SUSE-SU-2026:3835-1

Описание

This update for openssl, openssl-3 fixes the following issues:

OpenSSL is updated to 3.5.0 in SLE-15-SP7: (jsc#PED-16072)

• Enables Post-Quantum Cryptography (PQC) TLS support

Security issues fixed:

• CVE-2026-42764: NULL pointer dereference in QUIC server initial packet handling (bsc#1266347)
• CVE-2026-34182: CMS AuthEnvelopedData Processing May Accept Forged Messages (bsc#1266344)
• CVE-2026-28390: NULL pointer dereference during processing of a crafted CMS EnvelopedData message with KeyTransportRecipientInfo (bsc#1261678)
• CVE-2026-2673: TLS 1.3 servers may choose unexpected key agreement group (bsc#1259652)
• CVE-2025-66199: TLS 1.3 CompressedCertificate excessive memory allocation (bsc#1256833)
• CVE-2025-15469: 'openssl dgst' one-shot codepath silently truncates inputs greater than 16MB (bsc#1256832)
• CVE-2025-11187: Improper validation of PBMAC1 parameters in PKCS#12 MAC verification (bsc#1256829)
• CVE-2025-15468: NULL dereference in SSL_CIPHER_find() function on unknown cipher ID (bsc#1256831)
• CVE-2025-9231: Fix timing side-channel in SM2 algorithm on 64 bit ARM (bsc#1250233)
• CVE-2025-9232: Fix out-of-bounds read in HTTP client no_proxy handling (bsc#1250234)
• CVE-2025-4575: Fix the x509 application adding trusted use instead of rejected use (bsc#1243564)
• CVE-2025-27587: Minerva side channel vulnerability in P-384 (bsc#1243459)
• CVE-2024-12797: Fixed RFC7250 handshakes with unauthenticated servers don't abort as expected. (bsc#1236599)
• CVE-2024-13176: Fixed timing side-channel in ECDSA signature computation.
• CVE-2024-9143: Fixed possible OOB memory access with invalid low-level GF(2^m) elliptic curve parameters.
• CVE-2024-13176: Fix timing side-channel in ECDSA signature computation (bsc#1236136)

POWER performance enhancements:

• Optimized MLDSA NTT, supports p8 and above architectures (jsc#PED-14569)

• Adapt spec file for immutability via systemd-tmpfiles (jsc#PED-14813)

• Fix check %{suse_version} > 1600 (jsc#PED-15816)

• Fix NULL pointer dereference when processing an OCSP response

• Remove showciphers.c in favor of openssl ciphers

• Use %ldconfig_scriptlets

• Enable livepatching support for ppc64le [bsc#1257274]

• Move ssl configuration files to the libopenssl package [bsc#1247463]

• Don't install unneeded NOTES

• Disable LTO for userspace livepatching [jsc#PED-13245]

• Fix P-384 curve on lower-than-P9 PPC64 targets [bsc#1243014]

• FIPS: Fix the speed command in FIPS mode for KMAC

• FIPS: Restore the check to deny SHA1 signatures in FIPS mode and the functionality to allow/deny via crypto-policies. [jsc#PED-12224]

Update to 3.5.0:

• Changes:

  • Default encryption cipher for the req, cms, and smime applications changed from des-ede3-cbc to aes-256-cbc.
  • The default TLS supported groups list has been changed to include and prefer hybrid PQC KEM groups. Some practically unused groups were removed from the default list.
  • The default TLS keyshares have been changed to offer X25519MLKEM768 and and X25519.
  • All BIO_meth_get_*() functions were deprecated.

  • New features:

    • Support for server side QUIC (RFC 9000)
    • Support for 3rd party QUIC stacks including 0-RTT support
    • Support for PQC algorithms (ML-KEM, ML-DSA and SLH-DSA)
    • A new configuration option no-tls-deprecated-ec to disable support for TLS groups deprecated in RFC8422
    • A new configuration option enable-fips-jitter to make the FIPS provider to use the JITTER seed source
    • Support for central key generation in CMP
    • Support added for opaque symmetric key objects (EVP_SKEY)
    • Support for multiple TLS keyshares and improved TLS key establishment group configurability
    • API support for pipelining in provided cipher algorithms

Changes between 3.3.0 and 3.4.0:

• Changes:

  • Deprecation of TS_VERIFY_CTX_set_* functions and addition of replacement TS_VERIFY_CTX_set0_* functions with improved semantics
  • The X25519 and X448 key exchange implementation in the FIPS provider is unapproved and has fips=no property.
  • SHAKE-128 and SHAKE-256 implementations have no default digest length anymore. That means these algorithms cannot be used with EVP_DigestFinal/_ex() unless the xoflen param is set before.
  • Setting config_diagnostics=1 in the config file will cause errors to be returned from SSL_CTX_new() and SSL_CTX_new_ex() if there is an error in the ssl module configuration.
  • An empty renegotiate extension will be used in TLS client hellos instead of the empty renegotiation SCSV, for all connections with a minimum TLS version > 1.0.
  • Deprecation of SSL_SESSION_get_time(), SSL_SESSION_set_time() and SSL_CTX_flush_sessions() functions in favor of their respective _ex functions which are Y2038-safe on platforms with Y2038-safe time_t

• New features:

  • Support for directly fetched composite signature algorithms such as RSA-SHA2-256 including new API functions
  • FIPS indicators support in the FIPS provider and various updates of the FIPS provider required for future FIPS 140-3 validations
  • Implementation of RFC 9579 (PBMAC1) in PKCS#12
  • An optional additional random seed source RNG JITTER using a statically linked jitterentropy library
  • New options -not_before and -not_after for explicit setting start and end dates of certificates created with the req and x509 apps
  • Support for integrity-only cipher suites TLS_SHA256_SHA256 and TLS_SHA384_SHA384 in TLS 1.3, as defined in RFC 9150
  • Support for retrieving certificate request templates and CRLs in CMP
  • Support for additional X.509v3 extensions related to Attribute Certificates
  • Initial Attribute Certificate (RFC 5755) support
  • Possibility to customize ECC groups initialization to use precomputed values to save CPU time and use of this feature by the P-256 implementation

Changes between 3.2.0 and 3.3.0:

• Changes:

  • Optimized AES-CTR for ARM Neoverse V1 and V2
  • Various optimizations for cryptographic routines using RISC-V vector crypto extensions
  • Added assembly implementation for md5 on loongarch64
  • Accept longer context for TLS 1.2 exporters
  • The activate and soft_load configuration settings for providers in openssl.cnf have been updated to require a value of [1|yes|true|on] (in lower or UPPER case) to enable the setting. Conversely a value of [0|no|false|off] will disable the setting.
  • In openssl speed, changed the default hash function used with hmac from md5 to sha256.
  • The -verify option to the openssl crl and openssl req will make the program exit with 1 on failure.
  • The d2i_ASN1_GENERALIZEDTIME(), d2i_ASN1_UTCTIME(), ASN1_TIME_check(), and related functions have been augmented to check for a minimum length of the input string, in accordance with ITU-T X.690 section 11.7 and 11.8.
  • OPENSSL_sk_push() and sk__push() functions now return 0 instead of -1 if called with a NULL stack argument.
  • New limit on HTTP response headers is introduced to HTTP client. The default limit is set to 256 header lines.

• Bug fixes and mitigations:

  • The BIO_get_new_index() function can only be called 127 times before it reaches its upper bound of BIO_TYPE_MASK and will now return -1 once its exhausted.

• new features:

  • Support for qlog for tracing QUIC connections has been added
  • Added APIs to allow configuring the negotiated idle timeout for QUIC connections, and to allow determining the number of additional streams that can currently be created for a QUIC connection.
  • Added APIs to allow disabling implicit QUIC event processing for QUIC SSL objects
  • Added APIs to allow querying the size and utilisation of a QUIC stream's write buffer
  • New API SSL_write_ex2, which can be used to send an end-of-stream (FIN) condition in an optimised way when using QUIC.
  • Limited support for polling of QUIC connection and stream objects in a non-blocking manner.
  • Added a new EVP_DigestSqueeze() API. This allows SHAKE to squeeze multiple times with different output sizes.
  • The BLAKE2s hash algorithm matches BLAKE2b's support for configurable output length.
  • The EVP_PKEY_fromdata function has been augmented to allow for the derivation of CRT (Chinese Remainder Theorem) parameters when requested
  • Added API functions SSL_SESSION_get_time_ex(), SSL_SESSION_set_time_ex() using time_t which is Y2038 safe on 32 bit systems when 64 bit time is enabled.
  • Unknown entries in TLS SignatureAlgorithms, ClientSignatureAlgorithms config options and the respective calls to SSL[_CTX]_set1_sigalgs() and SSL[_CTX]_set1_client_sigalgs() that start with ? character are ignored and the configuration will still be used.
  • Added -set_issuer and -set_subject options to openssl x509 to override the Issuer and Subject when creating a certificate. The -subj option now is an alias for -set_subject.
  • Added several new features of CMPv3 defined in RFC 9480 and RFC 9483
  • New option SSL_OP_PREFER_NO_DHE_KEX, which allows configuring a TLS1.3 server to prefer session resumption using PSK-only key exchange over PSK with DHE, if both are available.
  • New atexit configuration switch, which controls whether the OPENSSL_cleanup is registered when libcrypto is unloaded.
  • Added X509_STORE_get1_objects to avoid issues with the existing X509_STORE_get0_objects API in multi-threaded applications.
  • Support for using certificate profiles and extened delayed delivery in CMP

• FIPS: Mark SHA-1 as non-approved in the SLI. [jsc#PED-12224]

• Introduce --without lto. When %{optflags} contains -flto=, tests cases are also built using -flto= which significantly increases build times, this option disables lto which improve iteration times when developing.

Update to 3.2.4:

• Remove the engines' directories and symlinks that were added to allow parallel installations with openssl-1_1.
• Add ktls capability [bsc#1216950]