openssl/providers, branch openssl-3.4.6

make update

2026-06-09T12:02:13Z

Reviewed-by: Neil Horman Reviewed-by: Saša Nedvědický MergeDate: Tue Jun 9 12:02:14 2026 Release: yes

Copyright year updates

2026-06-09T12:00:17Z

Reviewed-by: Neil Horman Reviewed-by: Saša Nedvědický MergeDate: Tue Jun 9 12:00:18 2026 Release: yes

Fix handling of empty-ciphertext messages in AES-GCM-SIV and AES-SIV

2026-06-08T20:18:12Z

AES-GCM-SIV: EVP_DecryptFinal_ex Accepts All-Zero Tag for Empty-Ciphertext Messages. AES-SIV: EVP_DecryptUpdate_ex Accepts All-Zero Tag for Empty-Ciphertext Messages on context reuse. Fixes CVE-2026-45446 Reviewed-by: Eugene Syromiatnikov Reviewed-by: Tomas Mraz MergeDate: Mon Jun 8 20:19:02 2026

[providers/implementations/ciphers] make aes-gcm-siv work with zero-length messages

2026-06-08T20:17:23Z

test cases lifted from RFC 8452 fixes #26431 Reviewed-by: Nicola Tuveri Reviewed-by: Tomas Mraz Reviewed-by: Eugene Syromiatnikov Reviewed-by: Tomas Mraz MergeDate: Mon Jun 8 20:19:01 2026

Apply the buffered IV on the AES-OCB EVP_Cipher() path

2026-06-08T20:03:58Z

aes_ocb_cipher(), the OCB provider's OSSL_FUNC_CIPHER_CIPHER slot, processed input without flushing the buffered IV into the OCB context. Effective nonce was 0 regardless of the caller's IV; EVP_*Final_ex() then emitted a tag depending only on (key, iv). This gave (key, nonce) reuse and single-query universal forgery on the EVP_Cipher() path. Apply update_iv() at the head of aes_ocb_cipher() to mirror the streaming handler. The matching GCM one-shot does this already. Add a cross-driver round-trip test for AES-{GCM,CCM,OCB} and ChaCha20-Poly1305 in test/evp_extra_test.c. Each cipher is exercised with and without AAD; the no-AAD case is needed because any prior EVP_CipherUpdate(NULL, aad, ...) routes through the streaming handler and applies the IV itself, masking the bug. Fixes CVE-2026-45445 Reviewed-by: Eugene Syromiatnikov Reviewed-by: Tomas Mraz MergeDate: Mon Jun 8 20:02:00 2026 (cherry picked from commit 50c95c5d1e83f4f46a555dfa7fd9c632d3eba9dc)

Match the local q DHX parameter against the peer's q

2026-06-08T19:57:55Z

As FFC/DH peer public key validation uses the peer's q value instead of checking against the local q, we must also check that these q values match when setting the peer's public key. Fixes CVE-2026-42770 Signed-off-by: Norbert Pocs Reviewed-by: Viktor Dukhovni Reviewed-by: Tomas Mraz MergeDate: Mon Jun 8 19:56:27 2026 (cherry picked from commit 29b9df160cc5f20ee3907cce0cb271b982846bce)

Fix broken hex data by reformatting

2026-06-03T08:42:51Z

The clang format broke some data in hexadecimal format. To make the tool obedient, the trailing comma needs to be removed, then it interpretes the data differently and therefore does not reformat it. The format can then be changed to the correct form. Fixes: https://github.com/openssl/project/issues/1959 Signed-off-by: Norbert Pocs Reviewed-by: Milan Broz Reviewed-by: Eugene Syromiatnikov MergeDate: Wed Jun 3 08:43:08 2026 (Merged from https://github.com/openssl/openssl/pull/31350)

rsa_sig: reject short buffers in raw verify_recover

2026-06-02T12:23:02Z

The md==NULL path of rsa_verify_recover passed the caller buffer to RSA_public_decrypt without checking routsize, while the X9.31 and PKCS#1 paths already reject undersized output buffers. RSA_public_decrypt writes up to RSA_size() bytes, so a short rout overflows. Validate routsize against RSA_size() before the call. Fixes: 6f4b7663150e "PROV: add RSA signature implementation" Reviewed-by: Tomas Mraz Reviewed-by: Dmitry Belyavskiy Reviewed-by: Eugene Syromiatnikov Reviewed-by: Paul Yang MergeDate: Tue Jun 2 11:55:00 2026 (Merged from https://github.com/openssl/openssl/pull/31340) (cherry picked from commit 78dd79823215ff37a51d977b47cf0bcb4798cee2) (cherry picked from commit 317a8867ce00ab2ec7b9652531b3338bbf9cd5ff)

poly1305: prevent crash on final without a key

2026-06-01T07:35:28Z

EVP_MAC_init with a NULL key followed by EVP_MAC_final on a Poly1305 context crashed with a NULL function-pointer dispatch because poly1305_init accepted the no-key case as success, and poly1305_final had no guard before dispatching through the uninitialised Poly1305 state. Add a key_set field to struct poly1305_data_st (matching OCB/CCM/GCM), set it in poly1305_setkey, and refuse init and final if no key has been installed. Added a regression test asserting EVP_MAC_init with a NULL key returns 0. ##### Checklist - [ ] documentation is added or updated - [x] tests are added or updated CLA: trivial Reviewed-by: Tomas Mraz Reviewed-by: Eugene Syromiatnikov MergeDate: Mon Jun 1 07:35:31 2026 (Merged from https://github.com/openssl/openssl/pull/31298)

rsa_sig: reject short buffers in verify_recover

2026-05-27T11:49:09Z

The RSA PKCS#1 verify-recover provider path did not validate routsize before passing the caller buffer to ossl_rsa_verify(). The X9.31 verify-recover path already rejects undersized output buffers, but the PKCS#1 path could proceed with too little output space and rely on the lower layer to write the recovered digest. Check the expected digest size before calling ossl_rsa_verify() and return PROV_R_OUTPUT_BUFFER_TOO_SMALL when the caller-provided buffer is too small. Add a regression test that covers both successful recovery with a properly sized buffer and failure with a 1-byte output buffer, while also checking that the short buffer is left unchanged. Co-authored-by: Kushal <72255307+Kushalkhemka@users.noreply.github.com> Co-authored-by: Mayank <175295782+mayank-jangid-moon@users.noreply.github.com> Reviewed-by: Dmitry Belyavskiy Reviewed-by: Tomas Mraz MergeDate: Wed May 27 11:46:40 2026 (Merged from https://github.com/openssl/openssl/pull/30917) (cherry picked from commit ca519ad1d591a91138aa7d7a10686cd2f180a050)