Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly
Appearance settings

Commit 04d4393

Browse filesBrowse files
aduh95marco-ippolito
aduh95
authored and
marco-ippolito
committed
deps: upgrade openssl sources to openssl-3.0.19
PR-URL: #61912 Reviewed-By: Richard Lau <richard.lau@ibm.com> Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
1 parent b3d6683 commit 04d4393
Copy full SHA for 04d4393

1,861 files changed

+154,935-128,631Lines changed: 154935 additions & 128631 deletions

File tree

Expand file treeCollapse file tree
Open diff view settings
Filter options

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.
Dismiss banner
Expand file treeCollapse file tree
Open diff view settings
Collapse file

‎deps/openssl/openssl/ACKNOWLEDGEMENTS.md‎

Copy file name to clipboardExpand all lines: deps/openssl/openssl/ACKNOWLEDGEMENTS.md
+2-2Lines changed: 2 additions & 2 deletions
  • Display the source diff
  • Display the rich diff
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
1-
Acknowlegements
2-
===============
1+
Acknowledgements
2+
================
33

44
Please see our [Thanks!][] page for the current acknowledgements.
55

Collapse file

‎deps/openssl/openssl/CHANGES.md‎

Copy file name to clipboardExpand all lines: deps/openssl/openssl/CHANGES.md
+254Lines changed: 254 additions & 0 deletions
  • Display the source diff
  • Display the rich diff
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,232 @@ breaking changes, and mappings for the large list of deprecated functions.
2828

2929
[Migration guide]: https://github.com/openssl/openssl/tree/master/doc/man7/migration_guide.pod
3030

31+
### Changes between 3.0.18 and 3.0.19 [27 Jan 2026]
32+
33+
* Fixed Stack buffer overflow in CMS `AuthEnvelopedData` parsing.
34+
35+
Severity: High
36+
37+
Issue summary: Parsing CMS `AuthEnvelopedData` message with maliciously
38+
crafted AEAD parameters can trigger a stack buffer overflow.
39+
40+
Impact summary: A stack buffer overflow may lead to a crash, causing Denial
41+
of Service, or potentially remote code execution.
42+
43+
Reported by: Stanislav Fort (Aisle Research)
44+
45+
([CVE-2025-15467])
46+
47+
*Igor Ustinov*
48+
49+
* Fixed Heap out-of-bounds write in `BIO_f_linebuffer` on short writes.
50+
51+
Severity: Low
52+
53+
Issue summary: Writing large, newline-free data into a BIO chain using the
54+
line-buffering filter where the next BIO performs short writes can trigger
55+
a heap-based out-of-bounds write.
56+
57+
Impact summary: This out-of-bounds write can cause memory corruption
58+
which typically results in a crash, leading to Denial of Service for
59+
an application.
60+
61+
Reported by: Petr Simecek (Aisle Research) and Stanislav Fort (Aisle
62+
Research)
63+
64+
([CVE-2025-68160])
65+
66+
*Stanislav Fort and Neil Horman*
67+
68+
* Fixed Unauthenticated/unencrypted trailing bytes with low-level OCB
69+
function calls.
70+
71+
Severity: Low
72+
73+
Issue summary: When using the low-level OCB API directly with AES-NI or
74+
other hardware-accelerated code paths, inputs whose length is not a multiple
75+
of 16 bytes can leave the final partial block unencrypted and
76+
unauthenticated.
77+
78+
Impact summary: The trailing 1-15 bytes of a message may be exposed in
79+
cleartext on encryption and are not covered by the authentication tag,
80+
allowing an attacker to read or tamper with those bytes without detection.
81+
82+
Reported by: Stanislav Fort (Aisle Research)
83+
84+
([CVE-2025-69418])
85+
86+
*Stanislav Fort*
87+
88+
* Fixed Out of bounds write in `PKCS12_get_friendlyname()` UTF-8 conversion.
89+
90+
Severity: Low
91+
92+
Issue summary: Calling `PKCS12_get_friendlyname()` function on a maliciously
93+
crafted PKCS#12 file with a `BMPString` (UTF-16BE) friendly name containing
94+
non-ASCII BMP code point can trigger a one byte write before the allocated
95+
buffer.
96+
97+
Impact summary: The out-of-bounds write can cause a memory corruption
98+
which can have various consequences including a Denial of Service.
99+
100+
Reported by: Stanislav Fort (Aisle Research)
101+
102+
([CVE-2025-69419])
103+
104+
*Norbert Pócs*
105+
106+
* Fixed Missing `ASN1_TYPE` validation in `TS_RESP_verify_response()` function.
107+
108+
Severity: Low
109+
110+
Issue summary: A type confusion vulnerability exists in the TimeStamp
111+
Response verification code where an `ASN1_TYPE` union member is accessed
112+
without first validating the type, causing an invalid or NULL pointer
113+
dereference when processing a malformed `TimeStamp` Response file.
114+
115+
Impact summary: An application calling `TS_RESP_verify_response()`
116+
with a malformed TimeStamp Response can be caused to dereference an invalid
117+
or NULL pointer when reading, resulting in a Denial of Service.
118+
119+
Reported by: Luigino Camastra (Aisle Research)
120+
121+
([CVE-2025-69420])
122+
123+
*Bob Beck*
124+
125+
* Fixed NULL Pointer Dereference in `PKCS12_item_decrypt_d2i_ex()` function.
126+
127+
Severity: Low
128+
129+
Issue summary: Processing a malformed PKCS#12 file can trigger a NULL
130+
pointer dereference in the `PKCS12_item_decrypt_d2i_ex()` function.
131+
132+
Impact summary: A NULL pointer dereference can trigger a crash which leads
133+
to Denial of Service for an application processing PKCS#12 files.
134+
135+
Reported by: Luigino Camastra (Aisle Research)
136+
137+
([CVE-2025-69421])
138+
139+
*Luigino Camastra*
140+
141+
* Fixed Missing `ASN1_TYPE` validation in PKCS#12 parsing.
142+
143+
Severity: Low
144+
145+
Issue summary: An invalid or NULL pointer dereference can happen in
146+
an application processing a malformed PKCS#12 file.
147+
148+
Impact summary: An application processing a malformed PKCS#12 file can be
149+
caused to dereference an invalid or NULL pointer on memory read, resulting
150+
in a Denial of Service.
151+
152+
Reported by: Luigino Camastra (Aisle Research)
153+
154+
([CVE-2026-22795])
155+
156+
*Bob Beck*
157+
158+
* Fixed `ASN1_TYPE` Type Confusion in the `PKCS7_digest_from_attributes()`
159+
function.
160+
161+
Severity: Low
162+
163+
Issue summary: A type confusion vulnerability exists in the signature
164+
verification of signed PKCS#7 data where an `ASN1_TYPE` union member
165+
is accessed without first validating the type, causing an invalid or NULL
166+
pointer dereference when processing malformed PKCS#7 data.
167+
168+
Impact summary: An application performing signature verification of PKCS#7
169+
data or calling directly the `PKCS7_digest_from_attributes()` function can be
170+
caused to dereference an invalid or NULL pointer when reading, resulting in
171+
a Denial of Service.
172+
173+
Reported by: Luigino Camastra (Aisle Research)
174+
175+
([CVE-2026-22796])
176+
177+
*Bob Beck*
178+
179+
* Fixed incorrect acceptance of some malformed ECDSA signatures on s390x.
180+
<!-- https://github.com/openssl/openssl/pull/29214 -->
181+
182+
*Holger Dengler*
183+
184+
* Source code has been reformatted with `clang-format`.
185+
<!-- https://github.com/openssl/openssl/pull/29256 -->
186+
187+
*Bob Beck*
188+
189+
### Changes between 3.0.17 and 3.0.18 [30 Sep 2025]
190+
191+
* Fix Out-of-bounds read & write in RFC 3211 KEK Unwrap
192+
193+
Issue summary: An application trying to decrypt CMS messages encrypted using
194+
password based encryption can trigger an out-of-bounds read and write.
195+
196+
Impact summary: This out-of-bounds read may trigger a crash which leads to
197+
Denial of Service for an application. The out-of-bounds write can cause
198+
a memory corruption which can have various consequences including
199+
a Denial of Service or Execution of attacker-supplied code.
200+
201+
The issue was reported by Stanislav Fort (Aisle Research).
202+
203+
([CVE-2025-9230])
204+
205+
*Viktor Dukhovni*
206+
207+
* Fix Out-of-bounds read in HTTP client no_proxy handling
208+
209+
Issue summary: An application using the OpenSSL HTTP client API functions
210+
may trigger an out-of-bounds read if the "no_proxy" environment variable is
211+
set and the host portion of the authority component of the HTTP URL is an
212+
IPv6 address.
213+
214+
Impact summary: An out-of-bounds read can trigger a crash which leads to
215+
Denial of Service for an application.
216+
217+
The issue was reported by Stanislav Fort (Aisle Research).
218+
219+
([CVE-2025-9232])
220+
221+
*Stanislav Fort*
222+
223+
* Avoided a potential race condition introduced in 3.0.17, where
224+
`OSSL_STORE_CTX` kept open during lookup while potentially being used
225+
by multiple threads simultaneously, that could lead to potential crashes
226+
when multiple concurrent TLS connections are served.
227+
228+
*Matt Caswell*
229+
230+
* Secure memory allocation calls are no longer used for HMAC keys.
231+
232+
*Dr Paul Dale*
233+
234+
* `openssl req` no longer generates certificates with an empty extension list
235+
when SKID/AKID are set to `none` during generation.
236+
237+
*David Benjamin*
238+
239+
* The man page date is now derived from the release date provided
240+
in `VERSION.dat` and not the current date for the released builds.
241+
242+
*Enji Cooper*
243+
244+
* Hardened the provider implementation of the RSA public key "encrypt"
245+
operation to add a missing check that the caller-indicated output buffer
246+
size is at least as large as the byte count of the RSA modulus. The issue
247+
was reported by Arash Ale Ebrahim from SYSPWN.
248+
249+
This operation is typically invoked via `EVP_PKEY_encrypt(3)`. Callers that
250+
in fact provide a sufficiently large buffer, but fail to correctly indicate
251+
its size may now encounter unexpected errors. In applications that attempt
252+
RSA public encryption into a buffer that is too small, an out-of-bounds
253+
write is now avoided and an error is reported instead.
254+
255+
*Viktor Dukhovni*
256+
31257
### Changes between 3.0.16 and 3.0.17 [1 Jul 2025]
32258

33259
* none yet
@@ -955,6 +1181,24 @@ breaking changes, and mappings for the large list of deprecated functions.
9551181

9561182
### Changes between 3.0.0 and 3.0.1 [14 Dec 2021]
9571183

1184+
* Fixed carry bug in BN_mod_exp which may produce incorrect results on MIPS
1185+
squaring procedure. Many EC algorithms are affected, including some of the
1186+
TLS 1.3 default curves. Impact was not analyzed in detail, because the
1187+
pre-requisites for attack are considered unlikely and include reusing
1188+
private keys. Analysis suggests that attacks against RSA and DSA as a result
1189+
of this defect would be very difficult to perform and are not believed
1190+
likely. Attacks against DH are considered just feasible (although very
1191+
difficult) because most of the work necessary to deduce information about
1192+
a private key may be performed offline.
1193+
The amount of resources required for such an attack would be significant.
1194+
However, for an attack on TLS to be meaningful, the server would have
1195+
to share the DH private key among multiple clients, which is no longer
1196+
an option since CVE-2016-0701.
1197+
The issue only affects OpenSSL on MIPS platforms.
1198+
([CVE-2021-4160])
1199+
1200+
*Bernd Edlinger*
1201+
9581202
* Fixed invalid handling of X509_verify_cert() internal errors in libssl
9591203
Internally libssl in OpenSSL calls X509_verify_cert() on the client side to
9601204
verify a certificate supplied by a server. That function may return a
@@ -19962,6 +20206,16 @@ ndif
1996220206

1996320207
<!-- Links -->
1996420208

20209+
[CVE-2026-22796]: https://www.openssl.org/news/vulnerabilities.html#CVE-2026-22796
20210+
[CVE-2026-22795]: https://www.openssl.org/news/vulnerabilities.html#CVE-2026-22795
20211+
[CVE-2025-69421]: https://www.openssl.org/news/vulnerabilities.html#CVE-2025-69421
20212+
[CVE-2025-69420]: https://www.openssl.org/news/vulnerabilities.html#CVE-2025-69420
20213+
[CVE-2025-69419]: https://www.openssl.org/news/vulnerabilities.html#CVE-2025-69419
20214+
[CVE-2025-69418]: https://www.openssl.org/news/vulnerabilities.html#CVE-2025-69418
20215+
[CVE-2025-68160]: https://www.openssl.org/news/vulnerabilities.html#CVE-2025-68160
20216+
[CVE-2025-15467]: https://www.openssl.org/news/vulnerabilities.html#CVE-2025-15467
20217+
[CVE-2025-9232]: https://www.openssl.org/news/vulnerabilities.html#CVE-2025-9232
20218+
[CVE-2025-9230]: https://www.openssl.org/news/vulnerabilities.html#CVE-2025-9230
1996520219
[CVE-2024-13176]: https://www.openssl.org/news/vulnerabilities.html#CVE-2024-13176
1996620220
[CVE-2024-9143]: https://www.openssl.org/news/vulnerabilities.html#CVE-2024-9143
1996720221
[CVE-2024-6119]: https://www.openssl.org/news/vulnerabilities.html#CVE-2024-6119
Collapse file

‎deps/openssl/openssl/Configurations/50-nonstop.conf‎

Copy file name to clipboardExpand all lines: deps/openssl/openssl/Configurations/50-nonstop.conf
+2Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -167,12 +167,14 @@
167167
# Build models
168168
'nonstop-model-put' => {
169169
template => 1,
170+
disable => [ 'secure-memory' ],
170171
defines => ['_PUT_MODEL_',
171172
'_REENTRANT', '_THREAD_SUPPORT_FUNCTIONS'],
172173
ex_libs => '-lput',
173174
},
174175
'nonstop-model-spt' => {
175176
template => 1,
177+
disable => [ 'secure-memory' ],
176178
defines => ['_SPT_MODEL_',
177179
'_REENTRANT', '_ENABLE_FLOSS_THREADS'],
178180
ex_libs => '-lspt',
Collapse file

‎deps/openssl/openssl/Configurations/unix-Makefile.tmpl‎

Copy file name to clipboardExpand all lines: deps/openssl/openssl/Configurations/unix-Makefile.tmpl
+13-1Lines changed: 13 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,8 @@
33
##
44
## {- join("\n## ", @autowarntext) -}
55
{-
6+
use Time::Piece;
7+
68
use OpenSSL::Util;
79

810
our $makedep_scheme = $config{makedep_scheme};
@@ -68,6 +70,15 @@ FIPSKEY={- $config{FIPSKEY} -}
6870

6971
VERSION={- "$config{full_version}" -}
7072
VERSION_NUMBER={- "$config{version}" -}
73+
RELEASE_DATE={- my $t = localtime;
74+
if ($config{"release_date"}) {
75+
# Provide the user with a more meaningful error message
76+
# than the default internal parsing error from
77+
# `Time::Piece->strptime(..)`.
78+
eval { $t = Time::Piece->strptime($config{"release_date"}, "%d %b %Y"); } ||
79+
die "Parsing \$config{release_date} ('$config{release_date}') failed: $@";
80+
}
81+
$t->strftime("%Y-%m-%d") -}
7182
MAJOR={- $config{major} -}
7283
MINOR={- $config{minor} -}
7384
SHLIB_VERSION_NUMBER={- $config{shlib_version} -}
@@ -1540,7 +1551,8 @@ EOF
15401551
return <<"EOF";
15411552
$args{src}: $pod
15421553
pod2man --name=$name --section=$section\$(MANSUFFIX) --center=OpenSSL \\
1543-
--release=\$(VERSION) $pod >\$\@
1554+
--date=\$(RELEASE_DATE) --release=\$(VERSION) \\
1555+
$pod >\$\@
15441556
EOF
15451557
} elsif (platform->isdef($args{src})) {
15461558
#
Collapse file

‎deps/openssl/openssl/Configure‎

Copy file name to clipboardExpand all lines: deps/openssl/openssl/Configure
+3-3Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
#! /usr/bin/env perl
22
# -*- mode: perl; -*-
3-
# Copyright 2016-2025 The OpenSSL Project Authors. All Rights Reserved.
3+
# Copyright 2016-2026 The OpenSSL Project Authors. All Rights Reserved.
44
#
55
# Licensed under the Apache License 2.0 (the "License"). You may not use
66
# this file except in compliance with the License. You can obtain a copy
@@ -603,7 +603,7 @@ my @disable_cascades = (
603603
# Without shared libraries, dynamic engines aren't possible.
604604
# This is due to them having to link with libcrypto and register features
605605
# using the ENGINE functionality, and since that relies on global tables,
606-
# those *have* to be exacty the same as the ones accessed from the app,
606+
# those *have* to be exactly the same as the ones accessed from the app,
607607
# which cannot be guaranteed if shared libraries aren't present.
608608
# (note that even with shared libraries, both the app and dynamic engines
609609
# must be linked with the same library)
@@ -1792,7 +1792,7 @@ my %skipdir = ();
17921792
my %disabled_info = (); # For configdata.pm
17931793
foreach my $what (sort keys %disabled) {
17941794
# There are deprecated disablables that translate to themselves.
1795-
# They cause disabling cascades, but should otherwise not regiter.
1795+
# They cause disabling cascades, but should otherwise not register.
17961796
next if $deprecated_disablables{$what};
17971797
# The generated $disabled{"deprecated-x.y"} entries are special
17981798
# and treated properly elsewhere
Collapse file

‎deps/openssl/openssl/INSTALL.md‎

Copy file name to clipboardExpand all lines: deps/openssl/openssl/INSTALL.md
+2-2Lines changed: 2 additions & 2 deletions
  • Display the source diff
  • Display the rich diff
Original file line numberDiff line numberDiff line change
@@ -1471,7 +1471,7 @@ over the build process. Typically these should be defined prior to running
14711471

14721472
PERL
14731473
The name of the Perl executable to use when building OpenSSL.
1474-
Only needed if builing should use a different Perl executable
1474+
Only needed if building should use a different Perl executable
14751475
than what is used to run the Configure script.
14761476

14771477
RANLIB
@@ -1627,7 +1627,7 @@ working incorrectly. If you think you encountered a bug, please
16271627
Along with a short description of the bug, please provide the complete
16281628
configure command line and the relevant output including the error message.
16291629

1630-
Note: To make the output readable, pleace add a 'code fence' (three backquotes
1630+
Note: To make the output readable, please add a 'code fence' (three backquotes
16311631
` ``` ` on a separate line) before and after your output:
16321632

16331633
```

0 commit comments

Comments
0 (0)
Morty Proxy This is a proxified and sanitized view of the page, visit original site.