OpenSSL 3.0.21 is a security patch release. The most severe CVE fixed in
this release is High.
This release incorporates the following bug fixes and mitigations:
* Fixed heap use-after-free in PKCS7_verify(). (CVE-2026-45447)
* Fixed CMS AuthEnvelopedData processing may accept forged messages.
(CVE-2026-34182)
* Fixed AES-OCB IV ignored on EVP_Cipher() path. (CVE-2026-45445)
* Fixed possible heap buffer overflow in ASN.1 multibyte string
conversion. (CVE-2026-7383)
* Fixed out-of-bounds read in CMS password-based decryption.
(CVE-2026-9076)
* Fixed heap buffer over-read in ASN.1 content parsing.
(CVE-2026-34180)
* Fixed possible NULL dereference in password-dased CMS decryption.
(CVE-2026-42766)
* Fixed FFC-DH peer validation uses attacker-supplied q.
(CVE-2026-42770)
* Fixed incorrect tag processing for empty messages in AES-GCM-SIV and
AES-SIV modes. (CVE-2026-45446)
Signed-off-by: Martin Schiller <ms@dev.tdt.de>
Link: https://github.com/openwrt/openwrt/pull/23843
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit 95d0ca014c4ce5e225579f859c066dc74a20763b)
525d3f45be