[openssl/openssl] d32350: Reject oversized inputs in ASN1_mbstring_ncopy()

  Branch: refs/heads/openssl-4.0
  Home:   https://github.com/openssl/openssl
  Commit: d32350ae8ef7426718f5aa9e383d4b51398ee255
      https://github.com/openssl/openssl/commit/d32350ae8ef7426718f5aa9e383d4b51398ee255
  Author: Viktor Dukhovni <[email protected]>
  Date:   2026-06-08 (Mon, 08 Jun 2026)

  Changed paths:
    M crypto/asn1/a_mbstr.c

  Log Message:
  -----------
  Reject oversized inputs in ASN1_mbstring_ncopy()

In ASN1_mbstring_ncopy() the destination size for BMPSTRING and
UNIVERSALSTRING output was computed by a signed left shift on an
int:

    outlen = nchar << 1;        /* MBSTRING_BMP  */
    outlen = nchar << 2;        /* MBSTRING_UNIV */

For nchar large enough the result is not representable in int.  In
the worst case (nchar == 0x40000000) nchar << 2 wraps to zero,
OPENSSL_malloc(1) is called, and traverse_string() then writes
4*nchar bytes into the one-byte allocation: a heap buffer
overflow.  The MBSTRING_UTF8 path computes outlen by summing
per-character byte counts in out_utf8(), and that sum can overflow
the same int under similarly large inputs.

Neither path is reachable from code that processes X.509
certificates through the DIRSTRING_TYPE mask used by
ASN1_STRING_set_by_NID(): UNIVERSALSTRING is absent from that
mask, and the UTF-8 sum requires inputs on the order of half a
gigabyte.  Reaching them needs an application that calls
ASN1_mbstring_copy()/ASN1_mbstring_ncopy() directly, or registers
a custom NID via ASN1_STRING_TABLE_add(), with an oversized
attacker-controlled input.

Add range checks before each shift and in out_utf8(), raising
ASN1_R_STRING_TOO_LONG at the point of detection.  Move the
existing ASN1_R_INVALID_UTF8STRING raise into out_utf8() too so
the two failure modes report distinct codes; the MBSTRING_UTF8
caller is left with cleanup only and now frees dest on error,
matching the BMP/UNIV branches.

Fixes CVE-2026-7383

Reviewed-by: Nikola Pajkovsky <[email protected]>
Reviewed-by: Norbert Pocs <[email protected]>
Reviewed-by: Daniel Kubec <[email protected]>
MergeDate: Mon Jun  8 13:59:47 2026


  Commit: 3d8d5bc1056b2f62da9fede23fedbf47e85187b0
      https://github.com/openssl/openssl/commit/3d8d5bc1056b2f62da9fede23fedbf47e85187b0
  Author: Nikola Pajkovsky <[email protected]>
  Date:   2026-06-08 (Mon, 08 Jun 2026)

  Changed paths:
    M crypto/cms/cms_pwri.c

  Log Message:
  -----------
  cms: kek_unwrap_key: Fix out-of-bounds read in check-byte validation

the check-byte test in kek_unwrap_key() reads tmp[1] through tmp[6]
unconditionally, so the decrypted buffer must hold at least seven
octets. The pre-decryption size check enforces inlen >= 2 * blocklen,
which yields the required seven octets only when blocklen >= 4. For
a KEK cipher with a smaller block size, inlen can be as small as
2 * blocklen and the check-byte read overruns the inlen-sized tmp
allocation.

Reject blocklen < 4 in the early sanity check. All block ciphers
appropriate for CMS PasswordRecipientInfo key wrapping have a block
size of at least 8 octets (DES/3DES = 8, AES = 16), so this only
forbids ciphers that would not be valid KEK choices anyway, and the
existing inlen >= 2 * blocklen check then guarantees the seven-octet
lower bound the check-byte test relies on.

Fixes CVE-2026-9076

Signed-off-by: Nikola Pajkovsky <[email protected]>

Reviewed-by: Daniel Kubec <[email protected]>
Reviewed-by: Milan Broz <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
MergeDate: Mon Jun  8 14:06:36 2026
(cherry picked from commit 1a653f2176434e6ec94f4b70e6796e911a3e607f)


  Commit: 501b45b8fe097c0f9556131e01ab6269ff0061e4
      https://github.com/openssl/openssl/commit/501b45b8fe097c0f9556131e01ab6269ff0061e4
  Author: Nikola Pajkovsky <[email protected]>
  Date:   2026-06-08 (Mon, 08 Jun 2026)

  Changed paths:
    M test/cmsapitest.c
    M test/recipes/80-test_cmsapi.t
    A test/recipes/80-test_cmsapi_data/cms_pwri_kek_oob.der

  Log Message:
  -----------
  cms: kek_unwrap_key: test for fix out-of-bounds read in check-byte validation

added EnvelopedData blob with a PasswordRecipientInfo using
id-alg-PWRI-KEK and an AES-128-CFB key encryption cipher. CFB's 1-byte
effective block size let the inlen >= 2 * blocklen guard in
kek_unwrap_key() accept a wrapped key shorter than the seven octets
the check-byte test reads from tmp[1..6]; the encryptedKey OCTET
STRING here is only two bytes.

Signed-off-by: Nikola Pajkovsky <[email protected]>

Reviewed-by: Daniel Kubec <[email protected]>
Reviewed-by: Milan Broz <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
MergeDate: Mon Jun  8 14:06:38 2026
(cherry picked from commit fd1e1078df9e68affcaaa88be75e343c1db3d1a4)


  Commit: f696c73c3e61b8c502d040af62e690c060908a16
      https://github.com/openssl/openssl/commit/f696c73c3e61b8c502d040af62e690c060908a16
  Author: Viktor Dukhovni <[email protected]>
  Date:   2026-06-08 (Mon, 08 Jun 2026)

  Changed paths:
    M crypto/asn1/tasn_dec.c

  Log Message:
  -----------
  Avoid length truncation in ASN1_STRING_set

The ASN1_STRING_set() function takes an `int` length, make sure the
argument is not inadvertently truncated when it is called from
asn1_ex_c2i().

Fixes CVE-2026-34180

Reviewed-by: Nikola Pajkovsky <[email protected]>
Reviewed-by: Norbert Pocs <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
MergeDate: Mon Jun  8 14:13:56 2026
(cherry picked from commit 5f525cace61a53311ee533374919356c700847d9)


  Commit: 0300eb9ddce7a0895bf301a4b0c03a9da2313a0f
      https://github.com/openssl/openssl/commit/0300eb9ddce7a0895bf301a4b0c03a9da2313a0f
  Author: Alicja Kario <[email protected]>
  Date:   2026-06-08 (Mon, 08 Jun 2026)

  Changed paths:
    M crypto/pkcs12/p12_mutl.c
    M test/recipes/80-test_pkcs12.t
    A test/recipes/80-test_pkcs12_data/pbmac1_256_256.bad-key-len.p12
    A test/recipes/80-test_pkcs12_data/pbmac1_256_256.good-shorter-key-len.p12

  Log Message:
  -----------
  pkcs12: verify that the pbmac1 key length is safe

Short mac keys (as short as 1 byte) can be used to probe the
system under attack to accept a PKCS#12 file created by an attacker
even if the attacker doesn't know the password used for MAC protection.

Fixes CVE-2026-34181

(also update the reference to the PBMAC1 PKCS#12 RFC)

Signed-off-by: Alicja Kario <[email protected]>

Reviewed-by: Dmitry Belyavskiy <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
MergeDate: Mon Jun  8 14:18:59 2026
(cherry picked from commit 84d226e59bbe4e72b73d855a1d6c8795130bc851)


  Commit: 9fd97f8cfdc2c0be214998de3b2b55c8edf6c7ac
      https://github.com/openssl/openssl/commit/9fd97f8cfdc2c0be214998de3b2b55c8edf6c7ac
  Author: Neil Horman <[email protected]>
  Date:   2026-06-08 (Mon, 08 Jun 2026)

  Changed paths:
    M crypto/cms/cms_enc.c

  Log Message:
  -----------
  Reject potentially forged encrypted CMS AuthEnvelopedData messages

1. Adjust ossl_cms_EncryptedContent_init_bio to not accept non-AEAD
ciphers.

If a forged CMS message with AuthEnvelopedData is received with
a non-AEAD cipher specified, we silently accept that and decrypt
the message, skipping any authentication, which violates RFC 5083.

We also add checks to ensure we fail if we try to encrypt
AuthEnvelopedData without using an AEAD cipher.

2. Ensure that tag lengths on cms AEAD data is the recommended size.

RFC 5084 recommends that mac tags be at least 12 bytes for AES-GCM
and 4 bytes for AES-CCM on AuthEnvelopedData. As this code is not
algorith-specific we add a check for a minimal size and just use the
lower limit which is sufficient to prevent this attack.

Without this check, its possible to set the tag length to 1 and within
256 guesses, forge a CMS message.

Fixes CVE-2026-34182

Reviewed-by: Norbert Pocs <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
MergeDate: Mon Jun  8 14:27:02 2026
(cherry picked from commit b9258b3ed7304cc2f749f79a09d18602fd51a4a2)


  Commit: 5a5963bbce8e47da3b1e2e121d2cb17473193f13
      https://github.com/openssl/openssl/commit/5a5963bbce8e47da3b1e2e121d2cb17473193f13
  Author: Neil Horman <[email protected]>
  Date:   2026-06-08 (Mon, 08 Jun 2026)

  Changed paths:
    M test/cmsapitest.c

  Log Message:
  -----------
  Add tests for CVE-2026-34182

Test to ensure that for a given CMS message:

1) We do not allow the creation of a CMS message containing
   AuthEnvelopedData with a non-AEAD cipher.
2) We do not accept a message containing AuthEnvelopedData with a
   non-AEAD cipher specified in the AlgorithmIdentifier.
3) We do not allow tag lengths less that 4 bytes.

Reviewed-by: Norbert Pocs <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
MergeDate: Mon Jun  8 14:27:03 2026
(cherry picked from commit d11787af723d8230f98a34d9ba5e43229982795a)


  Commit: fbaa83859c01ad64f497b757aaf51be7d05ed9eb
      https://github.com/openssl/openssl/commit/fbaa83859c01ad64f497b757aaf51be7d05ed9eb
  Author: Alexandr Nedvedicky <[email protected]>
  Date:   2026-06-08 (Mon, 08 Jun 2026)

  Changed paths:
    M include/internal/quic_cfq.h
    M include/internal/quic_channel.h
    M include/internal/quic_fifd.h
    M ssl/quic/quic_cfq.c
    M ssl/quic/quic_channel.c
    M ssl/quic/quic_channel_local.h
    M ssl/quic/quic_fifd.c
    M ssl/quic/quic_rx_depack.c
    M ssl/quic/quic_txp.c

  Log Message:
  -----------
  QUIC stack must limit the number of PATH_CHALLENGE frames processed in RX

Currently local QUIC stack allocates PATH_RESPONSE frame for every
PATH_CHALLENGE frame it receives in single packet from its remote peer.
The memory with PATH_RESPONSE frame is released after local QUIC stack
receives an ACK which confirms reception of PATH_RESPONSE by remote peer.
This gives remote peer too much control over memory resources local
QUIC stack may consume.

Quoting RFC 9000 section 9.2.1:
	...an endpoint SHOULD NOT send multiple
	PATH_CHALLENGE frames in a single packet.

Limiting the number of PATCH_CHALLENGE frames to 1 per QUIC packet received
helps to reduce heap memory overhead required to process PATH_CHALLENGE
frame.

Currently QUIC ACKM (ACK-manager) keeps all frames in retransmission
buffer until ACK is received. It can be changed such frames which
don't need to be ACKed don't need to be kept in retrans buffer,
those can be released right after transmission.

Fixes CVE-2026-34183

Reviewed-by: Nikola Pajkovsky <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
MergeDate: Mon Jun  8 14:38:28 2026


  Commit: 955d15f2e515559f63590da1d106e3a38c6a502e
      https://github.com/openssl/openssl/commit/955d15f2e515559f63590da1d106e3a38c6a502e
  Author: Alexandr Nedvedicky <[email protected]>
  Date:   2026-06-08 (Mon, 08 Jun 2026)

  Changed paths:
    M include/internal/quic_channel.h
    M ssl/quic/quic_channel.c
    M ssl/quic/quic_channel_local.h
    M ssl/quic/quic_rx_depack.c
    M test/radix/quic_tests.c

  Log Message:
  -----------
  Add test for path challenge flood mitigation

Client injects 16 path challenge frames. Those are received
by server. Only one challenge frame of 16 received triggers
path challenge response. Remaining challenge frames are
discrded/ignored.

Test introduces two counters to channel object:
  - path_challenge_rx which is bumped for every patch challenge
  frame received

  - path_response_tx which is bumped for every path response
  frame transmitted

Succesuful test verifies server receives 16 path challenge frames,
but sends just one path response frmae as response.

Reviewed-by: Nikola Pajkovsky <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
MergeDate: Mon Jun  8 14:38:29 2026


  Commit: 78d0154cffda03aaaac63a087cc523a6b35fa8fd
      https://github.com/openssl/openssl/commit/78d0154cffda03aaaac63a087cc523a6b35fa8fd
  Author: Daniel Kubec <[email protected]>
  Date:   2026-06-08 (Mon, 08 Jun 2026)

  Changed paths:
    M crypto/x509/x509_vfy.c

  Log Message:
  -----------
  Fix Double-free When Checking OCSP Stapled Response

If OCSP stapling is enabled and the TLS client connects to a malicious server,
a crafted OCSP stapled response can trigger a double free in the TLS client
when the stapled response is checked.

The OCSP stapling is not enabled by default. Reliable code execution
through a double-free is technically complex and highly environment-dependent
but the Denial of Service impact is straightforward to achieve, warranting
Moderate severity.

Fixes CVE-2026-35188

Reviewed-by: Neil Horman <[email protected]>
Reviewed-by: Eugene Syromiatnikov <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
MergeDate: Mon Jun  8 14:44:58 2026
(cherry picked from commit ac4b7adc4e8208b27a12b2e345b067ca49e3c451)


  Commit: bf29a458c1a231eca87e384c62b9c2553fa57a91
      https://github.com/openssl/openssl/commit/bf29a458c1a231eca87e384c62b9c2553fa57a91
  Author: Alexandr Nedvedicky <[email protected]>
  Date:   2026-06-08 (Mon, 08 Jun 2026)

  Changed paths:
    M ssl/quic/quic_port.c

  Log Message:
  -----------
  Fix NULL dereference in QUIC address validation

QUIC server crashes when address validation (RFC 9000, Section 8.1)
is disabled and client sends initial packet with invalid token.

Issue reported and fix submitted by Sunwoo Lee (KENTECH),
Hyuk Lim (KENTECH) and Seunghyun Yoon (KENTECH)

Fixes CVE-2026-42764

Reviewed-by: Norbert Pocs <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
MergeDate: Mon Jun  8 14:50:48 2026
(cherry picked from commit e74289062ca6ff778807aa79c03eae4cfc9635b7)


  Commit: 14340b7fa1d444615486bc137014b064e64ec334
      https://github.com/openssl/openssl/commit/14340b7fa1d444615486bc137014b064e64ec334
  Author: Daniel Kubec <[email protected]>
  Date:   2026-06-08 (Mon, 08 Jun 2026)

  Changed paths:
    M crypto/x509/x509_vfy.c

  Log Message:
  -----------
  Fix NULL Dereference in Certificate Verification with OCSP Checking

When performing OCSP response checking for certificates in the verification
chain, the code always tries to access the next certificate as the issuer.
There is a check for a self-signed certificate. However with the partial
chain verification enabled when the chain does not have a self-signed trusted
anchor, the issuer will be NULL for the last certificate in the chain. A NULL
pointer dereference then happens.

This issue affects only applications which enable both OCSP verification
of the certificate chain (X509_V_FLAG_OCSP_RESP_CHECK_ALL) and partial
chain verification (X509_V_FLAG_PARTIAL_CHAIN) in the certificate
verification. Both flags are disabled by default. For that reason, we have
assigned Low severity to the issue.

Fixes CVE-2026-42765

Reviewed-by: Neil Horman <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
MergeDate: Mon Jun  8 18:55:29 2026
(cherry picked from commit 1b5b3379bad0aaff7ed21096c28872dc19ad3cbc)


  Commit: 12bc26ffb3a2be728c9b86e1cae277de5b33dfa4
      https://github.com/openssl/openssl/commit/12bc26ffb3a2be728c9b86e1cae277de5b33dfa4
  Author: Igor Ustinov <[email protected]>
  Date:   2026-06-08 (Mon, 08 Jun 2026)

  Changed paths:
    M crypto/cms/cms_pwri.c

  Log Message:
  -----------
  Fix potential NULL dereference processing CMS PasswordRecipientInfo

Avoid NULL dereferencing when keyDerivationAlgorithm is absent
in CMS PasswordRecipientInfo.

Fixes CVE-2026-42766

Reviewed-by: Eugene Syromiatnikov <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
MergeDate: Mon Jun  8 18:57:52 2026
(cherry picked from commit f019b72c589071a73acda9812775389a857884c9)


  Commit: 72fecdef656deca8119dda2d87e2618fcaf7b912
      https://github.com/openssl/openssl/commit/72fecdef656deca8119dda2d87e2618fcaf7b912
  Author: Igor Ustinov <[email protected]>
  Date:   2026-06-08 (Mon, 08 Jun 2026)

  Changed paths:
    A test/cms-msg/make_missing_kdf_der.py
    A test/cms-msg/missing-kdf.der
    M test/recipes/80-test_cms.t

  Log Message:
  -----------
  Test for CVE-2026-42766

The script make_missing_kdf_der.py was developed by Mayank Jangid
and Kushal Khemka.

Co-Authored-by: Mayank Jangid <[email protected]>
Co-Authored-by: Kushal Khemka <[email protected]>

Reviewed-by: Eugene Syromiatnikov <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
MergeDate: Mon Jun  8 18:57:53 2026
(cherry picked from commit 7020987c162fe81e12e10101dd32f57bdfc7ff5e)


  Commit: f04b377be3d821741c86d1f4bf84dee09f3d5c3e
      https://github.com/openssl/openssl/commit/f04b377be3d821741c86d1f4bf84dee09f3d5c3e
  Author: Dmitry Belyavskiy <[email protected]>
  Date:   2026-06-08 (Mon, 08 Jun 2026)

  Changed paths:
    M crypto/cms/cms_env.c
    M crypto/pkcs7/pk7_doit.c
    M doc/man3/CMS_decrypt.pod
    M doc/man3/PKCS7_decrypt.pod

  Log Message:
  -----------
  Enforce implicit rejection for CMS/PKCS#7 decryption

Drop the disablement of the implicit rejection for RSA PKCS#1 v1.5
decryption.

Fixes CVE-2026-42768

Reviewed-by: Neil Horman <[email protected]>
Reviewed-by: Milan Broz <[email protected]>
Reviewed-by: Alicja Kario <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
MergeDate: Mon Jun  8 19:49:19 2026
(cherry picked from commit 33def545a0c173aec43891f24c3df4f7d2e4fd87)


  Commit: d531f21c0fe99067a66fc0ff1161ef127f9cd70b
      https://github.com/openssl/openssl/commit/d531f21c0fe99067a66fc0ff1161ef127f9cd70b
  Author: Bob Beck <[email protected]>
  Date:   2026-06-08 (Mon, 08 Jun 2026)

  Changed paths:
    M crypto/cmp/cmp_genm.c

  Log Message:
  -----------
  Use the correct issuer when validating rootCAKeyUpdate

This correctly uses the existing root, and not the same certificate
as the root of the chain to validate.

While we are here, we also turn on self signed certificate signature
checking as this case is actually bringing in trust anchors as
self signed certs, and fix a possible NULL deref.

Fixes CVE-2026-42769

Reviewed-by: Neil Horman <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
MergeDate: Mon Jun  8 19:54:01 2026
(cherry picked from commit 8b6c5dacb6ade54f30778cf344600d4a9df1f032)


  Commit: 3da5a516cd2635a320ff748503db2cef7c4b0f02
      https://github.com/openssl/openssl/commit/3da5a516cd2635a320ff748503db2cef7c4b0f02
  Author: Norbert Pocs <[email protected]>
  Date:   2026-06-08 (Mon, 08 Jun 2026)

  Changed paths:
    M providers/implementations/exchange/dh_exch.c

  Log Message:
  -----------
  Match the local q DHX parameter against the peer's q

As FFC/DH peer public key validation uses the peer's q value instead
of checking against the local q, we must also check that these
q values match when setting the peer's public key.

Fixes CVE-2026-42770

Signed-off-by: Norbert Pocs <[email protected]>

Reviewed-by: Viktor Dukhovni <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
MergeDate: Mon Jun  8 19:56:27 2026
(cherry picked from commit 29b9df160cc5f20ee3907cce0cb271b982846bce)


  Commit: 6cd187689f8180c1f8a3acde21f88190c4a20de7
      https://github.com/openssl/openssl/commit/6cd187689f8180c1f8a3acde21f88190c4a20de7
  Author: Bob Beck <[email protected]>
  Date:   2026-06-08 (Mon, 08 Jun 2026)

  Changed paths:
    M crypto/x509/x509_vpm.c

  Log Message:
  -----------
  Fix length miscalculation in validate_email

We incorrectly used the length of the domain part for the local part
when validating e-mail for X509_VERIFY_PARAM_set1_email().

Fixes CVE-2026-42771

Reviewed-by: Viktor Dukhovni <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
MergeDate: Mon Jun  8 19:59:28 2026
(cherry picked from commit 9ee2ad5a2b30e5ddd1cdf7ab6156d7922dd1e427)


  Commit: ffce42f4807d879586bd3bba8fa93caf13a7b8e4
      https://github.com/openssl/openssl/commit/ffce42f4807d879586bd3bba8fa93caf13a7b8e4
  Author: Bob Beck <[email protected]>
  Date:   2026-06-08 (Mon, 08 Jun 2026)

  Changed paths:
    M test/verify_extra_test.c

  Log Message:
  -----------
  Add further unit tests for e-mail validation

Ensure we correctly catch misformed things.

Reviewed-by: Viktor Dukhovni <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
MergeDate: Mon Jun  8 19:59:29 2026
(cherry picked from commit 17c86073c97951c1799449d2a3697c391cfd085d)


  Commit: 843c9b94ca9c2ed248bb30127bb4f3d7af0d607c
      https://github.com/openssl/openssl/commit/843c9b94ca9c2ed248bb30127bb4f3d7af0d607c
  Author: Viktor Dukhovni <[email protected]>
  Date:   2026-06-08 (Mon, 08 Jun 2026)

  Changed paths:
    M providers/implementations/ciphers/cipher_aes_ocb.c
    M test/evp_extra_test.c

  Log Message:
  -----------
  Apply the buffered IV on the AES-OCB EVP_Cipher() path

aes_ocb_cipher(), the OCB provider's OSSL_FUNC_CIPHER_CIPHER slot,
processed input without flushing the buffered IV into the OCB
context.  Effective nonce was 0 regardless of the caller's IV;
EVP_*Final_ex() then emitted a tag depending only on (key, iv).
This gave (key, nonce) reuse and single-query universal forgery on
the EVP_Cipher() path.

Apply update_iv() at the head of aes_ocb_cipher() to mirror the
streaming handler.  The matching GCM one-shot does this already.

Add a cross-driver round-trip test for AES-{GCM,CCM,OCB} and
ChaCha20-Poly1305 in test/evp_extra_test.c.  Each cipher is
exercised with and without AAD; the no-AAD case is needed because
any prior EVP_CipherUpdate(NULL, aad, ...) routes through the
streaming handler and applies the IV itself, masking the bug.

Fixes CVE-2026-45445

Reviewed-by: Eugene Syromiatnikov <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
MergeDate: Mon Jun  8 20:02:00 2026
(cherry picked from commit 50c95c5d1e83f4f46a555dfa7fd9c632d3eba9dc)


  Commit: 25b32cd9d41d2bc01b6abc425bb4baf2c2236fdc
      https://github.com/openssl/openssl/commit/25b32cd9d41d2bc01b6abc425bb4baf2c2236fdc
  Author: Dmitry Belyavskiy <[email protected]>
  Date:   2026-06-08 (Mon, 08 Jun 2026)

  Changed paths:
    M providers/implementations/ciphers/cipher_aes_gcm_siv_hw.c
    M providers/implementations/ciphers/cipher_aes_siv.c
    M test/evp_extra_test.c

  Log Message:
  -----------
  Fix handling of empty-ciphertext messages in AES-GCM-SIV and AES-SIV

AES-GCM-SIV: EVP_DecryptFinal_ex Accepts All-Zero Tag for Empty-Ciphertext
Messages.

AES-SIV: EVP_DecryptUpdate_ex Accepts All-Zero Tag for Empty-Ciphertext
Messages on context reuse.

Fixes CVE-2026-45446

Reviewed-by: Neil Horman <[email protected]>
Reviewed-by: Eugene Syromiatnikov <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
MergeDate: Mon Jun  8 20:12:25 2026
(cherry picked from commit aeb5000b0c66772bad600e9cc241a4c902e6d8b9)


  Commit: 3aad5eb7af4de4ee0633c30a8541a54d9bbde63c
      https://github.com/openssl/openssl/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c
  Author: Igor Ustinov <[email protected]>
  Date:   2026-06-08 (Mon, 08 Jun 2026)

  Changed paths:
    M crypto/pkcs7/pk7_smime.c

  Log Message:
  -----------
  Fix possible use-after-free in OpenSSL PKCS7_verify()

Fixes CVE-2026-45447

Reviewed-by: Eugene Syromiatnikov <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
MergeDate: Mon Jun  8 20:22:50 2026
(cherry picked from commit b4fbcf9fd25f781b17b763e3ec84d6b6dc096f6e)


  Commit: 370124c796abf5722a5caac0f670febda2895420
      https://github.com/openssl/openssl/commit/370124c796abf5722a5caac0f670febda2895420
  Author: Igor Ustinov <[email protected]>
  Date:   2026-06-08 (Mon, 08 Jun 2026)

  Changed paths:
    M test/recipes/80-test_cms.t
    A test/smime-eml/pkcs7-empty-digest-set.eml

  Log Message:
  -----------
  Test for CVE-2026-45447 (UAF in PKCS7_verify)

The test data were created with a tool developed by
Thai Duong <[email protected]>.

Reviewed-by: Eugene Syromiatnikov <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
MergeDate: Mon Jun  8 20:22:52 2026
(cherry picked from commit a60763a01490bd747ab716342b87d55bd0a27a39)


  Commit: b90ff3b1bd33b1c18e6a09936d097c2eddef8873
      https://github.com/openssl/openssl/commit/b90ff3b1bd33b1c18e6a09936d097c2eddef8873
  Author: Igor Ustinov <[email protected]>
  Date:   2026-06-08 (Mon, 08 Jun 2026)

  Changed paths:
    M crypto/crmf/crmf_lib.c

  Log Message:
  -----------
  Fix potential NULL dereference in OSSL_CRMF_ENCRYPTEDVALUE_decrypt()

Check that 'parameter' != NULL before dereferencing in
OSSL_CRMF_ENCRYPTEDVALUE_decrypt().

Fixes CVE-2026-42767

Reviewed-by: Neil Horman <[email protected]>
Reviewed-by: Norbert Pocs <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
MergeDate: Mon Jun  8 20:38:27 2026
(cherry picked from commit 309db711d13a6fdc6f8a719d8b4415a04dbf3bc5)


  Commit: 2ed0911917a87deafb14bfe32b0c20d6167be338
      https://github.com/openssl/openssl/commit/2ed0911917a87deafb14bfe32b0c20d6167be338
  Author: Eugene Syromiatnikov <[email protected]>
  Date:   2026-06-09 (Tue, 09 Jun 2026)

  Changed paths:
    M CHANGES.md
    M NEWS.md

  Log Message:
  -----------
  CHANGES.md, NEWS.md: update for 4.0.1

4.0.1 CHANGES.md includes the following:
 * CVE-2026-7383, CVE-2026-9076, CVE-2026-34180, CVE-2026-34181,
   CVE-2026-34182, CVE-2026-34183, CVE-2026-35188, CVE-2026-42764,
   CVE-2026-42765, CVE-2026-42766, CVE-2026-42767, CVE-2026-42768,
   CVE-2026-42769, CVE-2026-42770, CVE-2026-42771, CVE-2026-45445,
   CVE-2026-45446, CVE-2026-45447
 * https://github.com/openssl/openssl/pull/30626
   "TLSv1.3: Fix server not sending NewSessionTicket after ciphersuite mismatch"
 * https://github.com/openssl/openssl/pull/30904
   "pkey(1) missing setup for interactive pass prompt"
 * https://github.com/openssl/openssl/pull/31058
   "Validate that a PSK identity is at least one byte long"
 * https://github.com/openssl/openssl/pull/31146
   "ktls: Fix invalid memory access on retry with moving write buffer"
 * https://github.com/openssl/openssl/pull/31413
   "apps/s_client.c: read one byte less to avoid triggerring overflow
   protection"

4.0.1 NEWS.md includes the following:
 * CVE-2026-7383, CVE-2026-9076, CVE-2026-34180, CVE-2026-34181,
   CVE-2026-34182, CVE-2026-34183, CVE-2026-35188, CVE-2026-42764,
   CVE-2026-42765, CVE-2026-42766, CVE-2026-42767, CVE-2026-42768,
   CVE-2026-42769, CVE-2026-42770, CVE-2026-42771, CVE-2026-45445,
   CVE-2026-45446, CVE-2026-45447
 * https://github.com/openssl/openssl/pull/30904
   "pkey(1) missing setup for interactive pass prompt"
 * https://github.com/openssl/openssl/pull/31413
   "apps/s_client.c: read one byte less to avoid triggerring overflow
   protection"

Signed-off-by: Eugene Syromiatnikov <[email protected]>

Reviewed-by: Milan Broz <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
MergeDate: Tue Jun  9 11:18:04 2026


  Commit: 4592b4911d324b703959649b9b724218af6dcc13
      https://github.com/openssl/openssl/commit/4592b4911d324b703959649b9b724218af6dcc13
  Author: openssl-machine <[email protected]>
  Date:   2026-06-09 (Tue, 09 Jun 2026)

  Changed paths:
    M apps/testdsa.h
    M apps/testrsa.h
    M crypto/aes/asm/aes-sha1-armv8.pl
    M crypto/aes/asm/aes-sha256-armv8.pl
    M crypto/aes/asm/aesfx-sparcv9.pl
    M crypto/asn1/a_d2i_fp.c
    M crypto/asn1/asn1_lib.c
    M crypto/asn1/tasn_dec.c
    M crypto/bio/bss_dgram_pair.c
    M crypto/bn/bn_const.c
    M crypto/bn/bn_mod.c
    M crypto/cast/cast_s.h
    M crypto/cmp/cmp_genm.c
    M crypto/cms/cms_enc.c
    M crypto/cms/cms_env.c
    M crypto/cms/cms_pwri.c
    M crypto/des/fcrypt.c
    M crypto/dso/dso_win32.c
    M crypto/ec/curve448/scalar.c
    M crypto/ec/curve448/word.h
    M crypto/ec/ec_curve.c
    M crypto/ec/ecp_sm2p256.c
    M crypto/evp/asymcipher.c
    M crypto/ffc/ffc_params.c
    M crypto/hpke/hpke_util.c
    M crypto/md2/md2_dgst.c
    M crypto/modes/wrap128.c
    M crypto/param_build_set.c
    M crypto/rc2/rc2_skey.c
    M demos/cipher/aeskeywrap.c
    M demos/cipher/ariacbc.c
    M demos/digest/EVP_MD_demo.c
    M demos/encrypt/rsa_encrypt.h
    M demos/mac/cmac-aes256.c
    M demos/mac/hmac-sha512.c
    M demos/signature/EVP_EC_Signature_demo.h
    M doc/man1/openssl-pkcs8.pod.in
    M doc/man1/openssl-smime.pod.in
    M doc/man3/BIO_s_bio.pod
    M doc/man3/BN_add.pod
    M doc/man3/CMS_decrypt.pod
    M doc/man3/OSSL_HTTP_REQ_CTX.pod
    M doc/man3/OSSL_HTTP_parse_url.pod
    M doc/man3/OSSL_HTTP_transfer.pod
    M doc/man3/PKCS7_decrypt.pod
    M doc/man3/SSL_CTX_set_session_cache_mode.pod
    M doc/man3/SSL_CTX_set_session_id_context.pod
    M doc/man3/d2i_X509.pod
    M doc/man7/EVP_CIPHER-AES.pod
    M doc/man7/provider-asym_cipher.pod
    M doc/man7/provider-signature.pod
    M fuzz/dtlsserver.c
    M include/crypto/riscv_arch.h
    M include/internal/quic_cfq.h
    M include/internal/quic_fifd.h
    M include/internal/quic_port.h
    M include/internal/quic_stream_map.h
    M include/internal/rcu.h
    M include/openssl/bn.h
    M include/openssl/engine.h
    M include/openssl/x509_acert.h.in
    M providers/implementations/ciphers/cipher_aes_gcm_hw_rv64i.inc
    M providers/implementations/ciphers/cipher_aes_siv.c
    M providers/implementations/ciphers/cipher_chacha20_poly1305.c
    M providers/implementations/ciphers/cipher_chacha20_poly1305.h
    M providers/implementations/encode_decode/ml_dsa_codecs.c
    M providers/implementations/include/prov/ml_dsa_codecs.h
    M providers/implementations/include/prov/ml_kem_codecs.h
    M providers/implementations/keymgmt/ecx_kmgmt.c
    M providers/implementations/macs/poly1305_prov.c
    M providers/implementations/storemgmt/file_store_any2obj.c
    M ssl/quic/quic_ackm.c
    M ssl/quic/quic_fifd.c
    M ssl/quic/quic_port_local.h
    M ssl/quic/quic_record_rx.c
    M ssl/quic/quic_txp.c
    M ssl/record/methods/ktls_meth.c
    M test/asn1_decode_test.c
    M test/bad_dtls_test.c
    M test/bio_tfo_test.c
    M test/cipherlist_test.c
    M test/destest.c
    M test/dsatest.c
    M test/evp_extra_test2.c
    M test/evp_libctx_test.c
    M test/evp_pkey_provided_test.c
    M test/handshake-memfail.c
    M test/helpers/predefined_dhparams.c
    M test/hpke_test.c
    M test/ideatest.c
    M test/load_key_certs_crls_memfail.c
    M test/mem_alloc_test.c
    M test/ml_kem_evp_extra_test.c
    M test/pbetest.c
    M test/pkcs12_format_test.c
    M test/quic_record_test.c
    M test/quic_txp_test.c
    M test/radix/quic_tests.c
    M test/radix/terp.c
    M test/recipes/70-test_certtypeext.t
    M test/recipes/70-test_comp.t
    M test/recipes/70-test_npn.t
    M test/recipes/70-test_sslcbcpadding.t
    M test/recipes/70-test_sslcertstatus.t
    M test/recipes/70-test_sslextension.t
    M test/recipes/70-test_sslsessiontick.t
    M test/recipes/70-test_sslsignature.t
    M test/recipes/70-test_sslskewith0p.t
    M test/recipes/70-test_sslversions.t
    M test/recipes/70-test_sslvertol.t
    M test/recipes/70-test_tls13alerts.t
    M test/recipes/70-test_tls13cookie.t
    M test/recipes/70-test_tls13downgrade.t
    M test/recipes/70-test_tls13hrr.t
    M test/recipes/70-test_tls13psk.t
    M test/recipes/70-test_tlsextms.t
    M test/recipes/90-test_memfail.t
    M test/siphash_internal_test.c
    M test/stack_test.c
    M test/x509_memfail.c

  Log Message:
  -----------
  Copyright year updates


Reviewed-by: Saša Nedvědický <[email protected]>
Reviewed-by: Neil Horman <[email protected]>
MergeDate: Tue Jun  9 11:34:24 2026
Release: yes


  Commit: 625765614f7b6e31746a165a3d7206ee74f38d88
      https://github.com/openssl/openssl/commit/625765614f7b6e31746a165a3d7206ee74f38d88
  Author: openssl-machine <[email protected]>
  Date:   2026-06-09 (Tue, 09 Jun 2026)

  Changed paths:
    M providers/fips-sources.checksums
    M providers/fips.checksum

  Log Message:
  -----------
  make update


Reviewed-by: Saša Nedvědický <[email protected]>
Reviewed-by: Neil Horman <[email protected]>
MergeDate: Tue Jun  9 11:36:41 2026
Release: yes


  Commit: 1e963a8680ec78ad2072792c7a1a71f3c530bd2e
      https://github.com/openssl/openssl/commit/1e963a8680ec78ad2072792c7a1a71f3c530bd2e
  Author: openssl-machine <[email protected]>
  Date:   2026-06-09 (Tue, 09 Jun 2026)

  Changed paths:
    M CHANGES.md
    M NEWS.md
    M VERSION.dat

  Log Message:
  -----------
  Prepare for release of 4.0.1


Reviewed-by: Saša Nedvědický <[email protected]>
Reviewed-by: Neil Horman <[email protected]>
MergeDate: Tue Jun  9 11:36:43 2026
Release: yes


  Commit: 66b2b75799c694ccf14c5a1e2e529d9c6b7c63c7
      https://github.com/openssl/openssl/commit/66b2b75799c694ccf14c5a1e2e529d9c6b7c63c7
  Author: openssl-machine <[email protected]>
  Date:   2026-06-09 (Tue, 09 Jun 2026)

  Changed paths:
    M CHANGES.md
    M NEWS.md
    M VERSION.dat

  Log Message:
  -----------
  Prepare for 4.0.2


Reviewed-by: Saša Nedvědický <[email protected]>
Reviewed-by: Neil Horman <[email protected]>
MergeDate: Tue Jun  9 11:36:54 2026
Release: yes


Compare: https://github.com/openssl/openssl/compare/786cebff8c53...66b2b75799c6

To unsubscribe from these emails, change your notification settings at https://github.com/openssl/openssl/settings/notifications

-- 
You received this message because you are subscribed to the Google Groups "openssl-commits" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
To view this discussion visit https://groups.google.com/a/openssl.org/d/msgid/openssl-commits/openssl/openssl/push/refs/heads/openssl-4.0/786ceb-66b2b7%40github.com.