Change log for openssl package in openKylin

openssl (3.5.5-ok6) huanghe; urgency=medium

  * CVE-2026-34180, Heap Buffer Over-read in ASN.1 Content Parsing
  * CVE-2026-34181, PKCS#12 Files with PBMAC1 Are Accepted with Short HMAC Keys
  * CVE-2026-34182, CMS AuthEnvelopedData Processing May Accept Forged Messages
  * CVE-2026-34183, Unbounded Memory Growth in the QUIC PATH_CHALLENGE Handler
  * CVE-2026-42764, NULL pointer dereference in QUIC server initial packet handling
  * CVE-2026-42766, Possible NULL Dereference in Password-Based CMS Decryption
  * CVE-2026-42767, NULL Pointer Dereference in CRMF EncryptedValue Decryption
  * CVE-2026-42768, Multi-RecipientInfo Bleichenbacher Oracle in CMS_decrypt() and PKCS7_decrypt()
  * CVE-2026-42769, Trust-Anchor Substitution via cert/issuer Typo in CMP rootCaKeyUpdate
  * CVE-2026-42770, FFC-DH Peer Validation Uses Attacker-Supplied q
  * CVE-2026-45445, AES-OCB IV Ignored on EVP_Cipher() Path
  * CVE-2026-45446, Incorrect Tag Processing for Empty Messages in AES-GCM-SIV and AES-SIV modes
  * CVE-2026-45447, Heap Use-After-Free in OpenSSL PKCS7_verify()
  * CVE-2026-7383, Possible Heap Buffer Overflow in ASN.1 Multibyte String Conversion
  * CVE-2026-9076, Out-of-Bounds Read in CMS Password-Based Decryption

 -- songjuntao <email address hidden>  Wed, 17 Jun 2026 13:28:16 +0800

Available diffs

• diff from 3.5.5-ok5 to 3.5.5-ok6 (20.9 KiB)

openssl (3.5.5-ok5) huangge; urgency=medium

  * Fix CVE-2026-28388, fix NULL dereference when delta crl lacks crl number
    extension.
  * Fix CVE-2026-28389, fix NULL deref in [ec]dh_cms_set_shared_info.
  * Fix CVE-2026-28390, fix NULL deref in rsa_cms_decrypt.
  * Fix CVE-2026-31790, rsa_kem: validate RSA_public_encrypt() result in
    RSASVE.

 -- songjuntao <email address hidden>  Thu, 14 May 2026 13:50:24 +0800

Available diffs

• diff from 3.5.5-ok4 to 3.5.5-ok5 (6.4 KiB)

openssl (3.5.5-ok4) huanghe; urgency=medium

  * Fix CVE-2026-28387, dane_match_cert() should X509_free() on ->mcert
    instead of OPENSSL_free().
  * Fix CVE-2026-31789, avoid possible buffer overflow in buf2hex conversion

 -- songjuntao <email address hidden>  Sat, 09 May 2026 10:20:37 +0800

Available diffs

• diff from 3.5.5-ok3 to 3.5.5-ok4 (1.2 KiB)

openssl (3.5.5-ok3) huanghe; urgency=medium

  * Fix CVE-2026-2673, openssl tls1.3 server may fail to negoticate the
    expected preferred key exchange group.

 -- songjuntao <email address hidden>  Fri, 08 May 2026 16:41:48 +0800

Available diffs

• diff from 3.5.5-ok2 to 3.5.5-ok3 (6.8 KiB)

openssl (3.5.5-ok2) huanghe; urgency=medium

  * set DEB_BUILD_OPTIONS to nocheck for riscv64 platform

 -- songjuntao <email address hidden>  Fri, 17 Apr 2026 11:13:49 +0800

Available diffs

• diff from 3.5.5-ok1 to 3.5.5-ok2 (587 bytes)

openssl (3.5.5-ok1) huanghe; urgency=medium

  * rebuild source for openkylin

 -- songjuntao <email address hidden>  Fri, 03 Apr 2026 18:07:02 +0800

Available diffs

• diff from 3.2.1-ok5 to 3.5.5-ok1 (38.8 MiB)

openssl (3.2.1-ok7) nile; urgency=medium

  * Fix the CVE-2024-13176

 -- songjuntao <email address hidden>  Tue, 25 Feb 2025 14:23:13 +0800

Available diffs

• diff from 3.2.1-ok5 to 3.2.1-ok7 (30.4 KiB)
• diff from 3.2.1-ok6 to 3.2.1-ok7 (2.4 KiB)

openssl (3.2.1-ok6) nile; urgency=medium

  * Fix the CVE-2024-2511, CVE-2024-4603, CVE-2024-4741, CVE-2024-5535,
    CVE-2024-6119, CVE-2024-9143

 -- songjuntao <email address hidden>  Fri, 24 Jan 2025 11:22:34 +0800

Available diffs

• diff from 3.2.1-ok5 to 3.2.1-ok6 (28.4 KiB)

openssl (3.2.1-ok5) nile; urgency=medium

  * Non-maintainer upload.
  * Rename libraries for 64-bit time_t transition.(libssl3-->libssl3t64)

 -- wujiening <email address hidden>  Thu, 11 Jul 2024 17:11:09 +0800

Available diffs

• diff from 3.2.1-ok3 to 3.2.1-ok5 (1.7 KiB)

openssl (3.2.1-ok4) nile; urgency=medium

  * Optimize compilation time

 -- wujiening <email address hidden>  Mon, 08 Jul 2024 09:45:21 +0800

Available diffs

• diff from 3.2.1-ok3 to 3.2.1-ok4 (441 bytes)

openssl (3.2.1-ok3) nile; urgency=medium

  * Fix build with riscv64.
  * Fix riscv64 build error with undefined reference 'ra'.

 -- liwenjun <email address hidden>  Thu, 27 Jun 2024 18:26:03 +0800

Available diffs

• diff from 3.2.1-ok2 to 3.2.1-ok3 (1.1 KiB)

openssl (3.2.1-ok2) mantic-security; urgency=medium

  * aesv8-armx.pl: Avoid buffer overrread in AES-XTS decryption

 -- zhangfan <email address hidden>  Thu, 30 May 2024 10:45:57 +0800

Available diffs

• diff from 3.2.1-ok1 to 3.2.1-ok2 (865 bytes)

openssl (3.2.1-ok1) mantic-security; urgency=medium

  * rebuild source and update openssl verison to 3.2.1 for openkylin

 -- songjuntao <email address hidden>  Thu, 21 Mar 2024 11:37:25 +0800

Available diffs

• diff from 3.0.10-ok1 to 3.2.1-ok1 (3.6 MiB)

openssl (3.0.8-ok4.1) yangtze; urgency=medium

  * Re-upload.

 -- zhouganqing <email address hidden>  Wed, 06 Mar 2024 17:16:03 +0800

Available diffs

• diff from 3.0.8-ok3 to 3.0.8-ok4.1 (1.0 KiB)

openssl (3.0.10-ok1) mantic-security; urgency=medium

  * rebuild source for openKylin

 -- yuejiayuan <yuejiayuan@yuejiayuan-vmware71>  Wed, 29 Nov 2023 16:08:21 +0800

Available diffs

• diff from 3.0.8-ok3 to 3.0.10-ok1 (352.6 KiB)

openssl (3.0.8-ok3) yangtze; urgency=medium

  * Fix risc-v build error.

 -- shangxiaoyang <email address hidden>  Wed, 19 Apr 2023 17:27:20 +0800

Available diffs

• diff from 1.1.1f-ok3 to 3.0.8-ok3 (13.0 MiB)
• diff from 3.0.8-ok2 to 3.0.8-ok3 (1.0 KiB)

openssl (3.0.8-ok2) yangtze; urgency=medium

  * Fix compilation errors.

 -- shangxiaoyang <email address hidden>  Thu, 13 Apr 2023 10:27:16 +0800

Available diffs

• diff from 3.0.8-ok1 to 3.0.8-ok2 (885 bytes)

openssl (3.0.8-ok1) yangtze; urgency=medium

  * merge upstream 3.0.8.

 -- shangxiaoyang <email address hidden>  Wed, 08 Mar 2023 15:48:31 +0800

Available diffs

• diff from 3.0.2-ok2 to 3.0.8-ok1 (581.6 KiB)

openssl (3.0.2-ok2) yangtze; urgency=medium

  * Update debian/rules

 -- Luoyaoming <email address hidden>  Fri, 06 Jan 2023 21:21:08 +0800

Available diffs

• diff from 1.1.1f-ok3 to 3.0.2-ok2 (12.9 MiB)

openssl (1.1.1f-ok3) yangtze; urgency=medium

  * Update debian/rules.

 -- Luoyaoming <email address hidden>  Sun, 27 Nov 2022 19:57:17 +0800

Available diffs

• diff from 1.1.1f-ok1 (in Openkylin) to 1.1.1f-ok3 (953 bytes)

openssl (1.1.1f-ok1) yangtze; urgency=medium

  * Build for openKylin.

 -- openKylinBot <email address hidden>  Mon, 25 Apr 2022 22:03:04 +0800