openssl, branch openssl-3.0.21

Prepare for release of 3.0.21

2026-06-09T12:20:40Z

Reviewed-by: Neil Horman Reviewed-by: Saša Nedvědický MergeDate: Tue Jun 9 12:20:45 2026 Release: yes

make update

2026-06-09T12:20:39Z

Reviewed-by: Neil Horman Reviewed-by: Saša Nedvědický MergeDate: Tue Jun 9 12:20:40 2026 Release: yes

Copyright year updates

2026-06-09T12:18:58Z

Reviewed-by: Neil Horman Reviewed-by: Saša Nedvědický MergeDate: Tue Jun 9 12:19:00 2026 Release: yes

CHANGES.md, NEWS.md: update for 3.0.21

2026-06-09T12:17:33Z

3.0.21 CHANGES.md includes the following: * CVE-2026-7383, CVE-2026-9076, CVE-2026-34180, CVE-2026-34182, CVE-2026-42766, CVE-2026-42770, CVE-2026-45445, CVE-2026-45446, CVE-2026-45447 * https://github.com/openssl/openssl/pull/30626 "TLSv1.3: Fix server not sending NewSessionTicket after ciphersuite mismatch" * https://github.com/openssl/openssl/pull/31058 "Validate that a PSK identity is at least one byte long" 3.0.21 NEWS.md includes the following: * CVE-2026-7383, CVE-2026-9076, CVE-2026-34180, CVE-2026-34182, CVE-2026-42766, CVE-2026-42770, CVE-2026-45445, CVE-2026-45446, CVE-2026-45447 Signed-off-by: Eugene Syromiatnikov Reviewed-by: Norbert Pocs Reviewed-by: Milan Broz Reviewed-by: Tomas Mraz MergeDate: Tue Jun 9 11:23:33 2026

Fix potential NULL dereference in OSSL_CRMF_ENCRYPTEDVALUE_get1_encCert()

2026-06-09T12:17:33Z

Check that 'parameter' != NULL before dereferencing in OSSL_CRMF_ENCRYPTEDVALUE_get1_encCert(). Fixes CVE-2026-42767 Co-authored-by: Tomas Mraz Reviewed-by: Eugene Syromiatnikov Reviewed-by: Milan Broz MergeDate: Mon Jun 8 20:40:47 2026 (cherry picked from commit 665d5254083affde9982efca7c41dd01cacc8774)

Test for CVE-2026-45447 (UAF in PKCS7_verify)

2026-06-09T12:17:33Z

The test data were created with a tool developed by Thai Duong . Reviewed-by: Eugene Syromiatnikov Reviewed-by: Norbert Pocs MergeDate: Mon Jun 8 20:32:33 2026

Fix possible use-after-free in OpenSSL PKCS7_verify()

2026-06-09T12:17:33Z

Fixes CVE-2026-45447 Reviewed-by: Eugene Syromiatnikov Reviewed-by: Norbert Pocs MergeDate: Mon Jun 8 20:32:32 2026

Fix handling of empty-ciphertext messages in AES-SIV

2026-06-09T12:16:28Z

AES-SIV: EVP_DecryptUpdate_ex Accepts All-Zero Tag for Empty-Ciphertext Messages on context reuse. Fixes CVE-2026-45446 Reviewed-by: Eugene Syromiatnikov Reviewed-by: Tomas Mraz MergeDate: Mon Jun 8 20:19:02 2026

Apply the buffered IV on the AES-OCB EVP_Cipher() path

2026-06-08T20:04:07Z

aes_ocb_cipher(), the OCB provider's OSSL_FUNC_CIPHER_CIPHER slot, processed input without flushing the buffered IV into the OCB context. Effective nonce was 0 regardless of the caller's IV; EVP_*Final_ex() then emitted a tag depending only on (key, iv). This gave (key, nonce) reuse and single-query universal forgery on the EVP_Cipher() path. Apply update_iv() at the head of aes_ocb_cipher() to mirror the streaming handler. The matching GCM one-shot does this already. Add a cross-driver round-trip test for AES-{GCM,CCM,OCB} and ChaCha20-Poly1305 in test/evp_extra_test.c. Each cipher is exercised with and without AAD; the no-AAD case is needed because any prior EVP_CipherUpdate(NULL, aad, ...) routes through the streaming handler and applies the IV itself, masking the bug. Fixes CVE-2026-45445 Reviewed-by: Eugene Syromiatnikov Reviewed-by: Tomas Mraz MergeDate: Mon Jun 8 20:02:00 2026 (cherry picked from commit 50c95c5d1e83f4f46a555dfa7fd9c632d3eba9dc)

Match the local q DHX parameter against the peer's q

2026-06-08T19:58:01Z

As FFC/DH peer public key validation uses the peer's q value instead of checking against the local q, we must also check that these q values match when setting the peer's public key. Fixes CVE-2026-42770 Signed-off-by: Norbert Pocs Reviewed-by: Viktor Dukhovni Reviewed-by: Tomas Mraz MergeDate: Mon Jun 8 19:56:27 2026 (cherry picked from commit 29b9df160cc5f20ee3907cce0cb271b982846bce)