openssl, branch openssl-3.6.3

Prepare for release of 3.6.3

2026-06-09T11:46:57Z

Reviewed-by: Neil Horman Reviewed-by: Saša Nedvědický MergeDate: Tue Jun 9 11:46:58 2026 Release: yes

make update

2026-06-09T11:46:55Z

Reviewed-by: Neil Horman Reviewed-by: Saša Nedvědický MergeDate: Tue Jun 9 11:46:57 2026 Release: yes

Copyright year updates

2026-06-09T11:44:35Z

Reviewed-by: Neil Horman Reviewed-by: Saša Nedvědický MergeDate: Tue Jun 9 11:44:36 2026 Release: yes

CHANGES.md, NEWS.md: update for 3.6.3

2026-06-09T11:19:03Z

3.6.3 CHANGES.md includes the following: * CVE-2026-7383, CVE-2026-9076, CVE-2026-34180, CVE-2026-34181, CVE-2026-34182, CVE-2026-34183, CVE-2026-35188, CVE-2026-42764, CVE-2026-42765, CVE-2026-42766, CVE-2026-42767, CVE-2026-42768, CVE-2026-42769, CVE-2026-42770, CVE-2026-45445, CVE-2026-45446, CVE-2026-45447 * https://github.com/openssl/openssl/pull/30626 "TLSv1.3: Fix server not sending NewSessionTicket after ciphersuite mismatch" * https://github.com/openssl/openssl/pull/31058 "Validate that a PSK identity is at least one byte long" * https://github.com/openssl/openssl/pull/31146 "ktls: Fix invalid memory access on retry with moving write buffer" 3.6.3 NEWS.md includes the following: * CVE-2026-7383, CVE-2026-9076, CVE-2026-34180, CVE-2026-34181, CVE-2026-34182, CVE-2026-34183, CVE-2026-35188, CVE-2026-42764, CVE-2026-42765, CVE-2026-42766, CVE-2026-42767, CVE-2026-42768, CVE-2026-42769, CVE-2026-42770, CVE-2026-45445, CVE-2026-45446, CVE-2026-45447 Signed-off-by: Eugene Syromiatnikov Reviewed-by: Norbert Pocs Reviewed-by: Milan Broz Reviewed-by: Tomas Mraz MergeDate: Tue Jun 9 11:19:21 2026

Fix potential NULL dereference in OSSL_CRMF_ENCRYPTEDVALUE_decrypt()

2026-06-08T20:39:07Z

Check that 'parameter' != NULL before dereferencing in OSSL_CRMF_ENCRYPTEDVALUE_decrypt(). Fixes CVE-2026-42767 Reviewed-by: Neil Horman Reviewed-by: Norbert Pocs Reviewed-by: Tomas Mraz MergeDate: Mon Jun 8 20:38:27 2026 (cherry picked from commit 309db711d13a6fdc6f8a719d8b4415a04dbf3bc5)

Test for CVE-2026-45447 (UAF in PKCS7_verify)

2026-06-08T20:28:38Z

The test data were created with a tool developed by Thai Duong . Reviewed-by: Eugene Syromiatnikov Reviewed-by: Tomas Mraz MergeDate: Mon Jun 8 20:22:52 2026 (cherry picked from commit a60763a01490bd747ab716342b87d55bd0a27a39)

Fix possible use-after-free in OpenSSL PKCS7_verify()

2026-06-08T20:25:10Z

Fixes CVE-2026-45447 Reviewed-by: Eugene Syromiatnikov Reviewed-by: Tomas Mraz MergeDate: Mon Jun 8 20:22:50 2026 (cherry picked from commit b4fbcf9fd25f781b17b763e3ec84d6b6dc096f6e)

Fix handling of empty-ciphertext messages in AES-GCM-SIV and AES-SIV

2026-06-08T20:16:20Z

AES-GCM-SIV: EVP_DecryptFinal_ex Accepts All-Zero Tag for Empty-Ciphertext Messages. AES-SIV: EVP_DecryptUpdate_ex Accepts All-Zero Tag for Empty-Ciphertext Messages on context reuse. Fixes CVE-2026-45446 Reviewed-by: Neil Horman Reviewed-by: Eugene Syromiatnikov Reviewed-by: Tomas Mraz MergeDate: Mon Jun 8 20:12:25 2026 (cherry picked from commit aeb5000b0c66772bad600e9cc241a4c902e6d8b9)

Apply the buffered IV on the AES-OCB EVP_Cipher() path

2026-06-08T20:03:46Z

aes_ocb_cipher(), the OCB provider's OSSL_FUNC_CIPHER_CIPHER slot, processed input without flushing the buffered IV into the OCB context. Effective nonce was 0 regardless of the caller's IV; EVP_*Final_ex() then emitted a tag depending only on (key, iv). This gave (key, nonce) reuse and single-query universal forgery on the EVP_Cipher() path. Apply update_iv() at the head of aes_ocb_cipher() to mirror the streaming handler. The matching GCM one-shot does this already. Add a cross-driver round-trip test for AES-{GCM,CCM,OCB} and ChaCha20-Poly1305 in test/evp_extra_test.c. Each cipher is exercised with and without AAD; the no-AAD case is needed because any prior EVP_CipherUpdate(NULL, aad, ...) routes through the streaming handler and applies the IV itself, masking the bug. Fixes CVE-2026-45445 Reviewed-by: Eugene Syromiatnikov Reviewed-by: Tomas Mraz MergeDate: Mon Jun 8 20:02:00 2026 (cherry picked from commit 50c95c5d1e83f4f46a555dfa7fd9c632d3eba9dc)

Match the local q DHX parameter against the peer's q

2026-06-08T19:57:45Z

As FFC/DH peer public key validation uses the peer's q value instead of checking against the local q, we must also check that these q values match when setting the peer's public key. Fixes CVE-2026-42770 Signed-off-by: Norbert Pocs Reviewed-by: Viktor Dukhovni Reviewed-by: Tomas Mraz MergeDate: Mon Jun 8 19:56:27 2026 (cherry picked from commit 29b9df160cc5f20ee3907cce0cb271b982846bce)