Skip to content

openssl 3.5.9 #167

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
DevomB merged 1 commit into from
Sep 30, 2026
Merged

openssl 3.5.9 #167

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion build/config/versions.env
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -47,7 +47,7 @@ V_E2FSPROGS=1.47.1
V_PKGCONF=2.3.0

# --- crypto / security ---
V_OPENSSL=3.5.8
V_OPENSSL=3.5.9
V_CRYPTSETUP=2.8.8
V_LIBCAP=2.78
V_SHADOW=4.16.0
Expand Down
2 changes: 1 addition & 1 deletion sources.lock
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -80,7 +80,7 @@ a107adad2101fecac54ac7f9f0e0a0dd155d954193da55c2340c97f2ff1d814e mtdev-1.1.7.ta
a6fbf060d8d4fff001517a2b94f356bb4366bfbf0ba366366f9d27cc38caa58f nftables-1.1.7.tar.xz
974d6b2f4eeefa25625d34da3cb36bdcebe7fbce40f4c16ac0835fd1c0cbae17 ninja-1.13.2.tar.gz
d44d28a839ea9daf969cc69150fde59910b2b39361dad81a3bd6cbd19218db11 openssh-10.5p1.tar.gz
a8f84a39918ec6415ce765d9b429d313ba97b8143169c172e734b9514464f5b2 openssl-3.5.8.tar.gz
603f5602e2eef00d77fbd429d34dcd5822bb301757a1bc9cdb24c670f1eb859a openssl-3.5.9.tar.gz
f87cee69eec2b4fcbf60a396b030ad6aa3415f192aa5f7ee84cad5e11f7f5ae3 patch-2.8.tar.xz
1fe6f825b487d26c35aa51a35f52fe494d4cfc77b8051f8b1ee3391bf0289bc6 perl-5.40.5.tar.xz
d09c44ebc3bd5bee7021c79f922fe8fb2fb57f7320f55e97ff9914d2346a591c pixman-0.46.4.tar.gz
Expand Down
2 changes: 1 addition & 1 deletion tools/pin-reviews.tsv
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,7 +27,7 @@ file 5.45 5.48 fine 2026-09-19 ChangeLog 5.46 to 5.48: the st
zlib 1.3.1 1.3.2 fine 2026-09-25 1.3.2's security fix, CVE-2026-27171 (crc32_combine never returns when a caller passes a negative length; local, low), is carried as upstream's commit (build/patches/zlib-1.3.1). 1.3.2 also INTRODUCES CVE-2026-85091, a heap overflow in gz_vacate that 1.3.1 does not contain (checked: the function is absent); its fix, upstream df84af25dc, is in no release. The rest of 1.3.1.2 and 1.3.2, read commit by commit, is build, portability and defensive work: NULL checks, zeroed state, inflateCopy and deflateCopy copying only initialised memory, a larger deflateBound for unusual calls. Move when a release carries df84af25dc.
zstd 1.5.6 1.5.7 fine 2026-09-19 Release notes 1.5.7: performance and CLI defaults; no security fix.
libffi 3.5.2 3.8.0 fine 2026-09-19 The x86-64 memory access fixes of 3.4.7 and 3.4.8 are in 3.5.2. 3.6 to 3.8 history read; no upstream security page exists, so this rests on that and an NVD search.
openssl 3.5.8 3.6.4 fine 2026-09-19 3.5.8 is the newest release of the 3.5 LTS series (supported to 2030-04-08) and came out the same day as 3.6.4. The one extra fix in 3.6.4, CVE-2026-54876, affects 3.6 and 4.0 only. 3.6 reaches end of life on 2026-11-01.
openssl 3.5.9 3.6.5 fine 2026-09-30 3.5.9 is the newest release of the 3.5 LTS series (supported to 2030-04-08) and came out the same day as 3.6.5, with the same fixes: CVE-2026-84782 (DTLS retransmission, high), CVE-2026-35189 (CRLDP memory), CVE-2026-35191 and CVE-2026-42772 (QUIC). The one extra fix in 3.6.4, CVE-2026-54876, affects 3.6 and 4.0 only. 3.6 reaches end of life on 2026-11-01.
gettext 0.22.5 1.0 fine 2026-09-19 NEWS 0.23 to 1.0: no security fix. 1.0 changes how po directories are handled.
texinfo 7.1 7.3 fine 2026-09-19 NEWS 7.1.1 to 7.3: no security fix.
libtool 2.4.7 2.6.2 fine 2026-09-19 NEWS 2.5.x and 2.6.x: no security fix.
Expand Down
Loading