openssl/apps, branch openssl-3.5.6

Copyright year updates

2026-04-07T12:24:29Z

Reviewed-by: Neil Horman Reviewed-by: Eugene Syromiatnikov MergeDate: Tue Apr 7 12:24:30 2026 Release: yes

Don't eat a NULL if a queryfile is not provided

2026-03-31T09:54:27Z

Fixes: 18cd23df8a8f2 "Remove "noise" comments from TS files." Reviewed-by: Paul Dale Reviewed-by: Eugene Syromiatnikov MergeDate: Tue Mar 31 09:54:31 2026 (Merged from https://github.com/openssl/openssl/pull/30608)

cmp_vfy.c,doc/,test/: when trying to use cached CMP message sender cert, no more check its revocation and chain

2026-03-25T10:56:11Z

Reviewed-by: Neil Horman Reviewed-by: Paul Dale (Merged from https://github.com/openssl/openssl/pull/28973) (cherry picked from commit 525a4f1efbab0d3c2aff59ab8e671b8d9f35ddee)

apps/cmp.c: minor code refactoring on -no_cache_extracerts, tweak mock server error message

2026-03-25T09:59:11Z

Reviewed-by: Neil Horman Reviewed-by: Paul Dale (Merged from https://github.com/openssl/openssl/pull/28973) (cherry picked from commit 3c15377ab8ec23673b3ecfc6b556ba70a7dde859)

x509: remove OCSP_TRUSTOTHER from stapled response and issuer fallback paths

2026-03-24T17:49:04Z

This is backport of 8a630915c045 "x509: remove OCSP_TRUSTOTHER from stapled response and issuer fallback paths" that includes only parts pertaining the openssl ocsp command. Original commit message: check_cert_ocsp_resp() verified stapled OCSP responses with OCSP_TRUSTOTHER while passing the peer-provided chain (ctx->chain), which allowed certificates from that chain to be treated as trusted OCSP responder signers. similarly, the ocsp CLI issuer fallback path unconditionally used OCSP_TRUSTOTHER, making certificates given via -issuer implicitly trusted regardless of verify_flags. remove OCSP_TRUSTOTHER from both paths so that responder authorization is validated against the trust store. Link: https://github.com/openssl/openssl/pull/30323 References: 8a630915c045 "x509: remove OCSP_TRUSTOTHER from stapled response and issuer fallback paths" Fixes: c6724060e267f "RT2206: Add -issuer flag to ocsp command" Reviewed-by: David von Oheimb Reviewed-by: Tomas Mraz MergeDate: Tue Mar 24 17:49:34 2026 (Merged from https://github.com/openssl/openssl/pull/30526)

apps/cmp.c: fix leak of out_trusted in setup_verification_ctx()

2026-03-24T17:35:13Z

setup_verification_ctx() allocates out_trusted via load_trusted() and passes it to OSSL_CMP_CTX_set_certConf_cb_arg(). Since the argument is not consumed, it must be freed on failure. The fix is to free out_trusted if OSSL_CMP_CTX_set_certConf_cb_arg() fails. Fixes #30377 Signed-off-by: huanghuihui0904 <625173@qq.com> Reviewed-by: Eugene Syromiatnikov Reviewed-by: Tomas Mraz MergeDate: Tue Mar 24 17:34:49 2026 (Merged from https://github.com/openssl/openssl/pull/30392) (cherry picked from commit 6f01df42cd0fff76dc789e50f5f86addd6103192)

apps/cmp_mock_srv: fix resource leak in process_genm()

2026-03-16T11:18:54Z

If pushing the generated rsp ITAV object into the out stack fails, the error path frees the stack container but permanently abandons the newly allocated rsp object. Explicitly free the rsp structure if it exists and was not pushed successfully to prevent this memory leak. Reviewed-by: Frederik Wedel-Heinen Reviewed-by: Eugene Syromiatnikov MergeDate: Mon Mar 16 11:16:02 2026 (Merged from https://github.com/openssl/openssl/pull/30374) (cherry picked from commit b4a964f6c1313d386c45a747820d82a1a5ec4573)

Fix resource leak in crls_http_cb()

2026-03-13T15:18:43Z

When the function fails to push the second CRL to the stack, it incorrectly uses sk_X509_CRL_free() instead of sk_X509_CRL_pop_free(). This destroys the stack container but orphans previously pushed X509_CRL objects. Replace it with sk_X509_CRL_pop_free passing X509_CRL_free as the cleanup routine to ensure deep deallocation of any pushed items. Reviewed-by: Eugene Syromiatnikov Reviewed-by: Tomas Mraz Reviewed-by: Paul Dale Reviewed-by: Norbert Pocs Reviewed-by: Todd Short (Merged from https://github.com/openssl/openssl/pull/30372) (cherry picked from commit 0d2874b37a6b1da258aac81bd647fc02cbdf5547) (cherry picked from commit 0ddb228772e4e9c4ee9b29d20d7d119e2fa66c01) (cherry picked from commit 35a3aa59406500a377864645a0201403ca8726d7)

apps: unload provider on app_provider_load() failure

2026-03-13T08:12:36Z

CLA: trivial Reviewed-by: Paul Dale Reviewed-by: Eugene Syromiatnikov Reviewed-by: Tomas Mraz MergeDate: Fri Mar 13 08:12:44 2026 (Merged from https://github.com/openssl/openssl/pull/30314)

Fix a one byte buffer overflow in s_client

2026-03-12T17:56:56Z

The buffer used to process user commands when using advanced mode ("-adv") can overflow the buffer by one byte if the the read buffer is exactly BUFSIZZ bytes in length (16k). When processing the buffer we add a NUL terminator to the buffer, so if the buffer is already full then we overwrite by one byte when we add the NUL terminator. This does not represent a security issue because this is entirely local and would be "self-inflicted", i.e. not under attacker control. This issue was reported to use by Igor Morgenstern from AISLE. Reviewed-by: Paul Dale Reviewed-by: Tim Hudson Reviewed-by: Tomas Mraz MergeDate: Thu Mar 12 17:56:37 2026 (Merged from https://github.com/openssl/openssl/pull/30376) (cherry picked from commit 440ac348bf7ad86aaed3eb6a18c7ce587dccb350)