CVS commit: pkgsrc/security/openssl

["Adam Ciarcinski" <adam%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   adam
Date:           Tue Aug 25 12:57:01 UTC 2026

Modified Files:
        pkgsrc/security/openssl: Makefile PLIST distinfo

Log Message:
openssl: updated to 3.6.4

OpenSSL 3.6.4 is a security patch release. The most severe CVE fixed
in this release is Moderate.

This release incorporates the following bug fixes and mitigations:

Fixed QUIC server being able to trigger double free when processing
INITIAL packet.
(CVE-2026-18798)

Fixed heap buffer overflow in CMS key unwrapping.
(CVE-2026-63072)

Fixed invalid pointer dereference in CMP server via crafted protectionAlg.
(CVE-2026-63076)

Fixed unbounded memory growth in QUIC server incoming channel queue.
(CVE-2026-14456)

Fixed RPK server signature algorithm selection being able to dereference
a missing certificate.
(CVE-2026-14457)

Fixed excessive memory use buffering DTLS records for a future epoch.
(CVE-2026-54874)

Fixed client-side memory leak in OCSP response checking.
(CVE-2026-54876)

Fixed untrusted Sender DN being used as a format string in CMP response
validation.
(CVE-2026-63073)

Fixed CMP indefinite cache growth of extraCerts.
(CVE-2026-63074)

Fixed QUIC ACK-only packet retention being able to cause memory exhaustion.
(CVE-2026-63075)

Fixed possibility of AEAD forgeries with empty ciphertext when using
EVP_Cipher().
(CVE-2026-75803)

Fixed checking of authentication tags for empty ciphertexts for AEAD ciphers
in CCM cipher mode.


To generate a diff of this commit:
cvs rdiff -u -r1.318 -r1.319 pkgsrc/security/openssl/Makefile
cvs rdiff -u -r1.27 -r1.28 pkgsrc/security/openssl/PLIST
cvs rdiff -u -r1.189 -r1.190 pkgsrc/security/openssl/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/security/openssl/Makefile
diff -u pkgsrc/security/openssl/Makefile:1.318 pkgsrc/security/openssl/Makefile:1.319
--- pkgsrc/security/openssl/Makefile:1.318      Tue Jun  9 14:57:03 2026
+++ pkgsrc/security/openssl/Makefile    Tue Aug 25 12:57:01 2026
@@ -1,9 +1,9 @@
-# $NetBSD: Makefile,v 1.318 2026/06/09 14:57:03 adam Exp $
+# $NetBSD: Makefile,v 1.319 2026/08/25 12:57:01 adam Exp $
 
 # Remember to upload-distfiles when updating OpenSSL -- otherwise it
 # is not possible for users who have bootstrapped without OpenSSL
 # to install it and enable HTTPS fetching.
-DISTNAME=      openssl-3.6.3
+DISTNAME=      openssl-3.6.4
 CATEGORIES=    security
 MASTER_SITES=  ${MASTER_SITE_GITHUB:=openssl/}
 GITHUB_RELEASE=        ${DISTNAME}

Index: pkgsrc/security/openssl/PLIST
diff -u pkgsrc/security/openssl/PLIST:1.27 pkgsrc/security/openssl/PLIST:1.28
--- pkgsrc/security/openssl/PLIST:1.27  Tue Jun  9 14:57:03 2026
+++ pkgsrc/security/openssl/PLIST       Tue Aug 25 12:57:01 2026
@@ -1,4 +1,4 @@
-@comment $NetBSD: PLIST,v 1.27 2026/06/09 14:57:03 adam Exp $
+@comment $NetBSD: PLIST,v 1.28 2026/08/25 12:57:01 adam Exp $
 bin/c_rehash
 bin/openssl
 include/openssl/aes.h
@@ -2641,6 +2641,8 @@ man/man3/MDC2.3
 man/man3/MDC2_Final.3
 man/man3/MDC2_Init.3
 man/man3/MDC2_Update.3
+man/man3/NAME_CONSTRAINTS_check.3
+man/man3/NAME_CONSTRAINTS_check_CN.3
 man/man3/NAME_CONSTRAINTS_free.3
 man/man3/NAME_CONSTRAINTS_new.3
 man/man3/NAMING_AUTHORITY.3
@@ -2811,6 +2813,7 @@ man/man3/OPENSSL_VERSION_PRE_RELEASE.3
 man/man3/OPENSSL_VERSION_TEXT.3
 man/man3/OPENSSL_aligned_alloc.3
 man/man3/OPENSSL_aligned_alloc_array.3
+man/man3/OPENSSL_armcap.3
 man/man3/OPENSSL_atexit.3
 man/man3/OPENSSL_buf2hexstr.3
 man/man3/OPENSSL_buf2hexstr_ex.3
@@ -4697,6 +4700,7 @@ man/man3/SSL_VALUE_EVENT_HANDLING_MODE_E
 man/man3/SSL_VALUE_EVENT_HANDLING_MODE_IMPLICIT.3
 man/man3/SSL_VALUE_EVENT_HANDLING_MODE_INHERIT.3
 man/man3/SSL_VALUE_QUIC_IDLE_TIMEOUT.3
+man/man3/SSL_VALUE_QUIC_MAX_PENDING_CONNS.3
 man/man3/SSL_VALUE_QUIC_STREAM_BIDI_LOCAL_AVAIL.3
 man/man3/SSL_VALUE_QUIC_STREAM_BIDI_REMOTE_AVAIL.3
 man/man3/SSL_VALUE_QUIC_STREAM_UNI_LOCAL_AVAIL.3

Index: pkgsrc/security/openssl/distinfo
diff -u pkgsrc/security/openssl/distinfo:1.189 pkgsrc/security/openssl/distinfo:1.190
--- pkgsrc/security/openssl/distinfo:1.189      Tue Jun  9 14:57:03 2026
+++ pkgsrc/security/openssl/distinfo    Tue Aug 25 12:57:01 2026
@@ -1,7 +1,7 @@
-$NetBSD: distinfo,v 1.189 2026/06/09 14:57:03 adam Exp $
+$NetBSD: distinfo,v 1.190 2026/08/25 12:57:01 adam Exp $
 
-BLAKE2s (openssl-3.6.3.tar.gz) = 805be28e9457a3da03cf81331cc9cda847505771385ebccf33fe84e264593e2a
-SHA512 (openssl-3.6.3.tar.gz) = 4179ad56f285fd27a1c7b294472afdca588e915d4f8a9610e461f34f0678004aebe32e88434ae536a63a7c9aff6607702a3b341e2faacb7899c27d6def4cc92d
-Size (openssl-3.6.3.tar.gz) = 54953005 bytes
+BLAKE2s (openssl-3.6.4.tar.gz) = a53beb887698b14996f8a98efb813a7e91b19d304c7b83e7ebfb1aa1ddcebbf2
+SHA512 (openssl-3.6.4.tar.gz) = 9e7f4039082880357969c0857f33b20a6a4306d1b5e4f8fcbd7ec8dc41edc96e87c526a1db0b8259f5000c4ced84149b03547562ce4f9df35194634a7576dac0
+Size (openssl-3.6.4.tar.gz) = 55003802 bytes
 SHA1 (patch-Configurations_unix-Makefile.tmpl) = ea9b0a0c8de810362813d84a4f85c5ebdedf9fc6
 SHA1 (patch-util_perl_OpenSSL_config.pm) = 3ba3c23046bf69c7d348b4c1c8c8269d83cfa2b4