[ubuntu/resolute-security] openssl 3.5.5-1ubuntu3.5 (Accepted)

[Marc Deslauriers]

openssl (3.5.5-1ubuntu3.5) resolute-security; urgency=medium

  * SECURITY UPDATE: AEAD Forgeries with Empty Ciphertext When Using
    EVP_Cipher()
    - debian/patches/CVE-2026-75803-1.patch: Check the tag on EVP_Cipher()
      finalize: Poly1305 and OCB AEADs in
      providers/implementations/ciphers/cipher_aes_gcm_siv_hw.c,
      providers/implementations/ciphers/cipher_aes_ocb.c,
      providers/implementations/ciphers/cipher_chacha20_poly1305.c.
    - debian/patches/CVE-2026-75803-2.patch: Add tests for empty AEAD
      EVP_Cipher() finalization in test/evp_extra_test.c.
    - CVE-2026-75803

Date: 2026-08-26 12:22:11.968924+00:00
Changed-By: Marc Deslauriers <marc.deslauriers at canonical.com>
https://launchpad.net/ubuntu/+source/openssl/3.5.5-1ubuntu3.5
-------------- next part --------------
Sorry, changesfile not available.