[ubuntu/resolute-security] openssl 3.5.5-1ubuntu3.4 (Accepted)

[Marc Deslauriers]

openssl (3.5.5-1ubuntu3.4) resolute-security; urgency=medium

  * SECURITY UPDATE: Unbounded Memory Growth in QUIC Server Incoming Channel
    Queue
    - debian/patches/CVE-2026-14456.patch: QUIC server: limit number of pending
      QUIC channels/connections in doc/man3/SSL_get_value_uint.pod,
      include/internal/quic_port.h, include/openssl/ssl.h.in,
      ssl/quic/quic_impl.c, ssl/quic/quic_port.c, ssl/quic/quic_port_local.h,
      util/other.syms.
    - CVE-2026-14456
  * SECURITY UPDATE: RPK Server Signature Algorithm Selection Can Dereference
    a Missing Certificate
    - debian/patches/CVE-2026-14457.patch: Handle signature_algorithms_cert
      extension in key-only context in ssl/t1_lib.c, test/rpktest.c.
    - CVE-2026-14457
  * SECURITY UPDATE: QUIC Server May Trigger Double Free When Processing
    INITIAL Packet
    - debian/patches/CVE-2026-18798-pre1.patch: quic: remove unused scid from
      port_default_packet_handler in include/internal/quic_channel.h,
      ssl/quic/quic_channel.c, ssl/quic/quic_port.c.
    - debian/patches/CVE-2026-18798.patch: Avoid double free of qrx in
      port_default_packet_handler() in include/internal/quic_record_rx.h,
      ssl/quic/quic_port.c, ssl/quic/quic_record_rx.c.
    - CVE-2026-18798
  * SECURITY UPDATE: Excessive Memory Use Buffering DTLS Records for a Future
    Epoch
    - debian/patches/CVE-2026-54874-1.patch: Avoid full read buffer allocation
      when buffering DTLS next-epoch records in ssl/record/methods/dtls_meth.c.
    - debian/patches/CVE-2026-54874-2.patch: ssl/record/methods/dtls_meth.c:
      lower the unprocessed_rcds queue limit in ssl/record/methods/dtls_meth.c.
    - debian/patches/CVE-2026-54874-3.patch: ssl/record: remove dead DTLS
      processed_rcds record queue in ssl/record/methods/dtls_meth.c,
      ssl/record/methods/recmethod_local.h.
    - CVE-2026-54874
  * SECURITY UPDATE: Heap Buffer Overflow in CMS Key Unwrapping
    - debian/patches/CVE-2026-63072-1.patch: Add test for CVE-2026-63072 in
      test/cmsapitest.c, test/recipes/80-test_cmsapi.t.
    - debian/patches/CVE-2026-63072-2.patch: Fix heap buffer overflow (8-byte
      OOB write) in AES-WRAP-PAD unwrap in crypto/cms/cms_kari.c.
    - CVE-2026-63072
  * SECURITY UPDATE: Untrusted Sender DN Used as Format String in CMP Response
    Validation
    - debian/patches/CVE-2026-63073-1.patch: CMP unexpected sender DN used as
      format string in ERR_raise_data() in crypto/cmp/cmp_vfy.c.
    - debian/patches/CVE-2026-63073-2.patch: Add test for CVE-2026-63073 in
      test/cmp_vfy_test.c.
    - CVE-2026-63073
  * SECURITY UPDATE: CMP Indefinite Cache Growth of ExtraCerts
    - debian/patches/CVE-2026-63074-1.patch: Add a test for restricting growth
      in cmp cert cache in test/build.info, test/cmp_extracerts_dos_test.c,
      test/recipes/65-test_cmp_msg.t.
    - debian/patches/CVE-2026-63074-2.patch: Fix unbounded cert cache growth in
      cmp in crypto/cmp/cmp_vfy.c.
    - CVE-2026-63074
  * SECURITY UPDATE: QUIC ACK-only Packet Retention Can Cause Memory Exhaustion
    - debian/patches/CVE-2026-63075.patch: Don't store ACK-only frames in TX
      history for QUIC. in include/internal/quic_ackm.h, ssl/quic/quic_ackm.c,
      ssl/quic/quic_txp.c.
    - CVE-2026-63075
  * SECURITY UPDATE: Invalid Pointer Dereference in CMP Server via Crafted
    protectionAlg
    - debian/patches/CVE-2026-63076-1.patch: Add test for CVE-2026-63076 in
      test/cmp_protect_test.c.
    - debian/patches/CVE-2026-63076-2.patch: Fix Remote NULL deref in
      ossl_cmp_calc_protection() via crafted protectionAlg in
      crypto/cmp/cmp_protect.c.
    - CVE-2026-63076

Date: 2026-08-18 16:47:47.665638+00:00
Changed-By: Marc Deslauriers <marc.deslauriers at canonical.com>
https://launchpad.net/ubuntu/+source/openssl/3.5.5-1ubuntu3.4
-------------- next part --------------
Sorry, changesfile not available.