openssl (3.0.13-0ubuntu3.15) noble-security; urgency=medium
* SECURITY UPDATE: Excessive Memory Use Buffering DTLS Records for a Future
Epoch
- debian/patches/CVE-2026-54874-1.patch: Avoid full read buffer allocation
when buffering DTLS records in ssl/record/rec_layer_d1.c,
ssl/record/record.h, ssl/record/ssl3_record.c.
- debian/patches/CVE-2026-54874-2.patch: ssl/record: lower the DTLS
unprocessed_rcds queue limit in ssl/record/rec_layer_d1.c,
ssl/record/record_local.h, ssl/record/ssl3_record.c.
- CVE-2026-54874
* SECURITY UPDATE: Heap Buffer Overflow in CMS Key Unwrapping
- debian/patches/CVE-2026-63072-1.patch: Add test for CVE-2026-63072 in
test/cmsapitest.c, test/recipes/80-test_cmsapi.t.
- debian/patches/CVE-2026-63072-2.patch: Fix heap buffer overflow (8-byte
OOB write) in AES-WRAP-PAD unwrap in crypto/cms/cms_kari.c.
- CVE-2026-63072
* SECURITY UPDATE: CMP Indefinite Cache Growth of ExtraCerts
- debian/patches/CVE-2026-63074-1.patch: Add a test for restricting growth
in cmp cert cache in test/build.info, test/cmp_extracerts_dos_test.c,
test/recipes/65-test_cmp_msg.t.
- debian/patches/CVE-2026-63074-2.patch: Fix unbounded cert cache growth in
cmp in crypto/cmp/cmp_vfy.c.
- CVE-2026-63074
* SECURITY UPDATE: Invalid Pointer Dereference in CMP Server via Crafted
protectionAlg
- debian/patches/CVE-2026-63076-1.patch: Add test for CVE-2026-63076 in
test/cmp_protect_test.c.
- debian/patches/CVE-2026-63076-2.patch: Fix Remote NULL deref in
ossl_cmp_calc_protection() via crafted protectionAlg in
crypto/cmp/cmp_protect.c.
- CVE-2026-63076
* SECURITY UPDATE: AEAD Forgeries with Empty Ciphertext When Using
EVP_Cipher()
- debian/patches/CVE-2026-75803-1.patch: Check the tag on EVP_Cipher()
finalize: Poly1305 and OCB AEADs in
providers/implementations/ciphers/cipher_aes_ocb.c,
providers/implementations/ciphers/cipher_chacha20_poly1305.c.
- debian/patches/CVE-2026-75803-2.patch: Add tests for empty AEAD
EVP_Cipher() finalization in test/evp_extra_test.c.
- CVE-2026-75803
openssl (3.0.13-0ubuntu3.13) noble; urgency=medium
* Enable ec_nistp_64_gcc_128 optimization on multiple 64-bit
architectures (LP: #2130576).
Thanks to Szilárd Pfeiffer <coroner at pfeifferszilard.hu> for the
bug report and patch.
* Fix /usr/share/doc/openssl/ symlinks (LP: #2107167)
* Fix crypto/ec/asm/ecp_nistp521-ppc64.pl output regex failure
(LP: #2137464)
- d/p/regex_match_ecp_nistp521-ppc64.patch
Date: 2026-08-20 13:28:12.898816+00:00
Changed-By: Marc Deslauriers <marc.deslauriers at canonical.com>
Signed-By: Ubuntu Archive Robot <ubuntu-archive-robot at lists.canonical.com>
https://launchpad.net/ubuntu/+source/openssl/3.0.13-0ubuntu3.15
-------------- next part --------------
Sorry, changesfile not available.