Update openssl to 3.6.3#256
Open
gominimal-pkgmgr-mgr[bot] wants to merge 2 commits into
Open
Conversation
…warm) Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Update openssl
3.6.2→3.6.3Source:
github:openssl/openssl:in-seriesRelease: https://github.com/openssl/openssl/releases/tag/openssl-3.6.3
Changelog: openssl/openssl@openssl-3.6.2...openssl-3.6.3
Released: unknown (non-GitHub source or tag-only fallback)
Vulnerability impact
Partition analysis at
3.6.3(uses each advisory's fixed-version, vulnerable-range, affected-ranges, and fix-commit ancestry to decide):Vulnerabilities fixed (17)
This update clears 17 vulnerabilities affecting
3.6.2:(openssl, openssl)3.0.21, 3.4.6, 3.5.7, 3.6.3(openssl, openssl)1.0.2zq, 1.1.1zh, 3.0.21, 3.4.6, 3.5.7, 3.6.3(openssl, openssl)3.4.6, 3.5.7, 3.6.3(openssl, openssl)3.4.6, 3.5.7, 3.6.3(openssl, openssl)3.5.7, 3.6.3(openssl, openssl)3.6.3(openssl, openssl)3.0.21, 3.4.6, 3.5.7, 3.6.3(openssl, openssl)1.0.2zq, 1.1.1zh, 3.0.21, 3.4.6, 3.5.7, 3.6.3(openssl, openssl)1.0.2zq, 1.1.1zh, 3.0.21, 3.4.6, 3.5.7, 3.6.3(openssl, openssl)1.0.2zq, 1.1.1zh, 3.0.21, 3.4.6, 3.5.7, 3.6.3(openssl, openssl)3.6.3(openssl, openssl)1.0.2zq, 1.1.1zh, 3.0.21, 3.4.6, 3.5.7, 3.6.3(openssl, openssl)3.0.21, 3.4.6, 3.5.7, 3.6.3(openssl, openssl)3.4.6, 3.5.7, 3.6.3(openssl, openssl)3.0.21, 3.4.6, 3.5.7, 3.6.3(openssl, openssl)3.4.6, 3.5.7, 3.6.3(openssl, openssl)3.0.21, 3.4.6, 3.5.7, 3.6.3Advisory summaries
sufficient input validation on the cipher and tag length fields of
AuthEnvelopedData containers, leading to various pot… (Published 2026-06-09)
element whose content exceeds 2 gigabytes in length may cause a heap buffer
over-read on 64-bit Unix and Unix-like platfo… (Published 2026-06-09)
validation for files that use Password-Based Message Authentication Code 1
(PBMAC1) integrity mechanism allowing a certifi… (Published 2026-06-09)
server or client by flooding it with packets containing PATH_CHALLENGE
frames.
Impact summary: A malicious remote peer can cause an unb… (Published 2026-06-09)
trigger a NULL pointer dereference in the OpenSSL QUIC server with
address validation disabled.
Impact summary: NULL pointer … (Published 2026-06-09)
together with OCSP response checking for the whole chain, a NULL dereference
will happen if the verified chain does not have a … (Published 2026-06-09)
public EVP_Cipher() one-shot interface, the application-supplied
initialisation vector (IV) is silently discarded.
Impact sum… (Published 2026-06-09)
trigger a use-after-free during PKCS#7 signature verification.
Impact summary: A use-after-free may result in process crashes… (Published 2026-06-09)
buffer for Unicode output in ASN1_mbstring_ncopy() can lead to a heap
buffer overflow.
Impact summary: A heap buffer overflow may… (Published 2026-06-09)
processes attacker-supplied CMS data, an attacker-chosen stream-mode KEK
cipher can trigger a heap out-of-bounds read in… (Published 2026-06-09)
a crafted response through the status_request extension, triggering a
double-free in the client's certificate verificatio… (Published 2026-06-09)
can trigger a NULL pointer dereference during CMS decryption.
Impact summary: This NULL pointer dereference leads to an application … (Published 2026-06-09)
server could trigger a NULL pointer dereference in a CMP client application.
Impact summary: A NULL pointer dereference ca… (Published 2026-06-09)
provided in a Root CA key update Certificate Management Protocol (CMP)
message response rendered the certificate validation inef… (Published 2026-06-09)
(RFC 8452) mishandle the authentication of AAD (Additional Authenticated
Data) with an empty ciphertext allowing a forgery of … (Published 2026-06-09)
Bleichenbacher-style attack when an attacker is able to provide the CMS or
S/MIME messages and observe the error code and/… (Published 2026-06-09)
peer key, the peer key is not properly checked for the subgroup membership.
Impact summary: A malicious peer which present… (Published 2026-06-09)
Components changed
CycloneDX component delta (declared materials — the package's own version, not a dependency-tree diff)
openssl3.6.23.6.3openssl-upstream3.6.23.6.3Changes
3.6.23.6.3bc7dc809d1842e4a...c5524dd6bfaa8e8f...gs://minimal-staging-archives/openssl/openssl/openssl-3.6.2.tar.gzgs://minimal-staging-archives/openssl/openssl/openssl-3.6.3.tar.gzApache-2.0Apache-2.0, tarball saysPixarQuality suggestions
testsblock. This package has no standalone tests, so the buildbot will only verify compilation — not functional correctness. Consider adding a minimal smoke test (e.g., a--versionor small round-trip invocation) as part of this PR so future bumps catch regressions. Seepackages/python/build.nclfor a simple example.Created by pkgmgr