git: 514ff9a98263 - stable/15 - crypto/openssl: update to 3.5.8
- Go to: [ bottom of page ] [ top of archives ] [ this month ]
Date: Tue, 01 Sep 2026 08:16:23 UTC
The branch stable/15 has been updated by ngie:
URL: https://cgit.FreeBSD.org/src/commit/?id=514ff9a982637aa7686c1862f44d90f9e7a2f4a1
commit 514ff9a982637aa7686c1862f44d90f9e7a2f4a1
Author: Enji Cooper <ngie@FreeBSD.org>
AuthorDate: 2026-08-29 01:28:12 +0000
Commit: Enji Cooper <ngie@FreeBSD.org>
CommitDate: 2026-09-01 08:16:05 +0000
crypto/openssl: update to 3.5.8
This is a security bugfix release. Please see the related merge commit
for more details.
Maintainer note: `quic_ackm.h`'s conflict was resolved by taking
the upstream version of the file verbatim.
Conflicts:
crypto/openssl/include/internal/quic_ackm.h
MFC after: 3 days
Merge commit '248da023ae5ea7292930ac5d715d88b87e2e6f46'
(cherry picked from commit 78e936b2d0b5e6554425009199be31e76bc67c10)
---
crypto/openssl/CHANGES.md | 258 +
crypto/openssl/CONTRIBUTING.md | 44 +-
crypto/openssl/NEWS.md | 56 +
crypto/openssl/README-FIPS.md | 12 +-
crypto/openssl/VERSION.dat | 4 +-
crypto/openssl/apps/lib/apps.c | 25 +-
crypto/openssl/apps/lib/s_cb.c | 6 +-
crypto/openssl/apps/lib/vms_term_sock.c | 4 +-
crypto/openssl/apps/s_client.c | 55 +-
crypto/openssl/crypto/aes/aes_x86core.c | 867 -
crypto/openssl/crypto/aes/asm/aesni-mb-x86_64.pl | 9 +-
crypto/openssl/crypto/aes/asm/aesni-sha1-x86_64.pl | 5 +-
.../openssl/crypto/aes/asm/aesni-sha256-x86_64.pl | 9 +-
crypto/openssl/crypto/aes/asm/aesni-xts-avx512.pl | 7 +
crypto/openssl/crypto/armcap.c | 36 +-
crypto/openssl/crypto/asn1/a_d2i_fp.c | 15 +-
crypto/openssl/crypto/asn1/a_mbstr.c | 20 +-
crypto/openssl/crypto/asn1/asn1_gen.c | 5 +-
crypto/openssl/crypto/bio/bss_file.c | 8 +-
crypto/openssl/crypto/bn/asm/rsaz-2k-avx512.pl | 9 +-
crypto/openssl/crypto/bn/asm/rsaz-2k-avxifma.pl | 7 +
crypto/openssl/crypto/bn/asm/rsaz-3k-avx512.pl | 9 +-
crypto/openssl/crypto/bn/asm/rsaz-3k-avxifma.pl | 7 +
crypto/openssl/crypto/bn/asm/rsaz-4k-avx512.pl | 9 +-
crypto/openssl/crypto/bn/asm/rsaz-4k-avxifma.pl | 7 +
crypto/openssl/crypto/bn/asm/rsaz-avx2.pl | 10 +-
crypto/openssl/crypto/bn/asm/rsaz-x86_64.pl | 9 +-
crypto/openssl/crypto/bn/asm/x86_64-mont.pl | 9 +-
crypto/openssl/crypto/bn/asm/x86_64-mont5.pl | 9 +-
crypto/openssl/crypto/bn/bn_add.c | 9 +-
crypto/openssl/crypto/bn/bn_exp.c | 7 +-
crypto/openssl/crypto/bn/bn_lib.c | 32 +-
crypto/openssl/crypto/chacha/asm/chacha-x86.pl | 6 +-
crypto/openssl/crypto/chacha/asm/chacha-x86_64.pl | 9 +-
crypto/openssl/crypto/cmp/cmp_protect.c | 2 +-
crypto/openssl/crypto/cmp/cmp_vfy.c | 22 +-
crypto/openssl/crypto/cms/cms_asn1.c | 8 +-
crypto/openssl/crypto/cms/cms_env.c | 46 +-
crypto/openssl/crypto/cms/cms_kari.c | 8 +-
crypto/openssl/crypto/cms/cms_local.h | 3 +
crypto/openssl/crypto/cms/cms_pwri.c | 5 +-
crypto/openssl/crypto/cms/cms_smime.c | 39 +
crypto/openssl/crypto/ct/ct_b64.c | 8 +-
crypto/openssl/crypto/ctype.c | 6 +-
crypto/openssl/crypto/dh/dh_backend.c | 4 +-
crypto/openssl/crypto/dh/dh_check.c | 24 +-
crypto/openssl/crypto/dsa/dsa_key.c | 3 +-
.../openssl/crypto/ec/asm/ecp_nistz256-x86_64.pl | 10 +-
crypto/openssl/crypto/ec/asm/x25519-x86_64.pl | 9 +-
crypto/openssl/crypto/ec/ec_key.c | 56 +-
crypto/openssl/crypto/err/openssl.txt | 1 +
crypto/openssl/crypto/evp/exchange.c | 4 +-
crypto/openssl/crypto/ffc/ffc_params_generate.c | 9 +-
crypto/openssl/crypto/hmac/hmac.c | 10 +-
crypto/openssl/crypto/http/http_lib.c | 27 +-
crypto/openssl/crypto/ml_dsa/ml_dsa_encoders.c | 5 +-
crypto/openssl/crypto/ml_dsa/ml_dsa_key.c | 14 +-
crypto/openssl/crypto/ml_dsa/ml_dsa_matrix.c | 8 +-
crypto/openssl/crypto/ml_dsa/ml_dsa_sample.c | 47 +-
crypto/openssl/crypto/ml_dsa/ml_dsa_sign.c | 19 +-
crypto/openssl/crypto/ml_dsa/ml_dsa_vector.h | 4 +-
crypto/openssl/crypto/ml_kem/ml_kem.c | 107 +-
crypto/openssl/crypto/modes/asm/aes-gcm-avx512.pl | 9 +-
.../openssl/crypto/modes/asm/aesni-gcm-x86_64.pl | 9 +-
crypto/openssl/crypto/modes/asm/ghash-x86_64.pl | 9 +-
crypto/openssl/crypto/pem/pvkfmt.c | 8 +-
crypto/openssl/crypto/pkcs12/p12_add.c | 4 +-
crypto/openssl/crypto/pkcs12/p12_decr.c | 5 +-
crypto/openssl/crypto/pkcs12/p12_utl.c | 2 +
crypto/openssl/crypto/pkcs7/pk7_doit.c | 2 +-
crypto/openssl/crypto/pkcs7/pk7_lib.c | 18 +-
crypto/openssl/crypto/poly1305/asm/poly1305-x86.pl | 9 +-
.../openssl/crypto/poly1305/asm/poly1305-x86_64.pl | 9 +-
crypto/openssl/crypto/rand/rand_lib.c | 17 +-
crypto/openssl/crypto/rsa/rsa_gen.c | 3 +-
crypto/openssl/crypto/rsa/rsa_ossl.c | 16 +-
crypto/openssl/crypto/sha/asm/sha1-586.pl | 5 +-
crypto/openssl/crypto/sha/asm/sha1-mb-x86_64.pl | 9 +-
crypto/openssl/crypto/sha/asm/sha1-x86_64.pl | 9 +-
crypto/openssl/crypto/sha/asm/sha256-586.pl | 9 +-
crypto/openssl/crypto/sha/asm/sha256-mb-x86_64.pl | 9 +-
crypto/openssl/crypto/sha/asm/sha512-x86_64.pl | 9 +-
crypto/openssl/crypto/sha/sha_riscv.c | 10 +-
crypto/openssl/crypto/slh_dsa/slh_dsa.c | 37 +-
crypto/openssl/crypto/slh_dsa/slh_dsa_hash_ctx.c | 5 +-
crypto/openssl/crypto/slh_dsa/slh_dsa_key.c | 6 +
crypto/openssl/crypto/slh_dsa/slh_dsa_local.h | 14 +-
crypto/openssl/crypto/slh_dsa/slh_fors.c | 52 +-
crypto/openssl/crypto/slh_dsa/slh_hash.c | 38 +-
crypto/openssl/crypto/slh_dsa/slh_hypertree.c | 23 +-
crypto/openssl/crypto/slh_dsa/slh_wots.c | 6 +-
crypto/openssl/crypto/slh_dsa/slh_xmss.c | 29 +-
crypto/openssl/crypto/threads_win.c | 14 +
crypto/openssl/crypto/x509/by_dir.c | 38 +-
crypto/openssl/crypto/x509/pcy_cache.c | 7 +-
crypto/openssl/crypto/x509/v3_akid.c | 6 +-
crypto/openssl/crypto/x509/v3_ncons.c | 9 +-
crypto/openssl/crypto/x509/x509_err.c | 4 +-
crypto/openssl/crypto/x509/x509_lu.c | 9 +-
crypto/openssl/crypto/x509/x509_vfy.c | 9 +-
crypto/openssl/crypto/x509/x_crl.c | 6 +-
crypto/openssl/crypto/x509/x_pubkey.c | 2 +-
crypto/openssl/doc/build.info | 12 +
.../openssl/doc/internal/man3/DEFINE_LIST_OF.pod | 13 +-
crypto/openssl/doc/man1/openssl-pkeyutl.pod.in | 8 +-
crypto/openssl/doc/man1/openssl.pod | 6 +-
crypto/openssl/doc/man3/ASN1_INTEGER_get_int64.pod | 4 +-
crypto/openssl/doc/man3/ASN1_aux_cb.pod | 62 +-
crypto/openssl/doc/man3/ASN1_item_d2i_bio.pod | 18 +-
crypto/openssl/doc/man3/BIO_s_datagram.pod | 4 +-
crypto/openssl/doc/man3/BIO_s_file.pod | 9 +-
crypto/openssl/doc/man3/BN_generate_prime.pod | 4 +-
.../openssl/doc/man3/CMS_EncryptedData_decrypt.pod | 4 +-
crypto/openssl/doc/man3/NAME_CONSTRAINTS_check.pod | 211 +
crypto/openssl/doc/man3/OPENSSL_armcap.pod | 246 +
crypto/openssl/doc/man3/OPENSSL_init_crypto.pod | 7 +-
crypto/openssl/doc/man3/SSL_CTX_set1_curves.pod | 6 +-
.../openssl/doc/man3/SSL_CTX_set_msg_callback.pod | 4 +-
crypto/openssl/doc/man3/SSL_CTX_set_verify.pod | 6 +-
crypto/openssl/doc/man3/SSL_get_value_uint.pod | 22 +-
crypto/openssl/doc/man3/SSL_new.pod | 10 +-
crypto/openssl/doc/man3/SSL_poll.pod | 20 +-
.../doc/man3/X509_get_default_cert_file.pod | 4 +-
crypto/openssl/doc/man3/X509_verify_cert.pod | 512 +-
crypto/openssl/doc/man7/EVP_CIPHER-SM4.pod | 12 +-
crypto/openssl/doc/man7/EVP_SIGNATURE-ECDSA.pod | 2 +-
crypto/openssl/doc/man7/EVP_SIGNATURE-RSA.pod | 2 +-
crypto/openssl/doc/man7/fips_module.pod | 11 +-
.../openssl/doc/man7/openssl-core_dispatch.h.pod | 4 +-
crypto/openssl/doc/man7/openssl-env.pod | 4 +-
.../openssl/doc/man7/openssl-quic-concurrency.pod | 29 +-
crypto/openssl/doc/man7/openssl-threads.pod | 30 +-
crypto/openssl/doc/man7/provider-kem.pod | 19 +-
crypto/openssl/doc/man7/provider-signature.pod | 2 +-
crypto/openssl/fuzz/provider.c | 9 +-
crypto/openssl/include/internal/hashtable.h | 4 +-
crypto/openssl/include/internal/list.h | 31 +-
crypto/openssl/include/internal/quic_ackm.h | 4 +-
crypto/openssl/include/internal/quic_port.h | 6 +-
crypto/openssl/include/internal/quic_record_rx.h | 2 +-
crypto/openssl/include/internal/quic_ssl.h | 3 +-
crypto/openssl/include/openssl/ssl.h.in | 19 +-
crypto/openssl/include/openssl/x509err.h | 3 +-
crypto/openssl/providers/baseprov.c | 10 +-
crypto/openssl/providers/defltprov.c | 8 +-
crypto/openssl/providers/fips-sources.checksums | 152 +-
crypto/openssl/providers/fips.checksum | 2 +-
crypto/openssl/providers/fips/fipsprov.c | 10 +-
.../ciphers/cipher_aes_gcm_siv_hw.c | 14 +-
.../implementations/ciphers/cipher_aes_ocb.c | 4 +
.../ciphers/cipher_chacha20_poly1305.c | 27 +-
.../ciphers/cipher_chacha20_poly1305_hw.c | 4 +-
.../implementations/ciphers/ciphercommon_ccm.c | 17 +-
.../implementations/encode_decode/encode_key2ms.c | 5 +-
.../providers/implementations/kem/ml_kem_kem.c | 3 +-
.../providers/implementations/kem/mlx_kem.c | 12 +-
.../providers/implementations/kem/rsa_kem.c | 51 +
.../providers/implementations/keymgmt/dh_kmgmt.c | 6 +-
.../providers/implementations/keymgmt/ec_kmgmt.c | 20 +-
.../providers/implementations/keymgmt/ecx_kmgmt.c | 2 -
.../implementations/keymgmt/ml_dsa_kmgmt.c | 13 +-
.../implementations/keymgmt/ml_kem_kmgmt.c | 35 +-
.../providers/implementations/keymgmt/mlx_kmgmt.c | 26 +-
.../implementations/keymgmt/slh_dsa_kmgmt.c | 20 +-
.../providers/implementations/macs/cmac_prov.c | 4 +-
.../providers/implementations/macs/poly1305_prov.c | 6 +-
.../providers/implementations/rands/drbg_ctr.c | 57 +-
.../providers/implementations/rands/drbg_hash.c | 38 +-
.../providers/implementations/rands/drbg_hmac.c | 39 +-
.../implementations/rands/seeding/rand_unix.c | 4 +-
.../providers/implementations/rands/test_rng.c | 6 +-
.../providers/implementations/signature/rsa_sig.c | 12 +-
.../implementations/signature/slh_dsa_sig.c | 2 +-
.../implementations/storemgmt/file_store_any2obj.c | 6 +-
crypto/openssl/ssl/quic/quic_ackm.c | 17 +-
crypto/openssl/ssl/quic/quic_impl.c | 56 +
crypto/openssl/ssl/quic/quic_port.c | 16 +
crypto/openssl/ssl/quic/quic_port_local.h | 3 +-
crypto/openssl/ssl/quic/quic_rx_depack.c | 15 +-
crypto/openssl/ssl/quic/quic_stream_map.c | 4 +
crypto/openssl/ssl/record/methods/dtls_meth.c | 2 +-
.../openssl/ssl/record/methods/recmethod_local.h | 2 +-
crypto/openssl/ssl/record/methods/tls_common.c | 28 +-
crypto/openssl/ssl/record/rec_layer_s3.c | 4 +-
crypto/openssl/ssl/rio/poll_builder.c | 6 +-
crypto/openssl/ssl/rio/poll_builder.h | 15 +-
crypto/openssl/ssl/rio/poll_immediate.c | 31 +-
crypto/openssl/ssl/rio/rio_notifier.c | 22 +-
crypto/openssl/ssl/s3_lib.c | 5 +-
crypto/openssl/ssl/ssl_cert.c | 8 +-
crypto/openssl/ssl/ssl_lib.c | 25 +
crypto/openssl/ssl/ssl_local.h | 7 +-
crypto/openssl/ssl/ssl_rsa.c | 8 +-
crypto/openssl/ssl/statem/extensions.c | 27 +-
crypto/openssl/ssl/statem/statem_clnt.c | 8 +
crypto/openssl/ssl/statem/statem_lib.c | 4 +-
crypto/openssl/ssl/statem/statem_srvr.c | 6 +-
crypto/openssl/ssl/t1_lib.c | 105 +-
crypto/openssl/test/asn1_decode_test.c | 165 +
crypto/openssl/test/build.info | 7 +-
crypto/openssl/test/ca_internals_test.c | 6 +-
.../test/certs/delta-crl-as-complete-ca.pem | 20 +
.../certs/delta-crl-as-complete-delta-reasons.pem | 12 +
.../test/certs/delta-crl-as-complete-delta.pem | 12 +
.../test/certs/delta-crl-as-complete-leaf.pem | 20 +
.../test/certs/server-ec-compressed-cert.pem | 12 +
.../test/certs/server-ec-compressed-key.pem | 5 +
crypto/openssl/test/cmp_client_test.c | 12 +-
crypto/openssl/test/cmp_protect_test.c | 2 +-
crypto/openssl/test/cmp_vfy_test.c | 2 +-
crypto/openssl/test/cmsapitest.c | 103 +-
crypto/openssl/test/crltest.c | 125 +-
crypto/openssl/test/endecode_test.c | 508 +-
crypto/openssl/test/evp_extra_test.c | 854 +-
crypto/openssl/test/evp_extra_test2.c | 517 +-
crypto/openssl/test/fipsidentity.cnf | 23 +
crypto/openssl/test/helpers/quictestlib.c | 319 +-
crypto/openssl/test/helpers/quictestlib.h | 6 +-
crypto/openssl/test/helpers/ssltestlib.c | 63 +-
crypto/openssl/test/helpers/ssltestlib.h | 5 +-
crypto/openssl/test/hpke_test.c | 22 +-
crypto/openssl/test/http_test.c | 28 +-
crypto/openssl/test/list_test.c | 48 +-
crypto/openssl/test/p_test.c | 6 +-
crypto/openssl/test/pairwise_fail_test.c | 4 +-
crypto/openssl/test/pkcs12_api_test.c | 4 +-
crypto/openssl/test/pkcs7_test.c | 116 +-
crypto/openssl/test/punycode_test.c | 4 +-
crypto/openssl/test/quic_ackm_test.c | 68 +-
crypto/openssl/test/quic_multistream_test.c | 11 +-
crypto/openssl/test/quic_tserver_test.c | 38 +-
crypto/openssl/test/quicapitest.c | 126 +
crypto/openssl/test/radix/quic_bindings.c | 19 +-
crypto/openssl/test/radix/quic_ops.c | 61 +-
crypto/openssl/test/radix/quic_tests.c | 342 +-
crypto/openssl/test/recipes/20-test_app_s_client.t | 110 +
crypto/openssl/test/recipes/20-test_cli_fips.t | 42 +-
crypto/openssl/test/recipes/25-test_verify.t | 34 +-
.../test/recipes/30-test_evp_data/evprand.txt | 79844 -------------------
.../openssl/test/recipes/30-test_pairwise_fail.t | 12 +-
crypto/openssl/test/recipes/65-test_cmp_msg.t | 2 +-
.../test/recipes/70-test_rio_poll_builder.t | 19 +
crypto/openssl/test/recipes/70-test_sslrecords.t | 12 +-
crypto/openssl/test/recipes/80-test_cms.t | 64 +-
.../80-test_cms_data/authenticated_attrs.pem | 8 +
.../80-test_cms_data/authenveloped_attrs.pem | 7 +
.../80-test_cms_data/bad_authenveloped_attrs.pem | 7 +
crypto/openssl/test/recipes/80-test_cmsapi.t | 3 +-
crypto/openssl/test/recipes/80-test_ssl_new.t | 6 +-
crypto/openssl/test/rio_poll_builder_test.c | 45 +
crypto/openssl/test/rpktest.c | 2 +-
crypto/openssl/test/secmemtest.c | 4 +-
.../openssl/test/ssl-tests/33-compressed-spki.cnf | 76 +
.../test/ssl-tests/33-compressed-spki.cnf.in | 81 +
crypto/openssl/test/sslapitest.c | 172 +
crypto/openssl/test/x509_test.c | 98 +
crypto/openssl/util/missingcrypto.txt | 2 -
crypto/openssl/util/other.syms | 5 +-
crypto/openssl/util/perl/TLSProxy/Proxy.pm | 10 +-
259 files changed, 7392 insertions(+), 81990 deletions(-)
diff --git a/crypto/openssl/CHANGES.md b/crypto/openssl/CHANGES.md
index c1c29eb55f04..b440f013313f 100644
--- a/crypto/openssl/CHANGES.md
+++ b/crypto/openssl/CHANGES.md
@@ -28,6 +28,237 @@ OpenSSL Releases
OpenSSL 3.5
-----------
+### Changes between 3.5.7 and 3.5.8 [25 Aug 2026]
+
+ * Fixed QUIC server being able to trigger double free when processing `INITIAL`
+ packet.
+
+ Severity: Moderate
+
+ Issue summary: QUIC server may double free QRX (QUIC record layer RX) object
+ when channel creation fails for initial packet.
+
+ Impact summary: Double free leads to heap corruption, which typically results
+ in termination of QUIC server process, leading to a Denial of Service.
+ There is so far no evidence that this double free is exploitable for remote
+ code execution, thus it is considered highly improbable.
+
+ Reported by: Fuzz0x (ZKSC Institute of Security Research), Emilio Galle,
+ and Feng Xue (ThreatBoon).
+
+ ([CVE-2026-18798])
+
+ *Alexandr Nedvědický*
+
+ * Fixed heap buffer overflow in CMS key unwrapping.
+
+ Severity: Moderate
+
+ Issue summary: OpenSSL CMS decryption sizes the key-unwrap output buffer
+ based on querying the unwrapped key size, but the AES-WRAP-PAD unwrap
+ primitive can write and cleanse more bytes than that query reports, causing
+ an 8-byte out-of-bounds heap write.
+
+ Impact summary: An attacker who supplies a crafted CMS message can trigger
+ a deterministic 8-byte out-of-bounds heap write when the victim decrypts it
+ with `CMS_decrypt()`, corrupting the heap and typically resulting in a Denial
+ of Service.
+
+ Reported by: Bhabani Sankar Das and Filipe Casal (Trail of Bits).
+
+ ([CVE-2026-63072])
+
+ *Daniel Kubec*
+
+ * Fixed invalid pointer dereference in CMP server via crafted `protectionAlg`.
+
+ Severity: Moderate
+
+ Issue Summary: The OpenSSL Certificate Management Protocol (CMP)
+ password-based protection verification only checks whether
+ the `protectionAlg` parameter was not NULL and not its ASN.1 type,
+ before treating it as a `PBMParameter`. A crafted message can contain
+ a parameter of a different type, which is then dereferenced as an invalid
+ pointer.
+
+ Impact summary: A remote, unauthenticated attacker can crash an application
+ acting as a CMP server that accepts PBM-protected messages, or a CMP client
+ talking to a malicious or intercepted CMP server, resulting in a Denial
+ of Service.
+
+ Reported by: Ying Dong and Bhabani Sankar Das.
+
+ ([CVE-2026-63076])
+
+ *Daniel Kubec*
+
+ * Fixed unbounded memory growth in QUIC server incoming channel queue.
+
+ Severity: Low
+
+ Issue summary: When an OpenSSL QUIC server (Listener SSL object) processes
+ valid QUIC Initial packets for unknown destination connection IDs, it can
+ allocate and queue new incoming channels without enforcing any limit.
+
+ Impact summary: A remote peer that can make many `INITIAL` packets reach
+ the server listener faster than the application accepts connections can
+ cause the memory allocated to store the per-channel state to grow
+ without any limits, potentially making the QUIC listener unavailable
+ and causing a Denial of Service.
+
+ Reported by: Filipe Casal (Trail of Bits) in collaboration with OpenAI.
+
+ ([CVE-2026-14456])
+ <!-- https://github.com/openssl/openssl/pull/32052 -->
+
+ *Filipe Casal*
+
+ * Fixed RPK server signature algorithm selection being able to dereference
+ a missing certificate.
+
+ Severity: Low
+
+ Issue summary: In a server or client configuration with [RFC 7250] Raw Public
+ Keys (RPKs) enabled, and only the private key (with no associated
+ certificate) configured locally, a NULL pointer dereference may occur
+ when the remote peer solicits raw public keys and also sends the typically
+ omitted `signature_algorithms_cert` TLS extension.
+
+ Impact summary: The impact is limited to a possible Denial of Service
+ as a result of an application abort, no data disclosure or remote command
+ execution are possible.
+
+ Reported by: Filipe Casal (Trail of Bits) in collaboration with OpenAI.
+
+ ([CVE-2026-14457])
+
+ *Viktor Dukhovni*
+
+ * Fixed excessive memory use buffering DTLS records for a future epoch.
+
+ Severity: Low
+
+ Issue summary: Receiving a DTLS record for a future epoch while a handshake
+ is in progress causes OpenSSL to buffer far more memory than the record
+ itself requires.
+
+ Impact summary: A peer can use a small amount of network traffic to make
+ an OpenSSL DTLS endpoint retain a disproportionately large amount of memory,
+ which may lead to a Denial of Service.
+
+ Reported by: Amazon Web Services.
+
+ ([CVE-2026-54874])
+
+ *Matt Caswell*
+
+ * Fixed untrusted Sender DN being used as a format string in CMP response
+ validation.
+
+ Severity: Low
+
+ Issue Summary: The OpenSSL Certificate Management Protocol (CMP) response
+ validation passed an unexpected response sender distinguished name directly
+ as the format string to `ERR_raise_data()`.
+
+ Impact summary: A malicious or intercepted CMP endpoint can crash a CMP
+ client that enforces an expected sender or uses a pinned server certificate
+ whose subject becomes the default expected sender.
+
+ Reported by: Filipe Casal (Trail of Bits) in collaboration with OpenAI,
+ Brandon Luo, and TrendAI Zero Day Initiative.
+
+ ([CVE-2026-63073])
+
+ *Filipe Casal*
+
+ * Fixed CMP indefinite cache growth of `extraCerts`.
+
+ Severity: Low
+
+ Issue Summary: The OpenSSL Certificate Management Protocol (CMP) caches
+ additional certificates (`extraCerts`) sent in a CMP message, but never
+ expunges them (for instance, if they are invalid). If a server reuses
+ an `OSSL_CMP_CTX` object frequently, this cache of `extraCerts` may grow
+ unboundedly, and a malicious client may flood a CMP server with requests
+ driving this growth.
+
+ Impact Summary: Users utilizing a CMP server that reuses a single
+ `OSSL_CMP_CTX` object for the lifetime of a server process may observe
+ unbounded memory growth in the event a malicious client repeatedly sends
+ requests containing unique extra certificates, which may lead to OOM
+ conditions.
+
+ Reported by: Pavol Zacik (Red Hat).
+
+ ([CVE-2026-63074])
+
+ *Neil Horman*
+
+ * Fixed QUIC ACK-only packet retention being able to cause memory exhaustion.
+
+ Severity: Low
+
+ Issue Summary: When OpenSSL processes QUIC traffic from a peer
+ that repeatedly sends ACK-eliciting packets while not acknowledging ACK-only
+ responses, the QUIC stack can retain ACK-only packet metadata
+ for the lifetime of the connection.
+
+ Impact Summary: A remote peer that can complete a QUIC handshake can cause
+ connection-scoped memory growth, which may lead to a Denial of Service
+ through memory exhaustion, especially with sustained traffic or many
+ concurrent QUIC connections.
+
+ Reported by: Opal Wright (Trail of Bits).
+
+ ([CVE-2026-63075])
+
+ *Neil Horman*
+
+ * Fixed possibility of AEAD forgeries with empty ciphertext when using
+ `EVP_Cipher()`.
+
+ Severity: Low
+
+ Issue summary: ChaCha20-Poly1305 and AES-OCB decryption with an empty
+ ciphertext can report success without verifying the supplied authentication
+ tag when the operation is finalized by calling the `EVP_Cipher()` function.
+
+ Impact summary: Applications calling `EVP_Cipher()` on an empty ciphertext
+ and expecting the call to check the AEAD tag may accept forged messages.
+
+ Reported by: Billy Brumley (Rochester Institute of Technology).
+
+ ([CVE-2026-75803])
+ <!-- https://github.com/openssl/openssl/pull/32416 -->
+
+ *Billy Bob Brumley*
+
+ * Added `OPENSSL_armcap(3)` documentation page.
+ <!-- https://github.com/openssl/openssl/pull/31749 -->
+
+ *Paul Elliott*
+
+ * Added support for selecting assembly code paths for LLVM-based Intel's `icx`
+ compiler.
+ <!-- https://github.com/openssl/openssl/pull/31572 -->
+
+ *Wolfgang Beck*
+
+ * Updated compliance with TLS 1.3 session ticket lifetime requirements.
+ TLS 1.3 clients now cap `ticket_lifetime_hint` to 7 days (604800 seconds)
+ when processing new session ticket messages, in accordance
+ with [RFC 8446 Section 4.6.1].
+ <!-- https://github.com/openssl/openssl/pull/31174 -->
+
+ *Abel Thomas*
+
+ * Fixed checking of authentication tags for empty ciphertexts for AEAD ciphers
+ in CCM cipher mode.
+ <!-- https://github.com/openssl/openssl/pull/32427 -->
+
+ *Mounir IDRASSI*
+
### Changes between 3.5.6 and 3.5.7 [9 Jun 2026]
* Fixed heap use-after-free in `PKCS7_verify()`.
@@ -306,6 +537,21 @@ OpenSSL 3.5
*Dmitry Belyavskiy (Red Hat)*
+ * Fixed excessive allocation of the handshake message buffer (aka HollowByte).
+
+ Previously, we would allocate a buffer large enough to hold the full size of
+ an incoming handshake message as advertised by the peer. This could be quite
+ large (although it is bounded, e.g. for ClientHello this is approximately
+ 128 KiB). If the peer then fails to send the full handshake message, then the
+ endpoint is left waiting for the remainder of the message to arrive and the
+ memory is still allocated (i.e. a Slowloris attack). To prevent this, we
+ incrementally grow the buffer as we receive the data.
+
+ This issue was reported by Okta Red Team.
+ <!-- https://github.com/openssl/openssl/pull/30793 -->
+
+ *Matt Caswell*
+
* Fixed TLS 1.3 server not sending `NewSessionTicket` message
after ciphersuite mismatch.
<!-- https://github.com/openssl/openssl/pull/30626 -->
@@ -22260,6 +22506,9 @@ ndif
[CVE-2026-2673]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-2673
[CVE-2026-7383]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-7383
[CVE-2026-9076]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-9076
+[CVE-2026-14456]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-14456
+[CVE-2026-14457]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-14457
+[CVE-2026-18798]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-18798
[CVE-2026-22795]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-22795
[CVE-2026-22796]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-22796
[CVE-2026-28387]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-28387
@@ -22281,9 +22530,18 @@ ndif
[CVE-2026-45445]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-45445
[CVE-2026-45446]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-45446
[CVE-2026-45447]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-45447
+[CVE-2026-54874]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-54874
+[CVE-2026-63072]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-63072
+[CVE-2026-63073]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-63073
+[CVE-2026-63074]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-63074
+[CVE-2026-63075]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-63075
+[CVE-2026-63076]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-63076
+[CVE-2026-75803]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-75803
[ESV]: https://csrc.nist.gov/Projects/cryptographic-module-validation-program/entropy-validations
[RFC 2578 (STD 58), section 3.5]: https://datatracker.ietf.org/doc/html/rfc2578#section-3.5
[RFC 3211]: https://datatracker.ietf.org/doc/html/rfc3211
[RFC 5297]: https://datatracker.ietf.org/doc/html/rfc5297
+[RFC 7250]: https://datatracker.ietf.org/doc/html/rfc7250
[RFC 8446]: https://datatracker.ietf.org/doc/html/rfc8446
+[RFC 8446 Section 4.6.1]: https://datatracker.ietf.org/doc/html/rfc8446#section-4.6.1
[RFC 8452]: https://datatracker.ietf.org/doc/html/rfc8452
diff --git a/crypto/openssl/CONTRIBUTING.md b/crypto/openssl/CONTRIBUTING.md
index 06dfbaeff1fe..8a0d40524ddb 100644
--- a/crypto/openssl/CONTRIBUTING.md
+++ b/crypto/openssl/CONTRIBUTING.md
@@ -70,7 +70,37 @@ guidelines:
git push -f [<repository> [<branch>]]
```
- 2. All source files should start with the following text (with
+ 2. Similarly, if a non-trivial portion of a contribution was created
+ using an AI tool, you must declare which agent and model were used.
+ This is done by adding `Assisted-by: {agent}:{model}` below the commit
+ message:
+
+ ```
+ One-line summary of change with AI-generated portions
+
+ Assisted-by: Claude:claude-sonnet-4-6
+ ```
+
+ Multiple Assisted-by trailers can be included if multiple tools were used:
+
+ ```
+ Assisted-by: Claude:claude-sonnet-4-6
+ Assisted-by: ChatGPT:gpt-4o
+ Assisted-by: GitHub Copilot:gpt-4.1
+ ```
+
+ You will need to have signed a v1.1 or later CLA in order to
+ include AI-generated content in your contribution. CLAs signed
+ after June 2026 will have the requisite clauses.
+
+ Consult the [OpenSSL AI Code and Documentation Contribution
+ Policy] if an AI model assisted with the creation of your
+ contribution.
+
+ [OpenSSL AI Code and Documentation Contribution
+ Policy]: <https://openssl-library.org/policies/general/ai-policy/>
+
+ 3. All source files should start with the following text (with
appropriate comment characters at the start of each line and the
year(s) updated):
@@ -83,11 +113,11 @@ guidelines:
https://www.openssl.org/source/license.html
```
- 3. Patches should be as current as possible; expect to have to rebase
+ 4. Patches should be as current as possible; expect to have to rebase
often. We do not accept merge commits, you will have to remove them
(usually by rebasing) before it will be acceptable.
- 4. Code provided should follow our [coding style] and [documentation policy]
+ 5. Code provided should follow our [coding style] and [documentation policy]
and compile without warnings.
There is a [Perl tool](util/check-format.pl) that helps
finding code formatting mistakes and other coding style nits.
@@ -100,16 +130,16 @@ guidelines:
[coding style]: https://openssl-library.org/policies/technical/coding-style/
[documentation policy]: https://openssl-library.org/policies/technical/documentation-policy/
- 5. When at all possible, code contributions should include tests. These can
+ 6. When at all possible, code contributions should include tests. These can
either be added to an existing test, or completely new. Please see
[test/README.md](test/README.md) for information on the test framework.
- 6. New features or changed functionality must include
+ 7. New features or changed functionality must include
documentation. Please look at the `.pod` files in `doc/man[1357]` for
examples of our style. Run `make doc-nits` to make sure that your
documentation changes are clean.
- 7. For user visible changes (API changes, behaviour changes, ...),
+ 8. For user visible changes (API changes, behaviour changes, ...),
consider adding a note in [CHANGES.md](CHANGES.md).
This could be a summarising description of the change, and could
explain the grander details.
@@ -120,5 +150,5 @@ guidelines:
with a specific release without having to sift through the higher
noise ratio in git-log.
- 8. Guidelines on how to integrate error output of new crypto library modules
+ 9. Guidelines on how to integrate error output of new crypto library modules
can be found in [crypto/err/README.md](crypto/err/README.md).
diff --git a/crypto/openssl/NEWS.md b/crypto/openssl/NEWS.md
index 04d0bd72c7f5..329b1772c348 100644
--- a/crypto/openssl/NEWS.md
+++ b/crypto/openssl/NEWS.md
@@ -23,6 +23,50 @@ OpenSSL Releases
OpenSSL 3.5
-----------
+### Major changes between OpenSSL 3.5.7 and OpenSSL 3.5.8 [25 Aug 2026]
+
+OpenSSL 3.5.8 is a security patch release. The most severe CVE fixed
+in this release is Moderate.
+
+This release incorporates the following bug fixes and mitigations:
+
+ * Fixed QUIC server being able to trigger double free when processing
+ `INITIAL` packet.
+ ([CVE-2026-18798])
+
+ * Fixed heap buffer overflow in CMS key unwrapping.
+ ([CVE-2026-63072])
+
+ * Fixed invalid pointer dereference in CMP server via crafted `protectionAlg`.
+ ([CVE-2026-63076])
+
+ * Fixed unbounded memory growth in QUIC server incoming channel queue.
+ ([CVE-2026-14456])
+
+ * Fixed RPK server signature algorithm selection being able to dereference
+ a missing certificate.
+ ([CVE-2026-14457])
+
+ * Fixed excessive memory use buffering DTLS records for a future epoch.
+ ([CVE-2026-54874])
+
+ * Fixed untrusted Sender DN being used as a format string in CMP response
+ validation.
+ ([CVE-2026-63073])
+
+ * Fixed CMP indefinite cache growth of `extraCerts`.
+ ([CVE-2026-63074])
+
+ * Fixed QUIC ACK-only packet retention being able to cause memory exhaustion.
+ ([CVE-2026-63075])
+
+ * Fixed possibility of AEAD forgeries with empty ciphertext when using
+ `EVP_Cipher()`.
+ ([CVE-2026-75803])
+
+ * Fixed checking of authentication tags for empty ciphertexts for AEAD ciphers
+ in CCM cipher mode.
+
### Major changes between OpenSSL 3.5.6 and OpenSSL 3.5.7 [9 Jun 2026]
OpenSSL 3.5.7 is a security patch release. The most severe CVE fixed
@@ -78,6 +122,8 @@ This release incorporates the following bug fixes and mitigations:
and AES-SIV modes.
([CVE-2026-45446])
+ * Fixed excessive allocation of the handshake message buffer (aka HollowByte).
+
### Major changes between OpenSSL 3.5.5 and OpenSSL 3.5.6 [7 Apr 2026]
OpenSSL 3.5.6 is a security patch release. The most severe CVE fixed in this
@@ -2267,6 +2313,9 @@ OpenSSL 0.9.x
[CVE-2026-2673]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-2673
[CVE-2026-7383]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-7383
[CVE-2026-9076]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-9076
+[CVE-2026-14456]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-14456
+[CVE-2026-14457]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-14457
+[CVE-2026-18798]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-18798
[CVE-2026-22795]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-22795
[CVE-2026-22796]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-22796
[CVE-2026-28387]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-28387
@@ -2288,6 +2337,13 @@ OpenSSL 0.9.x
[CVE-2026-45445]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-45445
[CVE-2026-45446]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-45446
[CVE-2026-45447]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-45447
+[CVE-2026-54874]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-54874
+[CVE-2026-63072]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-63072
+[CVE-2026-63073]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-63073
+[CVE-2026-63074]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-63074
+[CVE-2026-63075]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-63075
+[CVE-2026-63076]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-63076
+[CVE-2026-75803]: https://openssl-library.org/news/vulnerabilities/#CVE-2026-75803
[ESV]: https://csrc.nist.gov/Projects/cryptographic-module-validation-program/entropy-validations
[OpenSSL Guide]: https://www.openssl.org/docs/manmaster/man7/ossl-guide-introduction.html
[README-QUIC.md]: ./README-QUIC.md
diff --git a/crypto/openssl/README-FIPS.md b/crypto/openssl/README-FIPS.md
index b31f8c65304b..feb6892a2c47 100644
--- a/crypto/openssl/README-FIPS.md
+++ b/crypto/openssl/README-FIPS.md
@@ -32,11 +32,15 @@ Installing the FIPS provider
============================
In order to be FIPS compliant you must only use FIPS validated source code.
-Refer to <https://www.openssl.org/source/> for information related to
+Refer to <https://openssl-library.org/source/> for information related to
which versions are FIPS validated. The instructions given below build OpenSSL
-just using the FIPS validated source code. Any FIPS validated version may be
-used with any other openssl library. Please see <https://www.openssl.org/source/>
-To determine which FIPS validated library version may be appropriate for you.
+just using the FIPS validated source code. A FIPS provider built from any
+validated version may be used together with an OpenSSL library built from any
+supported release from OpenSSL 3.0 onwards; provider compatibility is
+maintained backward and forward across these releases, including future major
+release series, for as long as the module remains supported. Please see
+<https://openssl-library.org/source/>
+to determine which FIPS validated library version may be appropriate for you.
If you want to use a validated FIPS provider, but also want to use the latest
OpenSSL release to build everything else, then refer to the next section.
diff --git a/crypto/openssl/VERSION.dat b/crypto/openssl/VERSION.dat
index a297eee91e17..bf654c1a7713 100644
--- a/crypto/openssl/VERSION.dat
+++ b/crypto/openssl/VERSION.dat
@@ -1,7 +1,7 @@
MAJOR=3
MINOR=5
-PATCH=7
+PATCH=8
PRE_RELEASE_TAG=
BUILD_METADATA=
-RELEASE_DATE="9 Jun 2026"
+RELEASE_DATE="25 Aug 2026"
SHLIB_VERSION=3
diff --git a/crypto/openssl/apps/lib/apps.c b/crypto/openssl/apps/lib/apps.c
index e5a2b162b4ef..29dd6514f6d9 100644
--- a/crypto/openssl/apps/lib/apps.c
+++ b/crypto/openssl/apps/lib/apps.c
@@ -1688,11 +1688,18 @@ CA_DB *load_index(const char *dbfile, DB_ATTR *db_attr)
goto err;
#ifndef OPENSSL_NO_POSIX_IO
- BIO_get_fp(in, &dbfp);
- if (fstat(fileno(dbfp), &dbst) == -1) {
- ERR_raise_data(ERR_LIB_SYS, errno,
- "calling fstat(%s)", dbfile);
- goto err;
+ if (BIO_get_fp(in, &dbfp) > 0 && dbfp != NULL) {
+ if (fstat(fileno(dbfp), &dbst) == -1) {
+ ERR_raise_data(ERR_LIB_SYS, errno,
+ "calling fstat(%s)", dbfile);
+ goto err;
+ }
+ } else {
+ if (stat(dbfile, &dbst) == -1) {
+ ERR_raise_data(ERR_LIB_SYS, errno,
+ "calling stat(%s)", dbfile);
+ goto err;
+ }
}
#endif
@@ -1722,8 +1729,14 @@ CA_DB *load_index(const char *dbfile, DB_ATTR *db_attr)
}
retdb->dbfname = OPENSSL_strdup(dbfile);
- if (retdb->dbfname == NULL)
+ if (retdb->dbfname == NULL) {
+ TXT_DB_free(retdb->db);
+ retdb->db = NULL;
+ OPENSSL_free(retdb);
+ retdb = NULL;
+ ERR_raise_data(ERR_LIB_SYS, errno, "Out of memory while copying filename: %s", dbfile);
goto err;
+ }
#ifndef OPENSSL_NO_POSIX_IO
retdb->dbst = dbst;
diff --git a/crypto/openssl/apps/lib/s_cb.c b/crypto/openssl/apps/lib/s_cb.c
index 80b5c6555424..760ad010988b 100644
--- a/crypto/openssl/apps/lib/s_cb.c
+++ b/crypto/openssl/apps/lib/s_cb.c
@@ -1,5 +1,5 @@
/*
- * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2026 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
@@ -1461,10 +1461,7 @@ static STRINT_PAIR callback_types[] = {
{ "Signature Algorithm mask", SSL_SECOP_SIGALG_MASK },
{ "Certificate chain EE key", SSL_SECOP_EE_KEY },
{ "Certificate chain CA key", SSL_SECOP_CA_KEY },
- { "Peer Chain EE key", SSL_SECOP_PEER_EE_KEY },
- { "Peer Chain CA key", SSL_SECOP_PEER_CA_KEY },
{ "Certificate chain CA digest", SSL_SECOP_CA_MD },
- { "Peer chain CA digest", SSL_SECOP_PEER_CA_MD },
{ "SSL compression", SSL_SECOP_COMPRESSION },
{ "Session ticket", SSL_SECOP_TICKET },
{ NULL }
@@ -1498,7 +1495,6 @@ static int security_callback_debug(const SSL *s, const SSL_CTX *ctx,
show_nm = 0;
break;
case SSL_SECOP_CA_MD:
- case SSL_SECOP_PEER_CA_MD:
cert_md = 1;
break;
case SSL_SECOP_SIGALG_SUPPORTED:
diff --git a/crypto/openssl/apps/lib/vms_term_sock.c b/crypto/openssl/apps/lib/vms_term_sock.c
index faceb05d0145..15bc6665694d 100644
--- a/crypto/openssl/apps/lib/vms_term_sock.c
+++ b/crypto/openssl/apps/lib/vms_term_sock.c
@@ -1,5 +1,5 @@
/*
- * Copyright 2016-2022 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2016-2026 The OpenSSL Project Authors. All Rights Reserved.
* Copyright 2016 VMS Software, Inc. All Rights Reserved.
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
@@ -230,6 +230,7 @@ int TerminalSocket(int FunctionCode, int *ReturnSocket)
LogMessage("TerminalSocket: SYS$QIO () - %08X", status);
close(TerminalSocketPair[0]);
close(TerminalSocketPair[1]);
+ sys$dassgn(TerminalDeviceChan);
return TERM_SOCK_FAILURE;
}
@@ -248,6 +249,7 @@ int TerminalSocket(int FunctionCode, int *ReturnSocket)
LogMessage("TerminalSocket: SYS$CANCEL () - %08X", status);
close(TerminalSocketPair[0]);
close(TerminalSocketPair[1]);
+ sys$dassgn(TerminalDeviceChan);
return TERM_SOCK_FAILURE;
}
diff --git a/crypto/openssl/apps/s_client.c b/crypto/openssl/apps/s_client.c
index 9b88d6dfbc86..b3f333a6993c 100644
--- a/crypto/openssl/apps/s_client.c
+++ b/crypto/openssl/apps/s_client.c
@@ -2846,11 +2846,9 @@ re_start:
}
/*
* According to RFC 5804 § 2.2, response codes are case-
- * insensitive, make it uppercase but preserve the response.
+ * insensitive.
*/
- strncpy(sbuf, mbuf, 2);
- make_uppercase(sbuf);
- if (!HAS_PREFIX(sbuf, "OK")) {
+ if (OPENSSL_strncasecmp(mbuf, "OK", 2) != 0) {
BIO_printf(bio_err, "STARTTLS not supported: %s", mbuf);
goto shut;
}
@@ -3349,29 +3347,32 @@ shut:
print_stuff(bio_c_out, con, full_log);
do_ssl_shutdown(con);
- /*
- * If we ended with an alert being sent, but still with data in the
- * network buffer to be read, then calling BIO_closesocket() will
- * result in a TCP-RST being sent. On some platforms (notably
- * Windows) then this will result in the peer immediately abandoning
- * the connection including any buffered alert data before it has
- * had a chance to be read. Shutting down the sending side first,
- * and then closing the socket sends TCP-FIN first followed by
- * TCP-RST. This seems to allow the peer to read the alert data.
- */
- shutdown(SSL_get_fd(con), 1); /* SHUT_WR */
- /*
- * We just said we have nothing else to say, but it doesn't mean that
- * the other side has nothing. It's even recommended to consume incoming
- * data. [In testing context this ensures that alerts are passed on...]
- */
- timeout.tv_sec = 0;
- timeout.tv_usec = 500000; /* some extreme round-trip */
- do {
- FD_ZERO(&readfds);
- openssl_fdset(sock, &readfds);
- } while (select(sock + 1, &readfds, NULL, NULL, &timeout) > 0
- && BIO_read(sbio, sbuf, BUFSIZZ) > 0);
+ /* The following half-close/drain workaround is TCP-specific. */
+ if (!isdtls && !isquic) {
+ /*
+ * If we ended with an alert being sent, but still with data in the
+ * network buffer to be read, then calling BIO_closesocket() will
+ * result in a TCP-RST being sent. On some platforms (notably
+ * Windows) then this will result in the peer immediately abandoning
+ * the connection including any buffered alert data before it has
+ * had a chance to be read. Shutting down the sending side first,
+ * and then closing the socket sends TCP-FIN first followed by
+ * TCP-RST. This seems to allow the peer to read the alert data.
+ */
+ shutdown(SSL_get_fd(con), 1); /* SHUT_WR */
+ /*
+ * We just said we have nothing else to say, but it doesn't mean that
+ * the other side has nothing. It's even recommended to consume incoming
+ * data. [In testing context this ensures that alerts are passed on...]
+ */
+ timeout.tv_sec = 0;
+ timeout.tv_usec = 500000; /* some extreme round-trip */
+ do {
+ FD_ZERO(&readfds);
+ openssl_fdset(sock, &readfds);
+ } while (select(sock + 1, &readfds, NULL, NULL, &timeout) > 0
+ && BIO_read(sbio, sbuf, BUFSIZZ) > 0);
+ }
BIO_closesocket(SSL_get_fd(con));
end:
diff --git a/crypto/openssl/crypto/aes/aes_x86core.c b/crypto/openssl/crypto/aes/aes_x86core.c
deleted file mode 100644
index 0fa994871b27..000000000000
--- a/crypto/openssl/crypto/aes/aes_x86core.c
+++ /dev/null
@@ -1,867 +0,0 @@
-/*
- * Copyright 2006-2016 The OpenSSL Project Authors. All Rights Reserved.
- *
- * Licensed under the Apache License 2.0 (the "License"). You may not use
- * this file except in compliance with the License. You can obtain a copy
- * in the file LICENSE in the source distribution or at
- * https://www.openssl.org/source/license.html
- */
-
-/*
- * This is experimental x86[_64] derivative. It assumes little-endian
- * byte order and expects CPU to sustain unaligned memory references.
- * It is used as playground for cache-time attack mitigations and
- * serves as reference C implementation for x86[_64] as well as some
- * other assembly modules.
- */
*** 95278 LINES SKIPPED ***