OpenSSL 3.0.20 is a security patch release. The most severe CVE fixed in
this release is Moderate.
This release incorporates the following bug fixes and mitigations:
* Fixed incorrect failure handling in RSA KEM RSASVE encapsulation.
(CVE-2026-31790)
* Fixed potential use-after-free in DANE client code.
(CVE-2026-28387)
* Fixed NULL pointer dereference when processing a delta CRL.
(CVE-2026-28388)
* Fixed possible NULL dereference when processing CMS
KeyAgreeRecipientInfo.
(CVE-2026-28389)
* Fixed possible NULL dereference when processing CMS
KeyTransportRecipientInfo.
(CVE-2026-28390)
* Fixed heap buffer overflow in hexadecimal conversion.
(CVE-2026-31789)
Signed-off-by: Jan Kardell <jan.kardell@telliq.com>
Link: https://github.com/openwrt/openwrt/pull/23346
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit 44d98eec231534487cbec4ba8f852c1acf67a32d)
75d296fed9