525d3f45be
OpenSSL 3.0.21 is a security patch release. The most severe CVE fixed in this release is High. This release incorporates the following bug fixes and mitigations: * Fixed heap use-after-free in PKCS7_verify(). (CVE-2026-45447) * Fixed CMS AuthEnvelopedData processing may accept forged messages. (CVE-2026-34182) * Fixed AES-OCB IV ignored on EVP_Cipher() path. (CVE-2026-45445) * Fixed possible heap buffer overflow in ASN.1 multibyte string conversion. (CVE-2026-7383) * Fixed out-of-bounds read in CMS password-based decryption. (CVE-2026-9076) * Fixed heap buffer over-read in ASN.1 content parsing. (CVE-2026-34180) * Fixed possible NULL dereference in password-dased CMS decryption. (CVE-2026-42766) * Fixed FFC-DH peer validation uses attacker-supplied q. (CVE-2026-42770) * Fixed incorrect tag processing for empty messages in AES-GCM-SIV and AES-SIV modes. (CVE-2026-45446) Signed-off-by: Martin Schiller <ms@dev.tdt.de> Link: https://github.com/openwrt/openwrt/pull/23843 Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de> (cherry picked from commit 95d0ca014c4ce5e225579f859c066dc74a20763b) |
||
|---|---|---|
| .. | ||
| files | ||
| patches | ||
| Config.in | ||
| Makefile | ||