CVS commit: pkgsrc/security/openssl

["Adam Ciarcinski" <adam%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   adam
Date:           Tue Sep 29 15:52:51 UTC 2026

Modified Files:
        pkgsrc/security/openssl: Makefile PLIST distinfo

Log Message:
openssl: updated to 3.6.5

OpenSSL 3.6.5 is a security patch release. The most severe CVE fixed
in this release is High.

This release incorporates the following bug fixes and mitigations:

Fixed DTLS retransmissions of handshake messages from a stale buffer offset.
(CVE-2026-84782)

Fixed excessive memory allocation in relative CRLDP processing.
(CVE-2026-35189)

Fixed QUIC unvalidated amplification credit may be over-accounted.
(CVE-2026-35191)

Fixed potential CPU DoS via O(n^2) fragment reassembly in QUIC.
(CVE-2026-42772)

Fixed a timing side-channel in scalar multiplication for mon-NIST EC curves.
(CVE-2026-54872)

Fixed QUIC STREAM fragment metadata DoS.
(CVE-2026-54873)

Fixed non-constant-time SM2 scalar multiplication on ARM64 and RISC-V.
(CVE-2026-54875)

Fixed out-of-bounds access after SSL_set_SSL_CTX() during a handshake.
(CVE-2026-72897)

Fixed QUIC connection-level flow control was not enforced for streams.
(CVE-2026-75804)

Fixed a NULL pointer dereference in CMP client revocation response handling.
(CVE-2026-75805)

Fixed an unauthenticated and undersized DTLS 1.2 AEAD record causing DoS.
(CVE-2026-75806)

Fixed a timing side-channel in SM2 signature generation.
(CVE-2026-77696)

Fixed an unbounded RETIRE_CONNECTION_ID backlog in QUIC stack
implementation.
(CVE-2026-84784)

Fixed a bug where EVP_DecryptFinal() incorrectly reported a stale success
on AES-SIV authentication failure.


To generate a diff of this commit:
cvs rdiff -u -r1.320 -r1.321 pkgsrc/security/openssl/Makefile
cvs rdiff -u -r1.28 -r1.29 pkgsrc/security/openssl/PLIST
cvs rdiff -u -r1.190 -r1.191 pkgsrc/security/openssl/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/security/openssl/Makefile
diff -u pkgsrc/security/openssl/Makefile:1.320 pkgsrc/security/openssl/Makefile:1.321
--- pkgsrc/security/openssl/Makefile:1.320      Wed Aug 26 08:24:01 2026
+++ pkgsrc/security/openssl/Makefile    Tue Sep 29 15:52:51 2026
@@ -1,10 +1,9 @@
-# $NetBSD: Makefile,v 1.320 2026/08/26 08:24:01 wiz Exp $
+# $NetBSD: Makefile,v 1.321 2026/09/29 15:52:51 adam Exp $
 
 # Remember to upload-distfiles when updating OpenSSL -- otherwise it
 # is not possible for users who have bootstrapped without OpenSSL
 # to install it and enable HTTPS fetching.
-DISTNAME=      openssl-3.6.4
-PKGREVISION=   1
+DISTNAME=      openssl-3.6.5
 CATEGORIES=    security
 MASTER_SITES=  ${MASTER_SITE_GITHUB:=openssl/}
 GITHUB_RELEASE=        ${DISTNAME}

Index: pkgsrc/security/openssl/PLIST
diff -u pkgsrc/security/openssl/PLIST:1.28 pkgsrc/security/openssl/PLIST:1.29
--- pkgsrc/security/openssl/PLIST:1.28  Tue Aug 25 12:57:01 2026
+++ pkgsrc/security/openssl/PLIST       Tue Sep 29 15:52:51 2026
@@ -1,4 +1,4 @@
-@comment $NetBSD: PLIST,v 1.28 2026/08/25 12:57:01 adam Exp $
+@comment $NetBSD: PLIST,v 1.29 2026/09/29 15:52:51 adam Exp $
 bin/c_rehash
 bin/openssl
 include/openssl/aes.h
@@ -5258,6 +5258,8 @@ man/man3/USERNOTICE_free.3
 man/man3/USERNOTICE_new.3
 man/man3/X509V3_EXT_d2i.3
 man/man3/X509V3_EXT_i2d.3
+man/man3/X509V3_EXT_nconf.3
+man/man3/X509V3_EXT_nconf_nid.3
 man/man3/X509V3_EXT_print.3
 man/man3/X509V3_EXT_print_fp.3
 man/man3/X509V3_add1_i2d.3

Index: pkgsrc/security/openssl/distinfo
diff -u pkgsrc/security/openssl/distinfo:1.190 pkgsrc/security/openssl/distinfo:1.191
--- pkgsrc/security/openssl/distinfo:1.190      Tue Aug 25 12:57:01 2026
+++ pkgsrc/security/openssl/distinfo    Tue Sep 29 15:52:51 2026
@@ -1,7 +1,7 @@
-$NetBSD: distinfo,v 1.190 2026/08/25 12:57:01 adam Exp $
+$NetBSD: distinfo,v 1.191 2026/09/29 15:52:51 adam Exp $
 
-BLAKE2s (openssl-3.6.4.tar.gz) = a53beb887698b14996f8a98efb813a7e91b19d304c7b83e7ebfb1aa1ddcebbf2
-SHA512 (openssl-3.6.4.tar.gz) = 9e7f4039082880357969c0857f33b20a6a4306d1b5e4f8fcbd7ec8dc41edc96e87c526a1db0b8259f5000c4ced84149b03547562ce4f9df35194634a7576dac0
-Size (openssl-3.6.4.tar.gz) = 55003802 bytes
+BLAKE2s (openssl-3.6.5.tar.gz) = d08a63cc272d055412eb67e2e906c31e7067cc64d37ed5443a696e42f77cc7bd
+SHA512 (openssl-3.6.5.tar.gz) = 1243d8ef75be54d38233251a06609eef1f1f1085999bfd85d509cc298498d2820956465eed7bba094d940f08c0f7cf9c5247eca78bb978d12a3c3ea16f2afa4e
+Size (openssl-3.6.5.tar.gz) = 55078161 bytes
 SHA1 (patch-Configurations_unix-Makefile.tmpl) = ea9b0a0c8de810362813d84a4f85c5ebdedf9fc6
 SHA1 (patch-util_perl_OpenSSL_config.pm) = 3ba3c23046bf69c7d348b4c1c8c8269d83cfa2b4