On Fri Aug 14, 2026 at 7:18 AM CEST, Jaipaul Cheernam wrote: > Upgrade OpenSSL from 3.5.7 to 4.0.1. This is a major version upgrade. > > Changelog: https://github.com/openssl/openssl/blob/openssl-4.0.1/CHANGES.md > > New CVE fixes not already in 3.5.7: > * CVE-2026-28386: Fixed OOB read in AES-CFB-128 on x86-64 with AVX-512 > * CVE-2026-35188: Fixed double-free when checking OCSP stapled response > * CVE-2026-42765: Fixed NULL deref in cert verification with OCSP > * CVE-2026-42771: Fixed OOB read in X509_VERIFY_PARAM_set1_email() > > Major breaking changes in 4.0.0: > * Removed support for engines. The ENGINE API is fully removed. > * Removed support for SSLv3. SSLv3 has been deprecated since 2015. > * Removed support for the SSLv2 Client Hello. > * Removed per-version TLS method functions (SSLv3_method(), > TLSv1_method(), TLSv1_1_method(), TLSv1_2_method()). > * Removed c_rehash script tool. Use 'openssl rehash' instead. > * ASN1_STRING has been made opaque. > * Numerous API function signatures changed to include const qualifiers. > * libcrypto no longer cleans up globally allocated data via atexit(). > * Added AKID verification checks when X509_V_FLAG_X509_STRICT is set. > * Support of deprecated elliptic curves in TLS disabled at compile-time > by default. > > Recipe changes: > * Drop 0001-Added-handshake-history-reporting-when-test-fails.patch > (merged upstream via PR #22481). > * Refresh remaining patches against the new version. > * Remove ENGINE API artifacts: engines package, dasync.so/ossltest.so > ptest installation, ENGINESDIR references, OPENSSL_ENGINES wrapper > variable, and cryptodev-linux PACKAGECONFIG. > > Tested: ptest on qemux86-64: > Files=362, Tests=4310, Result: PASS > Passed: 338, Skipped: 24 (fips, lms, rc5, tfo, compression, > sslversions, sslkeylogfile, external tests - all expected) > Failed: 0 >
Hi Jaipaul, Thanks for your patch. I gave it a go on the autobuilder, and we can see some build issues. A first one (multilib related ?): ERROR: lib32-openssl-4.0.1-r0 do_package: Execution of '/srv/pokybuild/yocto-worker/multilib/build/build/tmp/work/x86-pokymllib32-linux/lib32-openssl/4.0.1/temp/run.multilibscript_rename.3735101' failed with exit code 1 ... | mv: cannot stat '/srv/pokybuild/yocto-worker/multilib/build/build/tmp/work/x86-pokymllib32-linux/lib32-openssl/4.0.1/package/usr/bin/c_rehash': No such file or directory | WARNING: exit code 1 from a shell command. | DEBUG: Python function do_package finished NOTE: recipe lib32-openssl-4.0.1-r0: task do_package: Failed ERROR: Task (virtual:multilib:lib32:/srv/pokybuild/yocto-worker/multilib/build/layers/openembedded-core/meta/recipes-connectivity/openssl/openssl_4.0.1.bb:do_package) failed with exit code '1' https://autobuilder.yoctoproject.org/valkyrie/#/builders/92/builds/4374 https://autobuilder.yoctoproject.org/valkyrie/#/builders/92/builds/4374 And a second one: ERROR: openssl-4.0.1-r0 do_compile: Execution of '/srv/pokybuild/yocto-worker/qemux86-alt/build/build/tmp/work/core2-32-poky-linux/openssl/4.0.1/temp/run.do_compile.3557282' failed with exit code 1 ... | ../sources/openssl-4.0.1/providers/implementations/keymgmt/ml_kem_kmgmt.c:25:10: fatal error: prov/der_wrap.h: No such file or directory | 25 | #include "prov/der_wrap.h" | | ^~~~~~~~~~~~~~~~~ | compilation terminated. https://autobuilder.yoctoproject.org/valkyrie/#/builders/20/builds/4341 Thanks, Mathieu -- Mathieu Dubois-Briand, Bootlin Embedded Linux and Kernel engineering https://bootlin.com
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#243497): https://lists.openembedded.org/g/openembedded-core/message/243497 Mute This Topic: https://lists.openembedded.org/mt/120745096/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
