Thanks, applied as 80bf2ab774e199ad9569d35418d01a619f65e6c8. Michael
[sent from post-receive hook] On Fri, 13 Feb 2026 11:02:56 +0100, Christian Melki <[email protected]> wrote: > Security bump. > https://github.com/openssl/openssl/releases/tag/openssl-3.5.5 > > Plugs CVEs: > CVE-2025-11187: Fixed Improper validation of PBMAC1 parameters in PKCS#12 MAC > verification. > CVE-2025-15467: Fixed Stack buffer overflow in CMS AuthEnvelopedData parsing. > CVE-2025-15468: Fixed NULL dereference in SSL_CIPHER_find() function on > unknown cipher ID. > CVE-2025-15469: Fixed openssl dgst one-shot codepath silently truncates > inputs >16 MiB. > CVE-2025-66199: Fixed TLS 1.3 CompressedCertificate excessive memory > allocation. > CVE-2025-68160: Fixed Heap out-of-bounds write in BIO_f_linebuffer on short > writes. > CVE-2025-69418: Fixed Unauthenticated/unencrypted trailing bytes with > low-level OCB function calls. > CVE-2025-69419: Fixed Out of bounds write in PKCS12_get_friendlyname() UTF-8 > conversion. > CVE-2025-69420: Fixed Missing ASN1_TYPE validation in > TS_RESP_verify_response() function. > CVE-2025-69421: Fixed NULL Pointer Dereference in > PKCS12_item_decrypt_d2i_ex() function. > CVE-2026-22795: Fixed Missing ASN1_TYPE validation in PKCS#12 parsing. > CVE-2026-22796: Fixed ASN1_TYPE Type Confusion in the > PKCS7_digest_from_attributes() function. > > * Forward patchset, adjusted offsets, applies cleanly. > > Signed-off-by: Christian Melki <[email protected]> > Message-Id: <[email protected]> > Signed-off-by: Michael Olbrich <[email protected]> > > diff --git a/patches/openssl-3.5.4/0001-debian-targets.patch > b/patches/openssl-3.5.5/0001-debian-targets.patch > similarity index 99% > rename from patches/openssl-3.5.4/0001-debian-targets.patch > rename to patches/openssl-3.5.5/0001-debian-targets.patch > index 8b3a60e4de2d..ad7bfa4af669 100644 > --- a/patches/openssl-3.5.4/0001-debian-targets.patch > +++ b/patches/openssl-3.5.5/0001-debian-targets.patch > @@ -6,7 +6,7 @@ Imported from openssl_3.5.2-1.debian.tar.xz > > Signed-off-by: Michael Olbrich <[email protected]> > --- > - Configurations/20-debian.conf | 163 ++++++++++++++++++++++++++++++++++ > + Configurations/20-debian.conf | 163 > ++++++++++++++++++++++++++++++++++++++++++ > 1 file changed, 163 insertions(+) > create mode 100644 Configurations/20-debian.conf > > diff --git a/patches/openssl-3.5.4/0002-pic.patch > b/patches/openssl-3.5.5/0002-pic.patch > similarity index 100% > rename from patches/openssl-3.5.4/0002-pic.patch > rename to patches/openssl-3.5.5/0002-pic.patch > diff --git > a/patches/openssl-3.5.4/0003-Configure-allow-to-enable-ktls-if-target-does-not-st.patch > > b/patches/openssl-3.5.5/0003-Configure-allow-to-enable-ktls-if-target-does-not-st.patch > similarity index 100% > rename from > patches/openssl-3.5.4/0003-Configure-allow-to-enable-ktls-if-target-does-not-st.patch > rename to > patches/openssl-3.5.5/0003-Configure-allow-to-enable-ktls-if-target-does-not-st.patch > diff --git > a/patches/openssl-3.5.4/0004-conf-Serialize-allocation-free-of-ssl_names.patch > > b/patches/openssl-3.5.5/0004-conf-Serialize-allocation-free-of-ssl_names.patch > similarity index 94% > rename from > patches/openssl-3.5.4/0004-conf-Serialize-allocation-free-of-ssl_names.patch > rename to > patches/openssl-3.5.5/0004-conf-Serialize-allocation-free-of-ssl_names.patch > index 870bc13057af..eb39b4458b72 100644 > --- > a/patches/openssl-3.5.4/0004-conf-Serialize-allocation-free-of-ssl_names.patch > +++ > b/patches/openssl-3.5.5/0004-conf-Serialize-allocation-free-of-ssl_names.patch > @@ -19,7 +19,7 @@ Signed-off-by: Michael Olbrich <[email protected]> > 1 file changed, 32 insertions(+), 3 deletions(-) > > diff --git a/crypto/conf/conf_ssl.c b/crypto/conf/conf_ssl.c > -index 84c5b2afe581..d6596e60c3b5 100644 > +index c8796715c00e..2e152a1c0c2c 100644 > --- a/crypto/conf/conf_ssl.c > +++ b/crypto/conf/conf_ssl.c > @@ -12,6 +12,7 @@ > @@ -85,7 +85,7 @@ index 84c5b2afe581..d6596e60c3b5 100644 > ssl_conf_section = CONF_imodule_get_value(md); > cmd_lists = NCONF_get_section(cnf, ssl_conf_section); > if (sk_CONF_VALUE_num(cmd_lists) <= 0) { > -@@ -77,7 +105,7 @@ static int ssl_module_init(CONF_IMODULE *md, const CONF > *cnf) > +@@ -76,7 +104,7 @@ static int ssl_module_init(CONF_IMODULE *md, const CONF > *cnf) > goto err; > } > cnt = sk_CONF_VALUE_num(cmd_lists); > @@ -94,9 +94,9 @@ index 84c5b2afe581..d6596e60c3b5 100644 > ssl_names = OPENSSL_zalloc(sizeof(*ssl_names) * cnt); > if (ssl_names == NULL) > goto err; > -@@ -126,7 +154,8 @@ static int ssl_module_init(CONF_IMODULE *md, const CONF > *cnf) > +@@ -123,7 +151,8 @@ static int ssl_module_init(CONF_IMODULE *md, const CONF > *cnf) > rv = 1; > - err: > + err: > if (rv == 0) > - ssl_module_free(md); > + ssl_module_free_unlocked(md); > diff --git a/patches/openssl-3.5.4/series b/patches/openssl-3.5.5/series > similarity index 82% > rename from patches/openssl-3.5.4/series > rename to patches/openssl-3.5.5/series > index d9889f0bb825..43d793018a2e 100644 > --- a/patches/openssl-3.5.4/series > +++ b/patches/openssl-3.5.5/series > @@ -6,4 +6,4 @@ > 0003-Configure-allow-to-enable-ktls-if-target-does-not-st.patch > 0004-conf-Serialize-allocation-free-of-ssl_names.patch > #tag:upstream --start-number 100 > -# ab24a399a1a602376760e385c08ab320 - git-ptx-patches magic > +# 737c785d3b0f99ce20c6c5dd18240f8a - git-ptx-patches magic > diff --git a/rules/openssl.make b/rules/openssl.make > index 239a2436ec60..988ff36e6188 100644 > --- a/rules/openssl.make > +++ b/rules/openssl.make > @@ -16,8 +16,8 @@ PACKAGES-$(PTXCONF_OPENSSL) += openssl > # > # Paths and names > # > -OPENSSL_VERSION := 3.5.4 > -OPENSSL_MD5 := 570a7ab371147b6ba72c6d0fed93131f > +OPENSSL_VERSION := 3.5.5 > +OPENSSL_MD5 := 9c86d929c3d1067e2c88239d7d1ce81b > OPENSSL := openssl-$(OPENSSL_VERSION) > OPENSSL_SUFFIX := tar.gz > OPENSSL_URL := \
