openssl (3.0.2-0ubuntu1.27) jammy; urgency=medium

  * Enable ec_nistp_64_gcc_128 optimization on multiple 64-bit
    architectures (LP: #2130576).
    Thanks to Szilárd Pfeiffer <coroner@pfeifferszilard.hu> for the
    bug report and patch.

 -- Ravi Kant Sharma <ravi.kant.sharma@canonical.com>  Wed, 12 Aug 2026 15:10:04 +0200

openssl (3.0.2-0ubuntu1.26) jammy-security; urgency=medium

  * SECURITY UPDATE: HollowByte Denial of Service issue (LP: #2161371)
    - debian/patches/lp2161371.patch: Grow the init_buf incrementally as we
      receive data in ssl/statem/statem.c, ssl/statem/statem_lib.c.
    - No CVE number

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Wed, 29 Jul 2026 12:56:04 -0400

openssl (3.0.2-0ubuntu1.25) jammy-security; urgency=medium

  * SECURITY UPDATE: Heap Buffer Over-read in ASN.1 Content Parsing
    - debian/patches/CVE-2026-34180.patch: Avoid length truncation in
      ASN1_STRING_set in crypto/asn1/tasn_dec.c.
    - CVE-2026-34180
  * SECURITY UPDATE: CMS AuthEnvelopedData Processing May Accept Forged Messages
    - debian/patches/CVE-2026-34182-pre1.patch: Ensure
      ossl_cms_EncryptedContent_init_bio() reports an error on no OID in
      crypto/cms/cms_enc.c, crypto/cms/cms_err.c, crypto/err/openssl.txt,
      include/openssl/cmserr.h.
    - debian/patches/CVE-2026-34182-1.patch: CMS: Produce error when AEAD
      algorithms are used in enveloped data in crypto/cms/cms_enc.c,
      crypto/cms/cms_env.c, crypto/cms/cms_err.c, crypto/cms/cms_local.h,
      crypto/err/openssl.txt, include/openssl/cmserr.h, test/cms-msg/enveloped-
      content-type-for-aes-gcm.pem, test/cmsapitest.c,
      test/recipes/80-test_cms.t.
    - debian/patches/CVE-2026-34182-2.patch: Reject potentially forged encrypted
      CMS AuthEnvelopedData messages in crypto/cms/cms_enc.c.
    - debian/patches/CVE-2026-34182-3.patch: Add tests for CVE-2026-34182 in
      test/cmsapitest.c.
    - CVE-2026-34182
  * SECURITY UPDATE: Possible NULL Dereference in Password-Based CMS Decryption
    - debian/patches/CVE-2026-42766.patch: Fix potential NULL dereference
      processing CMS PasswordRecipientInfo in crypto/cms/cms_pwri.c.
    - CVE-2026-42766
  * SECURITY UPDATE: NULL Pointer Dereference in CRMF EncryptedValue Decryption
    - debian/patches/CVE-2026-42767.patch: Fix potential NULL dereference in
      OSSL_CRMF_ENCRYPTEDVALUE_decrypt() in crypto/crmf/crmf_lib.c.
    - CVE-2026-42767
  * SECURITY UPDATE: FFC-DH Peer Validation Uses Attacker-Supplied q
    - debian/patches/CVE-2026-42770.patch: Match the local q DHX parameter
      against the peer's q in providers/implementations/exchange/dh_exch.c.
    - CVE-2026-42770
  * SECURITY UPDATE: AES-OCB IV Ignored on EVP_Cipher() Path
    - debian/patches/CVE-2026-45445.patch: Apply the buffered IV on the AES-OCB
      EVP_Cipher() path in providers/implementations/ciphers/cipher_aes_ocb.c,
      test/evp_extra_test.c.
    - CVE-2026-45445
  * SECURITY UPDATE: Incorrect Tag Processing for Empty Messages in
    AES-GCM-SIV and AES-SIV modes
    - debian/patches/CVE-2026-45446.patch: Fix handling of empty-ciphertext
      messages in AES-SIV in providers/implementations/ciphers/cipher_aes_siv.c,
      test/evp_extra_test.c.
    - CVE-2026-45446
  * SECURITY UPDATE: Heap Use-After-Free in OpenSSL PKCS7_verify()
    - debian/patches/CVE-2026-45447-pre1.patch: Revert unnecessary
      PKCS7_verify() performance optimization in crypto/pkcs7/pk7_smime.c.
    - debian/patches/CVE-2026-45447-1.patch: Fix possible use-after-free in
      OpenSSL PKCS7_verify() in crypto/pkcs7/pk7_smime.c.
    - debian/patches/CVE-2026-45447-2.patch: Test for CVE-2026-45447 (UAF in
      PKCS7_verify) in test/recipes/80-test_cms.t, test/smime-eml/pkcs7-empty-
      digest-set.eml.
    - CVE-2026-45447
  * SECURITY UPDATE: Possible Heap Buffer Overflow in ASN.1 Multibyte String
    Conversion
    - debian/patches/CVE-2026-7383.patch: Reject oversized inputs in
      ASN1_mbstring_ncopy() in crypto/asn1/a_mbstr.c.
    - CVE-2026-7383
  * SECURITY UPDATE: Out-of-Bounds Read in CMS Password-Based Decryption
    - debian/patches/CVE-2026-9076.patch: cms: kek_unwrap_key: Fix out-of-bounds
      read in check-byte validation in crypto/cms/cms_pwri.c.
    - CVE-2026-9076

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Tue, 02 Jun 2026 15:33:25 -0400

openssl (3.0.2-0ubuntu1.23) jammy-security; urgency=medium

  * SECURITY UPDATE: NULL pointer dereference when processing an OCSP
    response
    - debian/patches/CVE-2026-28387.patch: dane_match_cert() should
      X509_free() on ->mcert instead of OPENSSL_free() in
      crypto/x509/x509_vfy.c.
    - CVE-2026-28387
  * SECURITY UPDATE: NULL Pointer Dereference When Processing a Delta CRL
    - debian/patches/CVE-2026-28388-1.patch: fix NULL Dereference When
      Delta CRL Lacks CRL Number Extension in crypto/x509/x509_vfy.c.
    - debian/patches/CVE-2026-28388-2.patch: Added test in test/*.
    - CVE-2026-28388
  * SECURITY UPDATE: Possible NULL dereference when processing CMS
    KeyAgreeRecipientInfo
    - debian/patches/CVE-2026-28389.patch: Fix NULL deref in
      [ec]dh_cms_set_shared_info in crypto/cms/cms_dh.c,
      crypto/cms/cms_ec.c.
    - CVE-2026-28389
  * SECURITY UPDATE: Possible NULL Dereference When Processing CMS
    KeyTransportRecipientInfo
    - debian/patches/CVE-2026-28390.patch: Fix NULL deref in
      rsa_cms_decrypt in crypto/cms/cms_rsa.c.
    - CVE-2026-28390
  * SECURITY UPDATE: Heap buffer overflow in hexadecimal conversion
    - debian/patches/CVE-2026-31789.patch: avoid possible buffer overflow
      in buf2hex conversion in crypto/o_str.c.
    - CVE-2026-31789
  * SECURITY UPDATE: Incorrect failure handling in RSA KEM RSASVE
    encapsulation
    - debian/patches/CVE-2026-31790-1.patch: validate RSA_public_encrypt()
      result in RSASVE in providers/implementations/kem/rsa_kem.c.
    - debian/patches/CVE-2026-31790-2.patch: test RSA_public_encrypt()
      result in RSASVE in test/evp_extra_test.c.
    - CVE-2026-31790

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Tue, 07 Apr 2026 08:05:56 -0400

openssl (3.0.2-0ubuntu1.21) jammy-security; urgency=medium

  * SECURITY UPDATE: Stack buffer overflow in CMS AuthEnvelopedData parsing
    - debian/patches/CVE-2025-15467-1.patch: correct handling of
      AEAD-encrypted CMS with inadmissibly long IV in crypto/evp/evp_lib.c.
    - debian/patches/CVE-2025-15467-2.patch: some comments to clarify
      functions usage in crypto/asn1/evp_asn1.c.
    - debian/patches/CVE-2025-15467-3.patch: test for handling of
      AEAD-encrypted CMS with inadmissibly long IV in test/cmsapitest.c,
      test/recipes/80-test_cmsapi.t,
      test/recipes/80-test_cmsapi_data/encDataWithTooLongIV.pem.
    - CVE-2025-15467
  * SECURITY UPDATE: Heap out-of-bounds write in BIO_f_linebuffer on short
    writes
    - debian/patches/CVE-2025-68160.patch: fix heap buffer overflow in
      BIO_f_linebuffer in crypto/bio/bf_lbuf.c.
    - CVE-2025-68160
  * SECURITY UPDATE: Unauthenticated/unencrypted trailing bytes with
    low-level OCB function calls
    - debian/patches/CVE-2025-69418.patch: fix OCB AES-NI/HW stream path
      unauthenticated/unencrypted trailing bytes in crypto/modes/ocb128.c.
    - CVE-2025-69418
  * SECURITY UPDATE: Out of bounds write in PKCS12_get_friendlyname() UTF-8
    conversion
    - debian/patches/CVE-2025-69419.patch: check return code of UTF8_putc
      in crypto/asn1/a_strex.c, crypto/pkcs12/p12_utl.c.
    - CVE-2025-69419
  * SECURITY UPDATE: Missing ASN1_TYPE validation in
    TS_RESP_verify_response() function
    - debian/patches/CVE-2025-69420.patch: verify ASN1 object's types
      before attempting to access them as a particular type in
      crypto/ts/ts_rsp_verify.c.
    - CVE-2025-69420
  * SECURITY UPDATE: NULL Pointer Dereference in PKCS12_item_decrypt_d2i_ex
    - debian/patches/CVE-2025-69421.patch: add NULL check in
      crypto/pkcs12/p12_decr.c.
    - CVE-2025-69421
  * SECURITY UPDATE: ASN1_TYPE missing validation and type confusion
    - debian/patches/CVE-2026-2279x.patch: ensure ASN1 types are checked
      before use in apps/s_client.c, crypto/pkcs12/p12_kiss.c,
      crypto/pkcs7/pk7_doit.c.
    - CVE-2026-22795
    - CVE-2026-22796

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Mon, 26 Jan 2026 07:32:08 -0500

openssl (3.0.2-0ubuntu1.20) jammy-security; urgency=medium

  * SECURITY UPDATE: Out-of-bounds read & write in RFC 3211 KEK Unwrap
    - debian/patches/CVE-2025-9230.patch: fix incorrect check of unwrapped
      key size in crypto/cms/cms_pwri.c.
    - CVE-2025-9230

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Thu, 18 Sep 2025 08:06:16 -0400

openssl (3.0.2-0ubuntu1.19) jammy-security; urgency=medium

  * SECURITY UPDATE: Low-level invalid GF(2^m) parameters lead to OOB
    memory access
    - debian/patches/CVE-2024-9143.patch: harden BN_GF2m_poly2arr against
      misuse in crypto/bn/bn_gf2m.c, test/ec_internal_test.c.
    - CVE-2024-9143
  * SECURITY UPDATE: A timing side-channel which could potentially allow
    recovering the private key exists in the ECDSA signature computation
    - debian/patches/CVE-2024-13176.patch: Fix timing side-channel in
      ECDSA signature computation in crypto/bn/bn_exp.c,
      crypto/ec/ec_lib.c, include/crypto/bn.h.
    - CVE-2024-13176

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Wed, 05 Feb 2025 08:19:41 -0500

openssl (3.0.2-0ubuntu1.18) jammy-security; urgency=medium

  * SECURITY UPDATE: Possible denial of service in X.509 name checks
    - debian/patches/CVE-2024-6119.patch: avoid type errors in EAI-related
      name check logic in crypto/x509/v3_utl.c, test/*.
    - CVE-2024-6119

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Tue, 20 Aug 2024 13:27:32 -0400

openssl (3.0.2-0ubuntu1.17) jammy-security; urgency=medium

  * SECURITY UPDATE: unbounded mem growth when processing TLSv1.3 sessions
    - debian/patches/CVE-2024-2511.patch: fix unconstrained session cache
      growth in TLSv1.3 in ssl/ssl_lib.c, ssl/ssl_sess.c,
      ssl/statem/statem_srvr.c.
    - CVE-2024-2511
  * SECURITY UPDATE: checking excessively long DSA keys or params very slow
    - debian/patches/CVE-2024-4603.patch: check DSA parameters for
      excessive sizes before validating in crypto/dsa/dsa_check.c,
      test/recipes/15-test_dsaparam_data/invalid/p10240_q256_too_big.pem.
    - CVE-2024-4603
  * SECURITY UPDATE: use after free with SSL_free_buffers
    - debian/patches/CVE-2024-4741.patch: only free the read buffers if
      we're not using them in ssl/record/rec_layer_s3.c,
      ssl/record/record.h, ssl/ssl_lib.c.
    - CVE-2024-4741
  * SECURITY UPDATE: crash or memory disclosure via SSL_select_next_proto
    - debian/patches/CVE-2024-5535.patch: validate provided client list in
      ssl/ssl_lib.c.
    - CVE-2024-5535

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Tue, 30 Jul 2024 11:18:05 -0400

openssl (3.0.2-0ubuntu1.16) jammy-security; urgency=medium

  * SECURITY UPDATE: Excessive time spent in DH modular-exponentiation
    calcuations when using long exponents.
    - debian/patches/CVE-2022-40735-1.patch: Use the minimum key length
      for known safe primes as per RFC 7919 in crypto/dh/dh_group_params.c,
      crypto/ffc/ffc_backend.c, crypto/ffc/ffc_dh.c,
      crypto/ffc/ffc_key_generate.c, include/internal/ffc.h and
      test/ffc_internal_test.c
    - debian/patches/CVE-2022-40735-2.patch: print DH key length in
      providers/implementations/encode_decode/encode_key2text.c,
      test/recipes/30-test_evp_pkey_provided/DH.priv.txt and
      test/recipes/30-test_evp_pkey_provided/DH.pub.txt
    - debian/patches/CVE-2022-40735-3.patch: test that short private keys
      are generated when using a known safe DH prime in
      test/evp_extra_test2.c
    - debian/patches/CVE-2022-40735-4.patch: copy keylength when copying
      FFC parameters in crypto/ffc/ffc_params.c and test/ffc_internal_test.c
    - CVE-2022-40735

 -- Alex Murray <alex.murray@canonical.com>  Wed, 05 Jun 2024 12:58:14 +0930

# For older changelog entries, run 'apt-get changelog libssl3'
