Shubham Chakraborty 402c94c2d7 package/botan: security bump to version 3.11.1 ...

- Update BOTAN_VERSION to 3.11.1
- Remove 0001-Add-more-value-barriers-to-avoid-compiler-induced-side-channels.patch
  as it is already integrated upstream in this version.

Fixed in 3.11.1:
- CVE-2026-34580: Resolve certificate verification bypass bug introduced
  in 3.11.0 (GH #5500)
- CVE-2026-34582: Resolve TLS 1.3 client authentication bypass (GH #5599)

Fixed in 3.11.0:
- CVE-2026-32877: Fix a heap over-read during SM2 decryption (GH #5450)
- CVE-2026-32883: Fix an OCSP response forgery vulnerability (GH #5449)
- CVE-2026-32884: Fix a name constraints bypass for DNS names (GH #5448)

- Remove the --disable-altivec configuration option as it has been removed
  from the Botan build system in version 3.x
- Optimize the --disable-neon logic using the yx pattern.
  In Botan 3.x, the --disable-neon flag is specifically targeted at the
  arm32 architecture. Furthermore, Buildroot's BR2_ARM_CPU_HAS_NEON
  variable is only defined for 32-bit ARM, which previously caused a
  false-positive --disable-neon flag to be passed on AArch64 builds
- Update license.txt hash in botan.hash due to the copyright year update
  to 2026

https://botan.randombit.net/news.html#version-3-11-1-2026-03-31

Signed-off-by: Shubham Chakraborty <chakrabortyshubham66@gmail.com>
[Julien: fix CVE numbers in commit log]
Signed-off-by: Julien Olivain <ju.o@free.fr>

2026-08-08 17:26:45 +02:00

..

botan.hash

…

botan.mk

…

Config.in

…