[openssl/openssl] 6fa8ce: Add test for CVE-2026-63076

  Branch: refs/heads/openssl-3.0
  Home:   https://github.com/openssl/openssl
  Commit: 6fa8ce64f35df0bf7f74cdd6f1cedf2637642c5f
      https://github.com/openssl/openssl/commit/6fa8ce64f35df0bf7f74cdd6f1cedf2637642c5f
  Author: Daniel Kubec <[email protected]>
  Date:   2026-08-22 (Sat, 22 Aug 2026)

  Changed paths:
    M test/cmp_protect_test.c

  Log Message:
  -----------
  Add test for CVE-2026-63076

Assisted-by: Claude:claude-fable-5
Reviewed-by: Milan Broz <[email protected]>
Reviewed-by: Norbert Pocs <[email protected]>
Merge-date: Sat Aug 22 06:12:03 2026


  Commit: 37882aa2e0256e1072442a8f62f7db45b995c45b
      https://github.com/openssl/openssl/commit/37882aa2e0256e1072442a8f62f7db45b995c45b
  Author: Daniel Kubec <[email protected]>
  Date:   2026-08-22 (Sat, 22 Aug 2026)

  Changed paths:
    M crypto/cmp/cmp_protect.c

  Log Message:
  -----------
  Fix Remote NULL deref in ossl_cmp_calc_protection() via crafted protectionAlg

ossl_cmp_calc_protection() only checked whether the protectionAlg parameter
(ppval) was NULL before treating it as a PBMParameter ASN1_STRING.

X509_ALGOR_get0() does not validate the ASN.1 type of the parameter against what
the caller expects. For id-PasswordBasedMAC, a crafted message can encode the
parameter as a BOOLEAN instead of the expected PBMParameter SEQUENCE. Because
the ASN1_TYPE value union overlays the boolean int on the pointer field, ppval
comes back as a bogus non-NULL pointer (e.g. 0xff).

Fixes CVE-2026-63076

Reviewed-by: Milan Broz <[email protected]>
Reviewed-by: Norbert Pocs <[email protected]>
Merge-date: Sat Aug 22 06:12:04 2026


  Commit: 9f2b8522d39ff869fac2ff7c3f20609b54843188
      https://github.com/openssl/openssl/commit/9f2b8522d39ff869fac2ff7c3f20609b54843188
  Author: Neil Horman <[email protected]>
  Date:   2026-08-24 (Mon, 24 Aug 2026)

  Changed paths:
    M test/build.info
    A test/cmp_extracerts_dos_test.c
    M test/recipes/65-test_cmp_msg.t

  Log Message:
  -----------
  Add a test for restricting growth in cmp cert cache

Test to ensure that if certs are rejected we don't add them unboundedly
to the cmp contexts cert cache.

Assisted-by: Claude sonnet 4.6
Reviewed-by: Milan Broz <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Igor Ustinov <[email protected]>
Merge-date: Mon Aug 24 12:45:54 2026


  Commit: 21a5d9658b0c66daace60e10ea18ff32a448de9f
      https://github.com/openssl/openssl/commit/21a5d9658b0c66daace60e10ea18ff32a448de9f
  Author: Neil Horman <[email protected]>
  Date:   2026-08-24 (Mon, 24 Aug 2026)

  Changed paths:
    M crypto/cmp/cmp_vfy.c

  Log Message:
  -----------
  Fix unbounded cert cache growth in cmp

If a remote user sends cmp messages to a server with a list of
extraCerts and the message is rejected, the extraCerts from the message
remain in the server contexts untrusted certificate stack.  This exposes
servers with long lived ctx objects to denial of service attacks in
which an attacker sends messages intending to be rejected with a large
list of additional cerificated repeatedly, forcing the server to store
them indefinately.

Fix it by rolling back the added extra certs if the message is rejected,
using the same method we do when the context is configured to not do
caching at all.

Fixes openssl/srt#224

Fixes CVE-2026-63074

Reviewed-by: Milan Broz <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Igor Ustinov <[email protected]>
Merge-date: Mon Aug 24 12:45:55 2026


  Commit: d307f61f1b341b6eb7d5d07bd6902a939c709bc6
      https://github.com/openssl/openssl/commit/d307f61f1b341b6eb7d5d07bd6902a939c709bc6
  Author: Daniel Kubec <[email protected]>
  Date:   2026-08-24 (Mon, 24 Aug 2026)

  Changed paths:
    M test/cmsapitest.c
    M test/recipes/80-test_cmsapi.t

  Log Message:
  -----------
  Add test for CVE-2026-63072

Assisted-by: Claude:claude-fable-5
Reviewed-by: Milan Broz <[email protected]>
Reviewed-by: Andrew Dinh <[email protected]>
Merge-date: Mon Aug 24 14:44:54 2026


  Commit: a0c8ec557d9cac078f032d76cdf684fe743eb382
      https://github.com/openssl/openssl/commit/a0c8ec557d9cac078f032d76cdf684fe743eb382
  Author: Daniel Kubec <[email protected]>
  Date:   2026-08-24 (Mon, 24 Aug 2026)

  Changed paths:
    M crypto/cms/cms_kari.c

  Log Message:
  -----------
  Fix heap buffer overflow (8-byte OOB write) in AES-WRAP-PAD unwrap

On its integrity-failure paths that primitive writes and cleanses up to inlen
bytes of the output buffer. Size the buffer for that worst case so a failed
unwrap cannot write past the allocation.

Fixes CVE-2026-63072

Reviewed-by: Milan Broz <[email protected]>
Reviewed-by: Andrew Dinh <[email protected]>
Merge-date: Mon Aug 24 14:44:55 2026


  Commit: 1ca5a124b48f1ffe6980ad33724b452fbd62da1e
      https://github.com/openssl/openssl/commit/1ca5a124b48f1ffe6980ad33724b452fbd62da1e
  Author: Matt Caswell <[email protected]>
  Date:   2026-08-24 (Mon, 24 Aug 2026)

  Changed paths:
    M ssl/record/rec_layer_d1.c
    M ssl/record/record.h
    M ssl/record/ssl3_record.c

  Log Message:
  -----------
  Avoid full read buffer allocation when buffering DTLS records

dtls1_buffer_record() is used to hold onto a DTLS record across three
different scenarios: a record arriving early for the next epoch while
a handshake is in progress, re-queuing a record once the epoch catches
up and it has been decrypted, and application data arriving between
ChangeCipherSpec and Finished. In all three cases it took ownership of
the entire live read buffer (sized for the largest possible record,
~16.7KB) and allocated a brand new one to carry on reading, regardless
of how small the buffered record actually was. With each of the three
queues capped at 100 entries, a peer could send a stream of tiny
bogus records and force a disproportionate amount of heap allocation
per connection.

Instead, copy only the record's own on-wire bytes (header plus
ciphertext, or header plus plaintext for an already-decrypted record)
into the queue entry, and leave the live read buffer untouched. On
retrieval, copy those bytes back into the live buffer and rebase any
SSL3_RECORD data/input pointers that pointed into the original packet,
rather than handing out a pointer to a standalone allocation. Memory
use is now proportional to what the peer actually sends.

Fixes CVE-2026-54874

Assisted-by: Claude:claude-sonnet-4-6
Assisted-by: Claude:claude-opus-5
Reviewed-by: Milan Broz <[email protected]>
Reviewed-by: Andrew Dinh <[email protected]>
Merge-date: Mon Aug 24 15:40:45 2026


  Commit: 0321286f0cc7f2c5eef419cbf8b130a95af072e7
      https://github.com/openssl/openssl/commit/0321286f0cc7f2c5eef419cbf8b130a95af072e7
  Author: Matt Caswell <[email protected]>
  Date:   2026-08-24 (Mon, 24 Aug 2026)

  Changed paths:
    M ssl/record/rec_layer_d1.c
    M ssl/record/record_local.h
    M ssl/record/ssl3_record.c

  Log Message:
  -----------
  ssl/record: lower the DTLS unprocessed_rcds queue limit

100 buffered next-epoch records is far more than a normal handshake
ever needs. A peer that has already completed its side of the epoch
transition may send more than one record under the new epoch before
we catch up and bump our own receive epoch - for example, application
data sent immediately once the peer considers the handshake done -
but real-world bursts like that are still small. Now that each entry
only costs as much memory as the record actually received, the limit
mainly serves as a ceiling on worst-case per-connection memory use, so
lower it to 16 to keep that ceiling smaller while still leaving ample
headroom over legitimate usage.

dtls1_buffer_record() serves three queues here, so take the limit as an
argument rather than tightening all of them. Only unprocessed_rcds gets
the lower limit: processed_rcds is filled from unprocessed_rcds and so
cannot exceed it in any case, and buffered_app_data holds application
data that arrived between ChangeCipherSpec and Finished, which is not
the queue this ceiling is aimed at.

Assisted-by: Claude:claude-opus-5
Reviewed-by: Milan Broz <[email protected]>
Reviewed-by: Andrew Dinh <[email protected]>
Merge-date: Mon Aug 24 15:40:45 2026


  Commit: 898880d642310a92564acfde91cbf5a3f8a61e48
      https://github.com/openssl/openssl/commit/898880d642310a92564acfde91cbf5a3f8a61e48
  Author: Eugene Syromiatnikov <[email protected]>
  Date:   2026-08-25 (Tue, 25 Aug 2026)

  Changed paths:
    M CHANGES.md

  Log Message:
  -----------
  CHANGES.md: rephrase TLS 1.3 ticket lifetime cap change log record

Complements: 7e82c32134aa "Enforce RFC 8446 ticket lifetime limit for TLS 1.3 client"
Signed-off-by: Eugene Syromiatnikov <[email protected]>
Reviewed-by: Milan Broz <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Bob Beck <[email protected]>
Merge-date: Tue Aug 25 11:38:30 2026


  Commit: c3357d35866ac3c21f84d5fce11aa2f3b6aa839b
      https://github.com/openssl/openssl/commit/c3357d35866ac3c21f84d5fce11aa2f3b6aa839b
  Author: Eugene Syromiatnikov <[email protected]>
  Date:   2026-08-25 (Tue, 25 Aug 2026)

  Changed paths:
    M CHANGES.md
    M NEWS.md

  Log Message:
  -----------
  CHANGES.md, NEWS.md: reorder HollowByte change log record, add missing period

Move HollowByte change log record after records with assigned CVE
numbers and severity ratings, add period at the end of the lead
sentence, add a link to the PR in the comment.

Complements: d01f86f21948 "Update CHANGES/NEWS to mention the HollowByte fix"
Signed-off-by: Eugene Syromiatnikov <[email protected]>
Reviewed-by: Milan Broz <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Bob Beck <[email protected]>
Merge-date: Tue Aug 25 11:38:32 2026


  Commit: 2f6e1a9f7036965b7a4e0bdf60847a542bf21213
      https://github.com/openssl/openssl/commit/2f6e1a9f7036965b7a4e0bdf60847a542bf21213
  Author: Eugene Syromiatnikov <[email protected]>
  Date:   2026-08-25 (Tue, 25 Aug 2026)

  Changed paths:
    M CHANGES.md
    M NEWS.md

  Log Message:
  -----------
  CHANGES.md, NEWS.md: update for 3.0.22

3.0.22 CHANGES.md includes the following:
 * CVE-2026-54874, CVE-2026-63072, CVE-2026-63074, CVE-2026-63076,
   CVE-2026-75803
 * https://github.com/openssl/openssl/pull/31174
   "Enforce RFC 8446 ticket lifetime limit for TLS 1.3 client"
   (already present)
 * https://github.com/openssl/openssl/pull/31578
   "Backport PR #30313 into 3.0 branch."
 * https://github.com/openssl/openssl/pull/32417
   "[3.0] Reject explicitly supplied invalid tags and generate tags for empty AEAD messages"
   (included as CVE-2026-75803)
 * https://github.com/openssl/openssl/pull/32427
   "Backport #32256 openssl 4.0 to 3.0"

3.0.22 NEWS.md includes the following:
 * CVE-2026-54874, CVE-2026-63072, CVE-2026-63074, CVE-2026-63076,
   CVE-2026-75803
 * https://github.com/openssl/openssl/pull/32417
   "[3.0] Reject explicitly supplied invalid tags and generate tags for empty AEAD messages"
   (included as CVE-2026-75803)
 * https://github.com/openssl/openssl/pull/32427
   "Backport #32256 openssl 4.0 to 3.0"

Signed-off-by: Eugene Syromiatnikov <[email protected]>
Reviewed-by: Milan Broz <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Bob Beck <[email protected]>
Merge-date: Tue Aug 25 11:38:33 2026


  Commit: c8d7e8cc2c33684d3193e13e84c55b48a0c284e6
      https://github.com/openssl/openssl/commit/c8d7e8cc2c33684d3193e13e84c55b48a0c284e6
  Author: openssl-machine <[email protected]>
  Date:   2026-08-25 (Tue, 25 Aug 2026)

  Changed paths:
    M apps/lib/vms_term_sock.c
    M crypto/aes/asm/aesni-mb-x86_64.pl
    M crypto/aes/asm/aesni-sha1-x86_64.pl
    M crypto/aes/asm/aesni-sha256-x86_64.pl
    M crypto/bn/asm/rsaz-avx2.pl
    M crypto/bn/asm/rsaz-x86_64.pl
    M crypto/bn/asm/x86_64-mont.pl
    M crypto/bn/asm/x86_64-mont5.pl
    M crypto/bn/bn_add.c
    M crypto/bn/bn_lib.c
    M crypto/chacha/asm/chacha-x86.pl
    M crypto/chacha/asm/chacha-x86_64.pl
    M crypto/cmp/cmp_protect.c
    M crypto/cms/cms_kari.c
    M crypto/ct/ct_b64.c
    M crypto/dh/dh_backend.c
    M crypto/dh/dh_check.c
    M crypto/ec/asm/ecp_nistz256-x86_64.pl
    M crypto/ec/asm/x25519-x86_64.pl
    M crypto/modes/asm/aesni-gcm-x86_64.pl
    M crypto/modes/asm/ghash-x86_64.pl
    M crypto/pem/pvkfmt.c
    M crypto/pkcs12/p12_add.c
    M crypto/poly1305/asm/poly1305-x86.pl
    M crypto/poly1305/asm/poly1305-x86_64.pl
    M crypto/rand/rand_lib.c
    M crypto/sha/asm/sha1-586.pl
    M crypto/sha/asm/sha1-mb-x86_64.pl
    M crypto/sha/asm/sha1-x86_64.pl
    M crypto/sha/asm/sha256-586.pl
    M crypto/sha/asm/sha256-mb-x86_64.pl
    M crypto/sha/asm/sha512-x86_64.pl
    M crypto/threads_win.c
    M crypto/x509/by_dir.c
    M crypto/x509/pcy_cache.c
    M crypto/x509/v3_ncons.c
    M crypto/x509/x509_err.c
    M crypto/x509/x_crl.c
    M doc/man3/ASN1_INTEGER_get_int64.pod
    M doc/man3/ASN1_aux_cb.pod
    M doc/man3/BIO_s_datagram.pod
    M doc/man3/BN_generate_prime.pod
    M doc/man3/SSL_CTX_set_verify.pod
    M doc/man7/fips_module.pod
    M doc/man7/openssl-core_dispatch.h.pod
    M include/internal/constant_time.h
    M include/openssl/x509err.h
    M providers/baseprov.c
    M providers/fips/fipsprov.c
    M providers/implementations/ciphers/ciphercommon_ccm.c
    M providers/implementations/rands/test_rng.c
    M providers/implementations/storemgmt/file_store_any2obj.c
    M ssl/record/rec_layer_d1.c
    M ssl/record/record.h
    M ssl/record/record_local.h
    M ssl/record/ssl3_record.c
    M ssl/statem/statem_clnt.c
    M ssl/t1_lib.c
    M test/cmp_protect_test.c
    M test/crltest.c
    M test/p_test.c
    M test/pkcs7_test.c
    M test/punycode_test.c
    M test/recipes/30-test_evp_data/evprand.txt
    M test/recipes/65-test_cmp_msg.t
    M test/recipes/80-test_ssl_new.t
    M test/secmemtest.c
    M test/v3ext.c

  Log Message:
  -----------
  Copyright year updates


Reviewed-by: Neil Horman <[email protected]>
Reviewed-by: Milan Broz <[email protected]>
MergeDate: Tue Aug 25 12:12:41 2026
Release: yes


  Commit: 798f45cba3a2a9f19516724e030da0237860e368
      https://github.com/openssl/openssl/commit/798f45cba3a2a9f19516724e030da0237860e368
  Author: openssl-machine <[email protected]>
  Date:   2026-08-25 (Tue, 25 Aug 2026)

  Changed paths:
    M providers/fips-sources.checksums
    M providers/fips.checksum

  Log Message:
  -----------
  make update


Reviewed-by: Neil Horman <[email protected]>
Reviewed-by: Milan Broz <[email protected]>
MergeDate: Tue Aug 25 12:14:21 2026
Release: yes


  Commit: a279090b9cd6b682a5a178410765a63e619fa2d9
      https://github.com/openssl/openssl/commit/a279090b9cd6b682a5a178410765a63e619fa2d9
  Author: openssl-machine <[email protected]>
  Date:   2026-08-25 (Tue, 25 Aug 2026)

  Changed paths:
    M CHANGES.md
    M NEWS.md
    M VERSION.dat

  Log Message:
  -----------
  Prepare for release of 3.0.22


Reviewed-by: Neil Horman <[email protected]>
Reviewed-by: Milan Broz <[email protected]>
MergeDate: Tue Aug 25 12:14:23 2026
Release: yes


  Commit: 6bf4c5b1325bfa50d3ae39e97077b58796e7e5d1
      https://github.com/openssl/openssl/commit/6bf4c5b1325bfa50d3ae39e97077b58796e7e5d1
  Author: openssl-machine <[email protected]>
  Date:   2026-08-25 (Tue, 25 Aug 2026)

  Changed paths:
    M CHANGES.md
    M NEWS.md
    M VERSION.dat

  Log Message:
  -----------
  Prepare for 3.0.23


Reviewed-by: Neil Horman <[email protected]>
Reviewed-by: Milan Broz <[email protected]>
MergeDate: Tue Aug 25 12:14:28 2026
Release: yes


Compare: https://github.com/openssl/openssl/compare/1d95715df8d0...6bf4c5b1325b

To unsubscribe from these emails, change your notification settings at https://github.com/openssl/openssl/settings/notifications

-- 
You received this message because you are subscribed to the Google Groups "openssl-commits" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
To view this discussion visit https://groups.google.com/a/openssl.org/d/msgid/openssl-commits/openssl/openssl/push/refs/heads/openssl-3.0/1d9571-6bf4c5%40github.com.