Hi Sylvain, Thanks for the feedback on this and info on the steps that should be taken.
For a short introduction text: wolfSSL is a TLS/DTLS and crypto library that is designed for reduced resource usage while providing post quantum crypto capabilities, the latest TLS 1.3 support, and FIPS certified crypto. The fixes back ported to bookworm are to close a TLS/DTLS authentication bypass gap with the fix for CVE-2026-93302 regarding trusted-peer CA enabled with --enable-distro, harden the DTLS 1.2 handshake against a man-in-the-middle early ChangeCipherSpec leading to a client decrypting a fake servers packets (the fake server can not decrypt the clients packets), a low severity issue with heap use-after-free during a very specific shutdown sequence and one certificate revocation fix for when OCSP and CRL are both enabled at once but the peer names no OCSP responder. Unpatched versions could be susceptible to potential authentication bypass if the CA being loaded is known due to CVE-2026-93302. Warm Regards, Jacob > On Oct 3, 2026, at 8:43 AM, Sylvain Beucler <[email protected]> wrote: > > Hello Jacob, > > On 01/10/2026 08:10, Jacob Barthelmeh wrote: >> Package: release.debian.org <http://release.debian.org/> >> <http://release.debian.org/> >> Severity: normal >> Tags: bookworm >> X-Debbugs-Cc: [email protected] >> <mailto:[email protected]> <mailto:[email protected]>, >> [email protected] <mailto:[email protected]><mailto:[email protected]> >> Control: affects -1 + src:wolfssl >> User: [email protected] >> <mailto:[email protected]> >> <mailto:[email protected]> >> Usertags: pu >> [ Reason ] >> wolfSSL 5.9.4 (uploaded to unstable as 5.9.4-1) fixes a new batch of >> CVEs. I would like to fix the ones affecting bookworm through a point >> release. > > > Thanks for this update :) > > First, we don't have point releases in bookworm. > Instead, see https://lts-team.pages.debian.net/wiki/Development.html for an > overview of the DLA process (Debian LTS Advisory), in particular targeting > 'bookworm-security'. > >> [ Impact ] >> Without the update bookworm users remain vulnerable to >> CVE-2026-93302 (High) trusted peer match ignores the public key >> CVE-2026-93304 (Med) TLS 1.2 client accepts early ChangeCipherSpec >> CVE-2026-89134 (Med) Subject CN name constraint skipped with non-DNS SAN >> (introduced by the CVE-2026-6731 fix in deb12u3) >> CVE-2026-15442 (Low) use-after-free in shutdown/read sequence >> CVE-2026-94417 (Low) CRL check skipped when no OCSP responder is named >> Checked and not affected in the bookworm build: CVE-2026-89102 (no >> status_request_v2 pending-CA code in 5.5.4), CVE-2026-89136 (RPK not in >> 5.5.4), CVE-2026-89135 (no WOLFSSL_TEMP_CA path), CVE-2026-94418 >> (WOLFSSL_SMALL_CERT_VERIFY not built), CVE-2026-94419 (built with >> NO_SESSION_CACHE_REF). CVE-2026-89133 is affected but deferred: its >> upstream fix changes the layout of the installed struct Signer. > > > Thanks, reported in the Debian security tracker at: > https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/2ddf1c1 > > The 2 CVEs not affected due to compilation options are marked <ignored>. > > For the others, ideally provide the introductory commit & version; I marked > them <not-affected> nonetheless. > > The deferred one I marked <postponed>. > >> [ Tests ] >> - Built with sbuild in a clean bookworm chroot (bookworm + >> bookworm-security). >> - ABI unchanged: soname libwolfssl.so <http://libwolfssl.so/> >> <http://libwolfssl.so/>.35 and the exported symbol set of >> the new library are identical to 5.5.4-2+deb12u3 (3180 symbols); >> debian/libwolfssl35.symbols is unchanged. >> - testwolfcrypt passes. >> - --enable-all API test suite (785 tests), each test run individually >> against the unpatched deb12u3 source and the patched source: identical >> pass/fail results for every test (the existing failures are >> environmental and occur without these patches too). >> [ Risks ] >> Minimal backports of upstream fixes, no upstream version or ABI change. >> Two fixes had to be adapted to 5.5.4 without the upstream refactors they >> build on (noted in each patch's DEP-3 header): >> - CVE-2026-93302: upstream replaces the TrustedPeerCert fields with a >> certificate hash; to keep the installed struct layout this stores the >> whole certificate DER in the existing sig buffer and requires an exact >> match instead. >> - CVE-2026-94417: 5.5.4 has no OCSP_NO_URL/OcspNoUrlPolicy(), so the >> no-responder case is detected from the certificate's AIA field. > > > OK good. Ideally please include these backport notes in the patch themselves > for future reference. > > >> [ Checklist ] >> [x] *all* changes are documented in the d/changelog >> [x] I reviewed all changes and I approve them >> [x] attach debdiff against the package in oldstable >> [x] the issue is verified as fixed in unstable >> [ Changes ] >> * CVE-2026-93302: require trusted peer certificates to match byte for >> byte. >> * CVE-2026-93304: reject ChangeCipherSpec before ClientKeyExchange is >> sent. >> * CVE-2026-15442: fix use-after-free in TLS shutdown/ReceiveData >> sequences. >> * CVE-2026-94417: check the CRL when a certificate names no OCSP >> responder. >> * CVE-2026-89134: apply Subject CN name constraints unless a dNSName >> SAN is present. >> Attachment: wolfssl_5.5.4-2+deb12u4.debdiff > > > Overall this is good. > > As Bastian noted at https://bugs.debian.org/1149565 , this should be fixed in > unstable first, and the trixie SPU would need to be reviewed/approved too. > > Then I'd suggest Bastian upload this new version to bookworm-security, and we > can take care of registering and announcing the DLA right after (or Bastian > can do that too). If you have a short introduction text for the update (about > wolfssl and the impact of the fixed vulnerabilities) that can help as well. > > Cheers! > Sylvain Beucler > Debian LTS Team
