openssl, branch openssl-3.3

NEWS.md: tfix: s/Medium/Moderate/

2026-04-08T10:42:01Z

Signed-off-by: Eugene Syromiatnikov Reviewed-by: Frederik Wedel-Heinen Reviewed-by: Paul Dale MergeDate: Mon Apr 13 08:42:48 2026 (Merged from https://github.com/openssl/openssl/pull/30724)

Prepare for 3.3.8

2026-04-07T12:40:22Z

Reviewed-by: Neil Horman Reviewed-by: Eugene Syromiatnikov MergeDate: Tue Apr 7 12:40:23 2026 Release: yes

Prepare for release of 3.3.7

2026-04-07T12:40:15Z

Reviewed-by: Neil Horman Reviewed-by: Eugene Syromiatnikov MergeDate: Tue Apr 7 12:40:16 2026 Release: yes

make update

2026-04-07T12:40:13Z

Reviewed-by: Neil Horman Reviewed-by: Eugene Syromiatnikov MergeDate: Tue Apr 7 12:40:14 2026 Release: yes

Copyright year updates

2026-04-07T12:38:24Z

Reviewed-by: Neil Horman Reviewed-by: Eugene Syromiatnikov MergeDate: Tue Apr 7 12:38:26 2026 Release: yes

CHANGES.md, NEWS.md: update for 3.3.7

2026-04-07T12:08:27Z

3.3.7 CHANGES.md includes the following: * CVE-2026-28387, CVE-2026-28388, CVE-2026-28389, CVE-2026-28390, CVE-2026-31789, CVE-2026-31790 * https://github.com/openssl/openssl/pull/30384 "Fix #19891 CONNECT request for IPv6 targets in OSSL_HTTP_proxy_connect" * https://github.com/openssl/openssl/pull/30412 "Fix detection of plaintext HTTP over TLS (3.4/3.3 backport)" 3.3.7 NEWS.md includes the following: * CVE-2026-28387, CVE-2026-28388, CVE-2026-28389, CVE-2026-28390, CVE-2026-31789, CVE-2026-31790 Signed-off-by: Eugene Syromiatnikov Reviewed-by: Nikola Pajkovsky Reviewed-by: Matt Caswell Reviewed-by: Tomas Mraz MergeDate: Tue Apr 7 12:08:43 2026

CHANGES.md, NEWS.md: update the URL format for CVE URLs

2026-04-07T12:08:27Z

The URLs have been changed from [1] to [2]. [1] https://www.openssl.org/news/vulnerabilities.html [2] https://openssl-library.org/news/vulnerabilities/ Signed-off-by: Eugene Syromiatnikov Reviewed-by: Nikola Pajkovsky Reviewed-by: Matt Caswell Reviewed-by: Tomas Mraz MergeDate: Tue Apr 7 12:08:41 2026

CHANGES.md, NEWS.md: sort links in lexicographical order

2026-04-07T12:08:27Z

A specific order makes link addition more consistent moving forward. The links were sorted with "LC_ALL=C sort -V" command, "sort" is from GNU coreutils. Signed-off-by: Eugene Syromiatnikov Reviewed-by: Nikola Pajkovsky Reviewed-by: Matt Caswell Reviewed-by: Tomas Mraz MergeDate: Tue Apr 7 12:08:40 2026

80-test_cms.t: Accept success in malformed RSA decryption

2026-04-07T07:17:34Z

The decryption of the malformed encrypted message might succeed with some probability. We accept that as the testcase tries to trigger a crash which does not happen. Reviewed-by: Eugene Syromiatnikov Reviewed-by: Nikola Pajkovsky MergeDate: Tue Apr 7 07:16:44 2026 (cherry picked from commit 7b5ece69dee3fb78fcd2618df3bce5064a04c6dc)

rsa_kem: test RSA_public_encrypt() result in RSASVE

2026-04-06T19:52:30Z

RSA_public_encrypt() returns the number of bytes written on success and -1 on failure. Add regression coverage in evp_extra_test using invalid RSA pubkey which triggers -1 in RSA_public_encrypt() using encapsulation. Signed-off-by: Nikola Pajkovsky Reviewed-by: Saša Nedvědický Reviewed-by: Tomas Mraz MergeDate: Mon Apr 6 19:51:31 2026 (cherry picked from commit c61bbd3f873d28e098f503f0187459ed488977c9)