usr/share/man/man3/BIO_new_ssl.3ossl #usr/share/man/man3/BIO_new_ssl_connect.3ossl #usr/share/man/man3/BIO_next.3ossl +#usr/share/man/man3/BIO_nread.3ossl +#usr/share/man/man3/BIO_nread0.3ossl +#usr/share/man/man3/BIO_nwrite.3ossl +#usr/share/man/man3/BIO_nwrite0.3ossl #usr/share/man/man3/BIO_parse_hostserv.3ossl #usr/share/man/man3/BIO_pending.3ossl #usr/share/man/man3/BIO_pop.3ossl @@ -1993,10 +1997,12 @@ usr/lib/ossl-modules/legacy.so #usr/share/man/man3/CRYPTO_mem_leaks_cb.3ossl #usr/share/man/man3/CRYPTO_mem_leaks_fp.3ossl #usr/share/man/man3/CRYPTO_memcmp.3ossl +#usr/share/man/man3/CRYPTO_memdup.3ossl #usr/share/man/man3/CRYPTO_new_ex_data.3ossl #usr/share/man/man3/CRYPTO_realloc.3ossl #usr/share/man/man3/CRYPTO_realloc_array.3ossl #usr/share/man/man3/CRYPTO_realloc_fn.3ossl +#usr/share/man/man3/CRYPTO_secure_actual_size.3ossl #usr/share/man/man3/CRYPTO_secure_allocated.3ossl #usr/share/man/man3/CRYPTO_secure_calloc.3ossl #usr/share/man/man3/CRYPTO_secure_clear_free.3ossl diff --git a/config/rootfiles/core/203/filelists/openssl b/config/rootfiles/core/203/filelists/openssl new file mode 120000 index 000000000..e011a9266 --- /dev/null +++ b/config/rootfiles/core/203/filelists/openssl @@ -0,0 +1 @@ +../../../common/openssl \ No newline at end of file diff --git a/lfs/openssl b/lfs/openssl index a91e16700..ef2e5891c 100644 --- a/lfs/openssl +++ b/lfs/openssl @@ -24,7 +24,7 @@ include Config -VER = 3.6.2 +VER = 3.6.3 THISAPP = openssl-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -72,7 +72,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = 21a23c53d16e9fbfb4c6d606d6056e7bb72e15c964c43a7f02837d805584bc34917fb2527cbc7fa75de63f3b5f840c693e7b43ac95e4bf9c10dce27f130bf69f +$(DL_FILE)_BLAKE2 = 12dcbd977c3ccbeefd0310c23a8398d91395896b0d23e3e630d1318e96d650ee7dadd91c8ea1876458076b2d19d1fa72c70ae76669ce97d315aa813a0b826745 install : $(TARGET) hooks/post-receive -- IPFire 2.x development tree