Re: [LFS Trac] #5793: openssl-3.5.3

#5793: openssl-3.5.3
-------------------------+-----------------------
 Reporter:  Bruce Dubbs  |       Owner:  lfs-book
     Type:  enhancement  |      Status:  new
 Priority:  normal       |   Milestone:  12.5
Component:  Book         |     Version:  git
 Severity:  normal       |  Resolution:
 Keywords:               |
-------------------------+-----------------------
Comment (by Bruce Dubbs):

 Changes between 3.5.2 and 3.5.3 [16 Sep 2025]

 * Avoided a potential race condition introduced in 3.5.1, where
   `OSSL_STORE_CTX` kept open during lookup while potentially being used
   by multiple threads simultaneously, that could lead to potential crashes
   when multiple concurrent TLS connections are served.

 * The FIPS provider no longer performs a PCT on key import for RSA, DH,
   and EC keys (that was introduced in 3.5.2), following the latest update
   on that requirement in FIPS 140-3 IG 10.3.A additional comment 1.

 * Secure memory allocation calls are no longer used for HMAC keys.

 * `openssl req` no longer generates certificates with an empty extension
 list
   when SKID/AKID are set to `none` during generation.

 * The man page date is now derived from the release date provided
   in `VERSION.dat` and not the current date for the released builds.

 * Hardened the provider implementation of the RSA public key "encrypt"
   operation to add a missing check that the caller-indicated output buffer
   size is at least as large as the byte count of the RSA modulus.  The
 issue
   was reported by Arash Ale Ebrahim from SYSPWN.

   This operation is typically invoked via `EVP_PKEY_encrypt(3)`.  Callers
 that
   in fact provide a sufficiently large buffer, but fail to correctly
 indicate
   its size may now encounter unexpected errors.  In applications that
 attempt
   RSA public encryption into a buffer that is too small, an out-of-bounds
   write is now avoided and an error is reported instead.

 * Added FIPS 140-3 PCT on DH key generation.

 * Fixed the synthesised `OPENSSL_VERSION_NUMBER`.
-- 
Ticket URL: <https://wiki.linuxfromscratch.org/lfs/ticket/5793#comment:1>
LFS Trac <https://wiki.linuxfromscratch.org/lfs/>
Linux From Scratch: Your Distro, Your Rules.

-- 
http://lists.linuxfromscratch.org/sympa/info/lfs-book
Unsubscribe: See the above information page