openssl/test, branch openssl-3.6.3

Copyright year updates

2026-06-09T11:44:35Z

Reviewed-by: Neil Horman Reviewed-by: Saša Nedvědický MergeDate: Tue Jun 9 11:44:36 2026 Release: yes

Test for CVE-2026-45447 (UAF in PKCS7_verify)

2026-06-08T20:28:38Z

The test data were created with a tool developed by Thai Duong . Reviewed-by: Eugene Syromiatnikov Reviewed-by: Tomas Mraz MergeDate: Mon Jun 8 20:22:52 2026 (cherry picked from commit a60763a01490bd747ab716342b87d55bd0a27a39)

Fix handling of empty-ciphertext messages in AES-GCM-SIV and AES-SIV

2026-06-08T20:16:20Z

AES-GCM-SIV: EVP_DecryptFinal_ex Accepts All-Zero Tag for Empty-Ciphertext Messages. AES-SIV: EVP_DecryptUpdate_ex Accepts All-Zero Tag for Empty-Ciphertext Messages on context reuse. Fixes CVE-2026-45446 Reviewed-by: Neil Horman Reviewed-by: Eugene Syromiatnikov Reviewed-by: Tomas Mraz MergeDate: Mon Jun 8 20:12:25 2026 (cherry picked from commit aeb5000b0c66772bad600e9cc241a4c902e6d8b9)

Apply the buffered IV on the AES-OCB EVP_Cipher() path

2026-06-08T20:03:46Z

aes_ocb_cipher(), the OCB provider's OSSL_FUNC_CIPHER_CIPHER slot, processed input without flushing the buffered IV into the OCB context. Effective nonce was 0 regardless of the caller's IV; EVP_*Final_ex() then emitted a tag depending only on (key, iv). This gave (key, nonce) reuse and single-query universal forgery on the EVP_Cipher() path. Apply update_iv() at the head of aes_ocb_cipher() to mirror the streaming handler. The matching GCM one-shot does this already. Add a cross-driver round-trip test for AES-{GCM,CCM,OCB} and ChaCha20-Poly1305 in test/evp_extra_test.c. Each cipher is exercised with and without AAD; the no-AAD case is needed because any prior EVP_CipherUpdate(NULL, aad, ...) routes through the streaming handler and applies the IV itself, masking the bug. Fixes CVE-2026-45445 Reviewed-by: Eugene Syromiatnikov Reviewed-by: Tomas Mraz MergeDate: Mon Jun 8 20:02:00 2026 (cherry picked from commit 50c95c5d1e83f4f46a555dfa7fd9c632d3eba9dc)

Test for CVE-2026-42766

2026-06-08T18:59:50Z

The script make_missing_kdf_der.py was developed by Mayank Jangid and Kushal Khemka. Co-Authored-by: Mayank Jangid Co-Authored-by: Kushal Khemka Reviewed-by: Eugene Syromiatnikov Reviewed-by: Tomas Mraz MergeDate: Mon Jun 8 18:57:53 2026 (cherry picked from commit 7020987c162fe81e12e10101dd32f57bdfc7ff5e)

Add test for path challenge flood mitigation

2026-06-08T14:39:17Z

Client injects 16 path challenge frames. Those are received by server. Only one challenge frame of 16 received triggers path challenge response. Remaining challenge frames are discrded/ignored. Test introduces two counters to channel object: - path_challenge_rx which is bumped for every patch challenge frame received - path_response_tx which is bumped for every path response frame transmitted Succesuful test verifies server receives 16 path challenge frames, but sends just one path response frmae as response. Reviewed-by: Nikola Pajkovsky Reviewed-by: Tomas Mraz MergeDate: Mon Jun 8 14:38:29 2026 (cherry picked from commit 955d15f2e515559f63590da1d106e3a38c6a502e)

Add tests for CVE-2026-34182

2026-06-08T14:28:12Z

Test to ensure that for a given CMS message: 1) We do not allow the creation of a CMS message containing AuthEnvelopedData with a non-AEAD cipher. 2) We do not accept a message containing AuthEnvelopedData with a non-AEAD cipher specified in the AlgorithmIdentifier. 3) We do not allow tag lengths less that 4 bytes. Reviewed-by: Norbert Pocs Reviewed-by: Tomas Mraz MergeDate: Mon Jun 8 14:27:03 2026 (cherry picked from commit d11787af723d8230f98a34d9ba5e43229982795a)

pkcs12: verify that the pbmac1 key length is safe

2026-06-08T14:20:27Z

Short mac keys (as short as 1 byte) can be used to probe the system under attack to accept a PKCS#12 file created by an attacker even if the attacker doesn't know the password used for MAC protection. Fixes CVE-2026-34181 (also update the reference to the PBMAC1 PKCS#12 RFC) Signed-off-by: Alicja Kario Reviewed-by: Dmitry Belyavskiy Reviewed-by: Norbert Pocs Reviewed-by: Tomas Mraz MergeDate: Mon Jun 8 14:20:38 2026

cms: kek_unwrap_key: test for fix out-of-bounds read in check-byte validation

2026-06-08T14:08:49Z

added EnvelopedData blob with a PasswordRecipientInfo using id-alg-PWRI-KEK and an AES-128-CFB key encryption cipher. CFB's 1-byte effective block size let the inlen >= 2 * blocklen guard in kek_unwrap_key() accept a wrapped key shorter than the seven octets the check-byte test reads from tmp[1..6]; the encryptedKey OCTET STRING here is only two bytes. Signed-off-by: Nikola Pajkovsky Reviewed-by: Daniel Kubec Reviewed-by: Milan Broz Reviewed-by: Tomas Mraz MergeDate: Mon Jun 8 14:06:38 2026 (cherry picked from commit fd1e1078df9e68affcaaa88be75e343c1db3d1a4)

Check custom extensions are handled correct with 3rd party QUIC

2026-06-08T07:52:24Z

We have some code to handle the case where we have custom 3rd party extension and 3rd party QUIC. Test that this doesn't cause any problems. Reviewed-by: Bob Beck Reviewed-by: Tomas Mraz MergeDate: Mon Jun 8 07:51:56 2026 (Merged from https://github.com/openssl/openssl/pull/31238) (cherry picked from commit 0d6164b9f09cd3703e1d8e0cc903b5c5cac87d60)