openssl/NEWS.md, branch dependabot/github_actions/actions/setup-python-7

Fix DSA with SHA-384 / SHA-512 X.509 verification (issue openssl#30432)

2026-07-20T11:10:45Z

Register dsa_with_SHA384 and dsa_with_SHA512 in obj_xref so signature verification resolves digest + DSA key type. Add test_verify regression tests and PEM fixtures; add executable DSA cert generation in test/certs/setup.sh. CHANGES.md and NEWS.md entries for 4.0→4.1. Address review: plan tests 215, remove CHANGES merge artifact, replace comment-only setup.sh notes with actual openssl commands. Fixes openssl#30432 Reviewed-by: Dmitry Belyavskiy Reviewed-by: Nikola Pajkovsky MergeDate: Mon Jul 20 11:10:47 2026 (Merged from https://github.com/openssl/openssl/pull/30655)

CHANGES.md, NEWS.md: update for 4.0.1

2026-06-18T13:13:12Z

4.0.1 CHANGES.md includes the following: * CVE-2026-7383, CVE-2026-9076, CVE-2026-34180, CVE-2026-34181, CVE-2026-34182, CVE-2026-34183, CVE-2026-35188, CVE-2026-42764, CVE-2026-42765, CVE-2026-42766, CVE-2026-42767, CVE-2026-42768, CVE-2026-42769, CVE-2026-42770, CVE-2026-42771, CVE-2026-45445, CVE-2026-45446, CVE-2026-45447 * https://github.com/openssl/openssl/pull/30626 "TLSv1.3: Fix server not sending NewSessionTicket after ciphersuite mismatch" * https://github.com/openssl/openssl/pull/30904 "pkey(1) missing setup for interactive pass prompt" * https://github.com/openssl/openssl/pull/31058 "Validate that a PSK identity is at least one byte long" * https://github.com/openssl/openssl/pull/31146 "ktls: Fix invalid memory access on retry with moving write buffer" * https://github.com/openssl/openssl/pull/31413 "apps/s_client.c: read one byte less to avoid triggerring overflow protection" 4.0.1 NEWS.md includes the following: * CVE-2026-7383, CVE-2026-9076, CVE-2026-34180, CVE-2026-34181, CVE-2026-34182, CVE-2026-34183, CVE-2026-35188, CVE-2026-42764, CVE-2026-42765, CVE-2026-42766, CVE-2026-42767, CVE-2026-42768, CVE-2026-42769, CVE-2026-42770, CVE-2026-42771, CVE-2026-45445, CVE-2026-45446, CVE-2026-45447 * https://github.com/openssl/openssl/pull/30904 "pkey(1) missing setup for interactive pass prompt" * https://github.com/openssl/openssl/pull/31413 "apps/s_client.c: read one byte less to avoid triggerring overflow protection" Signed-off-by: Eugene Syromiatnikov Reviewed-by: Norbert Pocs Reviewed-by: Nikola Pajkovsky Reviewed-by: Tomas Mraz MergeDate: Thu Jun 18 13:13:58 2026 (Merged from https://github.com/openssl/openssl/pull/31509)

CHANGES.md, NEWS.md: updates for 4.0.0 final release

2026-04-26T13:16:53Z

NEWS.md is amended to include the following PRs: * https://github.com/openssl/openssl/pull/28305 "Replace homebrewed implementation of *printf*() functions with libc" * https://github.com/openssl/openssl/pull/29299 "Remove support for custom EVP_CIPHERs" * https://github.com/openssl/openssl/pull/29366 "Remove support for custom EVP_MDs" * https://github.com/openssl/openssl/pull/29384 "Remove support for custom EVP_PKEY_METHODs" * https://github.com/openssl/openssl/pull/30128 "Removes fixed version TLS methods." * https://github.com/openssl/openssl/pull/29405 "Remove support EVP_PKEY_ASN1_METHODs from the public API" Overall, CHANGES.md includes the following: * https://github.com/openssl/openssl/pull/8136 "Remove spurious '00:' printing RSA/DSA/DH/EC key material with leading bit set in unsigned BN" * https://github.com/openssl/openssl/pull/17495 "4.0: `X509_ALGOR_set_md()`: Add return value to indicate success or failure" * https://github.com/openssl/openssl/pull/18229 "public API: Remove needless `const` from scalar types" * https://github.com/openssl/openssl/pull/22304 "4.0: crypto/{CMS,PKCS7,OCSP,TS,X509}: constify cert list parameters" * https://github.com/openssl/openssl/pull/24551 "Enable RFC 7919 FFDHE groups for TLS 1.2 server" * https://github.com/openssl/openssl/pull/24738 "add ech-api.md" * https://github.com/openssl/openssl/pull/25193 "ECH build artefacts and a bit of code" * https://github.com/openssl/openssl/pull/25420 "ECH CLI implementation" * https://github.com/openssl/openssl/pull/25663 "ECH external APIs" * https://github.com/openssl/openssl/pull/25991 "preserve data constness when getting issuer name's and subject's hash" * https://github.com/openssl/openssl/pull/26011 "ECH client side" * https://github.com/openssl/openssl/pull/27397 "create SSL_listen_ex api" * https://github.com/openssl/openssl/pull/27431 "fips: Enforce lower bounds checks for password protected files when using FIPS providers, by default" * https://github.com/openssl/openssl/pull/27540 "ECH client sending mulitple key shares" * https://github.com/openssl/openssl/pull/27561 "ECH both sides now" * https://github.com/openssl/openssl/pull/27776 "Introduce the PACKET_msg_start() function" * https://github.com/openssl/openssl/pull/28033 "Constify further X509 functions; remove OSSL_FUTURE_CONST" * https://github.com/openssl/openssl/pull/28041 "Remove support for SSLv2 Client Hello" * https://github.com/openssl/openssl/pull/28108 "Add a way to cleanse params arrays" * https://github.com/openssl/openssl/pull/28160 "New options for reading MAC key from environment variable, file and standard input were added." * https://github.com/openssl/openssl/pull/28270 "s_client and s_server command line options for ECH (plus some wndows CI fixes)" * https://github.com/openssl/openssl/pull/28278 "Implementing store support for EVP_SKEY" * https://github.com/openssl/openssl/pull/28305 "Replace homebrewed implementation of *printf*() functions with libc" * https://github.com/openssl/openssl/pull/28432 "Add support for CSHAKE." * https://github.com/openssl/openssl/pull/28445 "Updated s_server's verify_return_error option to enable peer verification" * https://github.com/openssl/openssl/pull/28535 "Print PowerPC CPUINFO" * https://github.com/openssl/openssl/pull/28623 "Combining time validation with comparison return values considered harmful" * https://github.com/openssl/openssl/pull/28837 "Add support to serialize/deserialize digest state for export/import" * https://github.com/openssl/openssl/pull/29018 "CRL: Validate Certificate Issuer extension with IDP Indirect=TRUE" * https://github.com/openssl/openssl/pull/29057 "Avoid empty AKID/SKID extensions in CSRs and certs" * https://github.com/openssl/openssl/pull/29107 "CRL: Enforce proper handling of ASN1_TIME validation results" * https://github.com/openssl/openssl/pull/29116 "info: Print CPUINFO for SPARCv9 processors" * https://github.com/openssl/openssl/pull/29152 "Add new public API for checking certificate times." * https://github.com/openssl/openssl/pull/29187 "Remove the ASN1_STRING_FLAG_X509_TIME flag" * https://github.com/openssl/openssl/pull/29195 "Add SNMPKDF implementation" * https://github.com/openssl/openssl/pull/29200 "Add tests and documentation and fix some issues resulting" * https://github.com/openssl/openssl/pull/29206 "Per-key encoding formats for ML-KEM and ML-DSA" * https://github.com/openssl/openssl/pull/29222 "Implementation of Deferred FIPS Self-Tests" * https://github.com/openssl/openssl/pull/29223 "ML-DSA: Add a digest that can calculate external mu." * https://github.com/openssl/openssl/pull/29230 "doc/man3: Add OPENSSL_ppccap.pod * https://github.com/openssl/openssl/pull/29266 "make PEM hexdump width a multiple of 8 bytes" * https://github.com/openssl/openssl/pull/29299 "Remove support for custom EVP_CIPHERs" * https://github.com/openssl/openssl/pull/29305 "Feature/engineremoval" * https://github.com/openssl/openssl/pull/29311 "Documentation for BIO flags and related functions" * https://github.com/openssl/openssl/pull/29338 "merge feature/removesslv3" * https://github.com/openssl/openssl/pull/29366 "Remove support for custom EVP_MDs" * https://github.com/openssl/openssl/pull/29380 "Remove crypto-mdebug-backtrace option from config" * https://github.com/openssl/openssl/pull/29381 " Added LMS support for OpenSSL commandline signature verification using pkeyutl." * https://github.com/openssl/openssl/pull/29384 "Remove support for custom EVP_PKEY_METHODs" * https://github.com/openssl/openssl/pull/29385 "Atexit.final draft.cleanup" * https://github.com/openssl/openssl/pull/29387 "Add ASN1_BIT_STRING_get_length()" * https://github.com/openssl/openssl/pull/29405 "Remove support EVP_PKEY_ASN1_METHODs from the public API" * https://github.com/openssl/openssl/pull/29427 "Remove the c_rehash script" * https://github.com/openssl/openssl/pull/29428 "Constify return value of X509_get_X509_PUBKEY()" * https://github.com/openssl/openssl/pull/29435 "Add SRTP KDF" * https://github.com/openssl/openssl/pull/29445 "Remove BIO_f_reliable() as it is broken" * https://github.com/openssl/openssl/pull/29465 "Constify X509_get_ext() and friends.." * https://github.com/openssl/openssl/pull/29468 "constify X509_NAME." * https://github.com/openssl/openssl/pull/29488 "Constify the X509_STORE_CTX argument to the lookup_certs functions." * https://github.com/openssl/openssl/pull/29576 "KDF: Add configuration options to disable many of the KDF algorithms." * https://github.com/openssl/openssl/pull/29612 "Support multiple names for certificate verification" * https://github.com/openssl/openssl/pull/29635 "SSL_CTX_is_server() was added" * https://github.com/openssl/openssl/pull/29639 "Disabling explicit EC curves encoding" * https://github.com/openssl/openssl/pull/29640 "add thunking for compare function to OPENSSL_STACK" * https://github.com/openssl/openssl/pull/29646 "Added SSL_CTX_get0_alpn_protos() and SSL_get0_alpn_protos()" * https://github.com/openssl/openssl/pull/29653 "Drop darwin-i386(-cc) targets from Configurations" * https://github.com/openssl/openssl/pull/29658 "Disable support of weak elliptic curves in TLS by default" * https://github.com/openssl/openssl/pull/29672 "Drop darwin-ppc{,64} targets" * https://github.com/openssl/openssl/pull/29721 "Make OPENSSL_cleanup() G A" * https://github.com/openssl/openssl/pull/29813 "Make X509_ATTRIBUTE accessor functions const-correct" * https://github.com/openssl/openssl/pull/29862 "Make ASN1_STRING opaque" * https://github.com/openssl/openssl/pull/29874 "Take OPENSSL_atexit() for a walk behind the barn." * https://github.com/openssl/openssl/pull/29926 "Provide ASN1_BIT_STRING_set1()" * https://github.com/openssl/openssl/pull/29953 "Support for RFC8998 `sm2sig_sm3`, `curveSM2` and its ML-KEM-768 hybrid." * https://github.com/openssl/openssl/pull/29971 "X509: apply AKID verification checks when X509_V_FLAG_X509_STRICT is set" * https://github.com/openssl/openssl/pull/29982 "Improved reporting of shared and peer sigalgs" * https://github.com/openssl/openssl/pull/29991 "Fix of SSL_get_error() so that it no longer depends on the state of the error stack" * https://github.com/openssl/openssl/pull/29995 "Add abilty to use static vcruntime" * https://github.com/openssl/openssl/pull/30005 "Make ERR_STATE opaque and remove related deprecated functions" * https://github.com/openssl/openssl/pull/30011 "Deprecate ASN1_OBJECT_new()." * https://github.com/openssl/openssl/pull/30020 "Const correct time parameter for X509_cmp_time(), X509_time_adj() and X509_time_adj_ex()." * https://github.com/openssl/openssl/pull/30024 "CRL: reject malformed CRL Number and CRL Delta Indicator" * https://github.com/openssl/openssl/pull/30028 "Add TLS 1.3 SM ciphersuites" * https://github.com/openssl/openssl/pull/30031 "Mostly deprecated is slightly not deprecated...." * https://github.com/openssl/openssl/pull/30033 "Remove the "msie-hack" option from openssl ca" * https://github.com/openssl/openssl/pull/30034 "Use the appropriate libctx when executing CMS_SignerInfo_verify" * https://github.com/openssl/openssl/pull/30035 "Constify X509_verify" * https://github.com/openssl/openssl/pull/30036 "Constify more X509 arguments and return values" * https://github.com/openssl/openssl/pull/30044 "Added BIO_set_send_flags() function to set flags passed to send(), sendto(), and sendmsg()" * https://github.com/openssl/openssl/pull/30048 "change from I-D to RFC 9849 and resolve TODO(ECH) cases" * https://github.com/openssl/openssl/pull/30053 "Constify NAME_CONSTRAINTS_check and NAME_CONSTRAINTS_check_CN" * https://github.com/openssl/openssl/pull/30054 "Consity X509_add_cert and X509_self_signed" * https://github.com/openssl/openssl/pull/30055 "Constify various functions that were non const due to extension cache" * https://github.com/openssl/openssl/pull/30056 "Constify X509_build_chain" * https://github.com/openssl/openssl/pull/30058 "Constify X509_chain_check_suiteb" * https://github.com/openssl/openssl/pull/30067 "Constify X509_check_issued and friends" * https://github.com/openssl/openssl/pull/30071 "constify X509_check_trust, X509_TRUST_add" * https://github.com/openssl/openssl/pull/30072 "Constify X509_to_X509_REQ and X509_REQ_to_X509" * https://github.com/openssl/openssl/pull/30073 "Constify X509_print_fp and X509_print_ex_fp" * https://github.com/openssl/openssl/pull/30074 "Constify X509_STORE_add_cert()" * https://github.com/openssl/openssl/pull/30076 "Constify X509_STORE_CTX functions invoving X509 *" * https://github.com/openssl/openssl/pull/30079 "Constify X509_CRL_get0_by_cert" * https://github.com/openssl/openssl/pull/30080 "Constify X509v3_asid_validate_resource_set and X509v3_addr_validate_resource_set" * https://github.com/openssl/openssl/pull/30082 "Constify X509_REQ_get1_email, X509_get1_email and X509_get1_ocsp." * https://github.com/openssl/openssl/pull/30084 "Constify X509_issuer_and_serial_hash" * https://github.com/openssl/openssl/pull/30089 "Added -expected-rpks s_client/server option" * https://github.com/openssl/openssl/pull/30090 "Constify X509_CRL_get0_by_cert" * https://github.com/openssl/openssl/pull/30092 "constify X509_find_by_issuer_and_serial" * https://github.com/openssl/openssl/pull/30096 "Constify X509_find_by_subject" * https://github.com/openssl/openssl/pull/30098 "Add a changes entry for the x509 time function changes" * https://github.com/openssl/openssl/pull/30113 "Add keyshare floating" * https://github.com/openssl/openssl/pull/30117 "Constify X509_OBJECT_[get0|set1]_X509 and friends" * https://github.com/openssl/openssl/pull/30127 "Constify a bunch of seldom used X509 functions. " * https://github.com/openssl/openssl/pull/30128 "Removes fixed version TLS methods." * https://github.com/openssl/openssl/pull/30140 "Ensure TLS 1.3 ciphersuites are actually for TLS 1.3" * https://github.com/openssl/openssl/pull/30171 "CRL: Reject CRLs with malformed Issuing Distribution Point" * https://github.com/openssl/openssl/pull/30200 "Remove remnant SSL_FIPS flag" * https://github.com/openssl/openssl/pull/30229 "X509 returned by X509_REQ_to_X509() should not be (const ...)" * https://github.com/openssl/openssl/pull/30235 "Make X509_up_ref and X509_free take const X509 *" * https://github.com/openssl/openssl/pull/30249 "x509: remove erroneous critical extension enforcement" * https://github.com/openssl/openssl/pull/30252 "Some more X509 extension add/del polish" * https://github.com/openssl/openssl/pull/30263 "Restrict the number of keyshares/groups/sigalgs a server is willing to accept" * https://github.com/openssl/openssl/pull/30265 "Unconstify X509_find_by_issuer_and_serial() and X509_find_by_subject()" * https://github.com/openssl/openssl/pull/30272 "Partially revert "Constify X509_STORE_CTX functions invoving X509 *"" * https://github.com/openssl/openssl/pull/30273 "Revert "Make X509_up_ref and X509_free take const X509 *"" * https://github.com/openssl/openssl/pull/30276 "Un-constify X509_OBJECT_get0_X509 and X509_OBJECT_set1_X509" The changes associated with these PRs are already mentioned in 3.6.x changes: * https://github.com/openssl/openssl/pull/28760 "Improve the CPUINFO display for RISC-V" * https://github.com/openssl/openssl/pull/28797 "Fix regression when X509_V_FLAG_CRL_CHECK_ALL is set" * https://github.com/openssl/openssl/pull/28955 "Fix for TLS handshake issue with GnuTLS #28902" * https://github.com/openssl/openssl/pull/29155 "fix(x509.c): fixed -checkend return values" * https://github.com/openssl/openssl/pull/29214 "s390x: Check and fail on invalid malformed ECDSA signatures" * https://github.com/openssl/openssl/pull/29242 "Clang format head" * https://github.com/openssl/openssl/pull/29251 "Fix change of behavior of the single stapled OCSP response API" * https://github.com/openssl/openssl/pull/30204 "Fix detection of plaintext HTTP over TLS" * https://github.com/openssl/openssl/pull/30384 "Fix #19891 CONNECT request for IPv6 targets in OSSL_HTTP_proxy_connect" * https://github.com/openssl/openssl/pull/30557 "re-constructorize the cpuid stuff, but fix riscv to not depend on BIO_snprintf." Signed-off-by: Eugene Syromiatnikov Original-PR: https://github.com/openssl/openssl/pull/30817) Original-Commit: 8fba5d0d9c64 "CHANGES.md, NEWS.md: updates for 4.0.0 final release" Reviewed-by: Nikola Pajkovsky Reviewed-by: Norbert Pocs MergeDate: Sun Apr 26 13:17:07 2026 (Merged from https://github.com/openssl/openssl/pull/30847)

Forward port release update commit to master branch

2026-04-16T16:27:35Z

Bring NEWS.md/CHANGES.md into line with updates on the 4.0 branch Reviewed-by: Eugene Syromiatnikov Reviewed-by: Norbert Pocs Reviewed-by: Tomas Mraz MergeDate: Thu Apr 16 16:27:47 2026 (Merged from https://github.com/openssl/openssl/pull/30830)

Add docs for new atomic apis

2026-04-14T08:29:28Z

Documents CRYPTO_atomic_load_ptr(), CRYPTO_atomic_store_ptr() and CRYPTO_atomic_cmp_exch_ptr() Reviewed-by: Paul Dale Reviewed-by: Nikola Pajkovsky MergeDate: Tue Apr 14 08:29:33 2026 (Merged from https://github.com/openssl/openssl/pull/30670)

CHANGES.md, NEWS.md: update for 3.6.2

2026-04-11T18:51:23Z

3.6.2 CHANGES.md includes the following: * CVE-2026-2673, CVE-2026-28386, CVE-2026-28387, CVE-2026-28388, CVE-2026-28389, CVE-2026-28390, CVE-2026-31789, CVE-2026-31790 * https://github.com/openssl/openssl/pull/30384 "Fix #19891 CONNECT request for IPv6 targets in OSSL_HTTP_proxy_connect" * https://github.com/openssl/openssl/pull/30411 "Fix detection of plaintext HTTP over TLS (3.6/3.5 backport)" * https://github.com/openssl/openssl/pull/30557 "re-constructorize the cpuid stuff, but fix riscv to not depend on BIO_snprintf." 3.6.2 NEWS.md includes the following: * CVE-2026-2673, CVE-2026-28386, CVE-2026-28387, CVE-2026-28388, CVE-2026-28389, CVE-2026-28390, CVE-2026-31789, CVE-2026-31790 Signed-off-by: Eugene Syromiatnikov Reviewed-by: Tomas Mraz Reviewed-by: Paul Dale MergeDate: Sat Apr 11 18:51:42 2026 (Merged from https://github.com/openssl/openssl/pull/30720)

NEWS.md: Update 3.6.0 release date

2026-04-08T09:59:56Z

Original-Commit: 7b371d80d959 "Prepare for release of 3.6.0" Reviewed-by: Paul Yang Reviewed-by: Paul Dale Reviewed-by: Tomas Mraz MergeDate: Wed Apr 8 10:00:08 2026 (Merged from https://github.com/openssl/openssl/pull/30686)

Prepare for 4.1

2026-03-10T14:39:55Z

Reviewed-by: Tomas Mraz Reviewed-by: Eugene Syromiatnikov MergeDate: Tue Mar 10 14:39:56 2026 Release: yes

CHANGES.md, NEWS.md: picking up changes from 3.6.1

2026-03-10T12:13:44Z

Since it has been released before 4.0.0-alpha1. Signed-off-by: Eugene Syromiatnikov Reviewed-by: Tomas Mraz Reviewed-by: Nikola Pajkovsky Reviewed-by: Neil Horman MergeDate: Tue Mar 10 13:39:37 2026 (Merged from https://github.com/openssl/openssl/pull/30338)

CHANGES.md, NEWS.md: update the URL format for CVE URLs

2026-03-10T10:45:08Z

The URLs have changed from [1] to [2]. [1] https://www.openssl.org/news/vulnerabilities.html [2] https://openssl-library.org/news/vulnerabilities/ Signed-off-by: Eugene Syromiatnikov Reviewed-by: Tomas Mraz Reviewed-by: Nikola Pajkovsky Reviewed-by: Neil Horman MergeDate: Tue Mar 10 13:39:35 2026 (Merged from https://github.com/openssl/openssl/pull/30338)