Security patch release. https://github.com/openssl/openssl/releases/tag/openssl-3.5.9
Plugs CVEs: CVE-2026-84782: Fixed DTLS retransmissions of handshake messages from a stale buffer offset. CVE-2026-35189: Fixed excessive memory allocation in relative CRLDP processing. CVE-2026-35191: Fixed QUIC unvalidated amplification credit may be over-accounted. CVE-2026-42772: Fixed potential CPU DoS via O(n^2) fragment reassembly in QUIC. CVE-2026-54872: Fixed a timing side-channel in scalar multiplication for mon-NIST EC curves. CVE-2026-54873: Fixed QUIC STREAM fragment metadata DoS. CVE-2026-54875: Fixed non-constant-time SM2 scalar multiplication on ARM64 and RISC-V. CVE-2026-72897: Fixed out-of-bounds access after SSL_set_SSL_CTX() during a handshake. CVE-2026-75804: Fixed QUIC connection-level flow control was not enforced for streams. CVE-2026-75805: Fixed a NULL pointer dereference in CMP client revocation response handling. CVE-2026-75806: Fixed an unauthenticated and undersized DTLS 1.2 AEAD record causing DoS. CVE-2026-77696: Fixed a timing side-channel in SM2 signature generation. CVE-2026-84784: Fixed an unbounded RETIRE_CONNECTION_ID backlog in QUIC stack implementation. Signed-off-by: Christian Melki <[email protected]> --- .../0001-debian-targets.patch | 0 patches/{openssl-3.5.8 => openssl-3.5.9}/0002-pic.patch | 0 ...Configure-allow-to-enable-ktls-if-target-does-not-st.patch | 0 .../0004-conf-Serialize-allocation-free-of-ssl_names.patch | 0 patches/{openssl-3.5.8 => openssl-3.5.9}/series | 0 rules/openssl.make | 4 ++-- 6 files changed, 2 insertions(+), 2 deletions(-) rename patches/{openssl-3.5.8 => openssl-3.5.9}/0001-debian-targets.patch (100%) rename patches/{openssl-3.5.8 => openssl-3.5.9}/0002-pic.patch (100%) rename patches/{openssl-3.5.8 => openssl-3.5.9}/0003-Configure-allow-to-enable-ktls-if-target-does-not-st.patch (100%) rename patches/{openssl-3.5.8 => openssl-3.5.9}/0004-conf-Serialize-allocation-free-of-ssl_names.patch (100%) rename patches/{openssl-3.5.8 => openssl-3.5.9}/series (100%) diff --git a/patches/openssl-3.5.8/0001-debian-targets.patch b/patches/openssl-3.5.9/0001-debian-targets.patch similarity index 100% rename from patches/openssl-3.5.8/0001-debian-targets.patch rename to patches/openssl-3.5.9/0001-debian-targets.patch diff --git a/patches/openssl-3.5.8/0002-pic.patch b/patches/openssl-3.5.9/0002-pic.patch similarity index 100% rename from patches/openssl-3.5.8/0002-pic.patch rename to patches/openssl-3.5.9/0002-pic.patch diff --git a/patches/openssl-3.5.8/0003-Configure-allow-to-enable-ktls-if-target-does-not-st.patch b/patches/openssl-3.5.9/0003-Configure-allow-to-enable-ktls-if-target-does-not-st.patch similarity index 100% rename from patches/openssl-3.5.8/0003-Configure-allow-to-enable-ktls-if-target-does-not-st.patch rename to patches/openssl-3.5.9/0003-Configure-allow-to-enable-ktls-if-target-does-not-st.patch diff --git a/patches/openssl-3.5.8/0004-conf-Serialize-allocation-free-of-ssl_names.patch b/patches/openssl-3.5.9/0004-conf-Serialize-allocation-free-of-ssl_names.patch similarity index 100% rename from patches/openssl-3.5.8/0004-conf-Serialize-allocation-free-of-ssl_names.patch rename to patches/openssl-3.5.9/0004-conf-Serialize-allocation-free-of-ssl_names.patch diff --git a/patches/openssl-3.5.8/series b/patches/openssl-3.5.9/series similarity index 100% rename from patches/openssl-3.5.8/series rename to patches/openssl-3.5.9/series diff --git a/rules/openssl.make b/rules/openssl.make index 2c60f127a..c92a7e2c0 100644 --- a/rules/openssl.make +++ b/rules/openssl.make @@ -16,8 +16,8 @@ PACKAGES-$(PTXCONF_OPENSSL) += openssl # # Paths and names # -OPENSSL_VERSION := 3.5.8 -OPENSSL_SHA256 := a8f84a39918ec6415ce765d9b429d313ba97b8143169c172e734b9514464f5b2 +OPENSSL_VERSION := 3.5.9 +OPENSSL_SHA256 := 603f5602e2eef00d77fbd429d34dcd5822bb301757a1bc9cdb24c670f1eb859a OPENSSL := openssl-$(OPENSSL_VERSION) OPENSSL_SUFFIX := tar.gz OPENSSL_URL := \ -- 2.43.0
