openssl, branch openssl-3.3.5

Prepare for release of 3.3.5

2025-09-30T12:57:24Z

Reviewed-by: Neil Horman Reviewed-by: Saša Nedvědický Release: yes

make update

2025-09-30T12:57:23Z

Reviewed-by: Neil Horman Reviewed-by: Saša Nedvědický Release: yes

Copyright year updates

2025-09-30T12:55:37Z

Reviewed-by: Neil Horman Reviewed-by: Saša Nedvědický Release: yes

CHANGES.md: update for 3.3.5

2025-09-30T11:49:08Z

3.3.5 CHANGES.md includes the following: * https://github.com/openssl/openssl/pull/28198 * https://github.com/openssl/openssl/pull/28398 * https://github.com/openssl/openssl/pull/28411 * https://github.com/openssl/openssl/pull/28449 Release: Yes Signed-off-by: Eugene Syromiatnikov Reviewed-by: Neil Horman Reviewed-by: Tomas Mraz

Add CHANGES.md and NEWS.md updates

2025-09-29T12:42:23Z

Including a few corrections of the previous entries. Reviewed-by: Neil Horman Reviewed-by: Saša Nedvědický

use_proxy(): Add missing terminating NUL byte

2025-09-29T10:04:32Z

Fixes CVE-2025-9232 There is a missing terminating NUL byte after strncpy() call. Issue and a proposed fix reported by Stanislav Fort (Aisle Research). Reviewed-by: Neil Horman Reviewed-by: Matt Caswell (cherry picked from commit 6bca15039e99d37ce3a3564eb862a3b1ff40e63d)

ecp_sm2p256.c: Remove unused code

2025-09-29T10:02:38Z

Reviewed-by: Neil Horman Reviewed-by: Matt Caswell (cherry picked from commit 56c89cd2de75055ecf4b705824fb354631d5d810)

SM2: Use constant time modular inversion

2025-09-29T10:02:37Z

Fixes CVE-2025-9231 Issue and a proposed fix reported by Stanislav Fort (Aisle Research). Reviewed-by: Neil Horman Reviewed-by: Matt Caswell (cherry picked from commit dff94dba75490d03926e77be9f2da3bcf4485820)

kek_unwrap_key(): Fix incorrect check of unwrapped key size

2025-09-29T09:59:03Z

Fixes CVE-2025-9230 The check is off by 8 bytes so it is possible to overread by up to 8 bytes and overwrite up to 4 bytes. Reviewed-by: Neil Horman Reviewed-by: Matt Caswell Reviewed-by: Tomas Mraz (cherry picked from commit 9c462be2cea54ebfc62953224220b56f8ba22a0c)

krb5kdf.c.in: Check the key size before applying the key

2025-09-26T16:54:50Z

Reviewed-by: Neil Horman Reviewed-by: Tim Hudson Reviewed-by: Paul Dale (Merged from https://github.com/openssl/openssl/pull/28663) (cherry picked from commit 3addc8bb3a8e62e701d44ae849437f97940632cd)