mirror of
https://gitlab.com/buildroot.org/buildroot.git
synced 2026-10-17 14:21:46 -09:00
ffa22bebc6
https://github.com/openssl/openssl/releases/tag/openssl-3.6.4
This release incorporates the following bug fixes and mitigations:
Fixed QUIC server being able to trigger double free when processing
INITIAL packet.
(CVE-2026-18798)
Fixed heap buffer overflow in CMS key unwrapping.
(CVE-2026-63072)
Fixed invalid pointer dereference in CMP server via crafted protectionAlg.
(CVE-2026-63076)
Fixed unbounded memory growth in QUIC server incoming channel queue.
(CVE-2026-14456)
Fixed RPK server signature algorithm selection being able to dereference
a missing certificate.
(CVE-2026-14457)
Fixed excessive memory use buffering DTLS records for a future epoch.
(CVE-2026-54874)
Fixed client-side memory leak in OCSP response checking.
(CVE-2026-54876)
Fixed untrusted Sender DN being used as a format string in CMP response
validation.
(CVE-2026-63073)
Fixed CMP indefinite cache growth of extraCerts.
(CVE-2026-63074)
Fixed QUIC ACK-only packet retention being able to cause memory exhaustion.
(CVE-2026-63075)
Fixed possibility of AEAD forgeries with empty ciphertext when using
EVP_Cipher().
(CVE-2026-75803)
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 198317785a)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
6 lines
300 B
Plaintext
6 lines
300 B
Plaintext
# From https://github.com/openssl/openssl/releases/download/openssl-3.6.4/openssl-3.6.4.tar.gz.sha256
|
|
sha256 9bffaa1ad1e07b354c21bd3324ec02fa15579f45a7d0494b3e74bc449b7333ef openssl-3.6.4.tar.gz
|
|
|
|
# License files
|
|
sha256 7d5450cb2d142651b8afa315b5f238efc805dad827d91ba367d8516bc9d49e7a LICENSE.txt
|