OpenSSL 4.0.2 is a security patch release. The most severe CVE fixed
in this release is Moderate.
This release incorporates the following bug fixes and mitigations:
Fixed QUIC server being able to trigger double free when processing
INITIAL packet.
(CVE-2026-18798)
Fixed heap buffer overflow in CMS key unwrapping.
(CVE-2026-63072)
Fixed invalid pointer dereference in CMP server via crafted protectionAlg.
(CVE-2026-63076)
Fixed unbounded memory growth in QUIC server incoming channel queue.
(CVE-2026-14456)
Fixed RPK server signature algorithm selection being able to dereference
a missing certificate.
(CVE-2026-14457)
Fixed excessive memory use buffering DTLS records for a future epoch.
(CVE-2026-54874)
Fixed client-side memory leak in OCSP response checking.
(CVE-2026-54876)
Fixed untrusted Sender DN being used as a format string in CMP response
validation.
(CVE-2026-63073)
Fixed CMP indefinite cache growth of extraCerts.
(CVE-2026-63074)
Fixed QUIC ACK-only packet retention being able to cause memory exhaustion.
(CVE-2026-63075)
Fixed possibility of AEAD forgeries with empty ciphertext when using
EVP_Cipher().
(CVE-2026-75803)
Fixed checking of authentication tags for empty ciphertexts for AEAD ciphers
in CCM cipher mode.
Signed-off-by: Richard Purdie <[email protected]>
---
.../openssl/openssl/0001-extend-check_cwm-test-timeout.patch | 2 +-
.../openssl/{openssl_4.0.1.bb => openssl_4.0.2.bb} | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
rename meta/recipes-connectivity/openssl/{openssl_4.0.1.bb =>
openssl_4.0.2.bb} (99%)
diff --git
a/meta/recipes-connectivity/openssl/openssl/0001-extend-check_cwm-test-timeout.patch
b/meta/recipes-connectivity/openssl/openssl/0001-extend-check_cwm-test-timeout.patch
index 76bc05d5f95..26622fd1b18 100644
---
a/meta/recipes-connectivity/openssl/openssl/0001-extend-check_cwm-test-timeout.patch
+++
b/meta/recipes-connectivity/openssl/openssl/0001-extend-check_cwm-test-timeout.patch
@@ -1,4 +1,4 @@
-From 14856dbd767621ce6f162680c00557b54af0effb Mon Sep 17 00:00:00 2001
+From 07bbd037ca61264bcc311856a119b664ce13f586 Mon Sep 17 00:00:00 2001
From: Gyorgy Sarvari <[email protected]>
Date: Thu, 23 Oct 2025 11:24:36 +0200
Subject: [PATCH] extend check_cwm test timeout
diff --git a/meta/recipes-connectivity/openssl/openssl_4.0.1.bb
b/meta/recipes-connectivity/openssl/openssl_4.0.2.bb
similarity index 99%
rename from meta/recipes-connectivity/openssl/openssl_4.0.1.bb
rename to meta/recipes-connectivity/openssl/openssl_4.0.2.bb
index a669de1b225..9e143b6f6ed 100644
--- a/meta/recipes-connectivity/openssl/openssl_4.0.1.bb
+++ b/meta/recipes-connectivity/openssl/openssl_4.0.2.bb
@@ -18,7 +18,7 @@ SRC_URI:append:class-nativesdk = " \
file://environment.d-openssl.sh \
"
-SRC_URI[sha256sum] =
"2db3f3a0d6ea4b59e1f094ace2c8cd536dffb87cdc39084c5afa1e6f7f37dd09"
+SRC_URI[sha256sum] =
"736b467530f916737b7031310ccb21d8218c6229e61e8e160cd1d3458cd543a8"
inherit lib_package multilib_header ptest perlnative manpages
-=-=-=-=-=-=-=-=-=-=-=-
Links: You receive all messages sent to this group.
View/Reply Online (#244984):
https://lists.openembedded.org/g/openembedded-core/message/244984
Mute This Topic: https://lists.openembedded.org/mt/121055481/21656
Group Owner: [email protected]
Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub
[[email protected]]
-=-=-=-=-=-=-=-=-=-=-=-
