Debian Patches

Status for openssl/3.0.17-1~deb12u3

Patch Description Author Forwarded Bugs Origin Last update
debian-targets.patch debian-targets Debian OpenSSL Team <pkg-openssl-devel@lists.alioth.debian.org> no 2017-11-05
man-section.patch man-section Debian OpenSSL Team <pkg-openssl-devel@lists.alioth.debian.org> no 2017-11-05
no-symbolic.patch no-symbolic Debian OpenSSL Team <pkg-openssl-devel@lists.alioth.debian.org> no 2017-11-05
pic.patch pic Debian OpenSSL Team <pkg-openssl-devel@lists.alioth.debian.org> no 2017-11-05
c_rehash-compat.patch also create old hash for compatibility Ludwig Nussel <ludwig.nussel@suse.de> no 2010-04-21
Configure-allow-to-enable-ktls-if-target-does-not-start-w.patch Configure: allow to enable ktls if target does not start with Linux
The Debian build system uses a `debian' target which sets CFLAGS and
then we have for instance debian-amd64 which inherits from
linux-x86_64 and debian. So far so good.

Since the target name does not start with `linux', the build system does not
enable ktls. So in order to get enabled, I
added a
`enable => [ "ktls" ],'
to the generic linux config which sets it explicit). Having this set, we can
check for it instead matching the target name.

This commit is based on changes for afalgeng in commit
9e381e8a01859 ("Configure: allow to enable afalgeng if target does not start with Linux")		 Sebastian Andrzej Siewior <sebastian@breakpoint.cc> no 2021-04-01
Remove-the-provider-section.patch Remove the provider section.
The provider section breaks libssl1.1 users. Remove it for now.		 Sebastian Andrzej Siewior <sebastian@breakpoint.cc> no 2022-06-08
conf-Serialize-allocation-free-of-ssl_names.patch conf: Serialize allocation/free of ssl_names.
The access to `ssl_names' is not fully serialized. With multiple threads
it is possible that more than one thread starts to clean up `ssl_names'.
This leads to occasional segfaults if more than one terminates and
performs the clean up.		 Sebastian Andrzej Siewior <sebastian@breakpoint.cc> no 2022-09-19
Fix-tests-for-new-default-security-level.patch Fix tests for new default security level
Fix tests that were expecting a default security level of 1 to work with
the new default of 2.

(Merged from https://github.com/openssl/openssl/pull/16760)		 Matt Caswell <matt@openssl.org> no 2021-10-05
Revert-Drop-by-store-s-by_store_subject_ex.patch Revert "Drop "by store"'s by_store_subject_ex()"
This reverts commit 7141330fb98ce ("Drop "by store"'s by_store_subject_ex()").

Avoid crashes in users, see https://bugs.debian.org/1110254		 Sebastian Andrzej Siewior <sebastian@breakpoint.cc> no 2025-08-04
Revert-Rework-the-by-store-X509_LOOKUP-method-to-open-the.patch Revert "Rework the "by store" X509_LOOKUP method to open the given URI early"

This reverts commit 340383f5f49f8 ("Rework the "by store" X509_LOOKUP method to open the given URI early")

Avoid crashes in users, see https://bugs.debian.org/1110254		 Sebastian Andrzej Siewior <sebastian@breakpoint.cc> no 2025-08-04
Revert-Add-test_verify-tests.patch Revert "Add test_verify tests"
This reverts commit a468bdb02531e ("Add test_verify tests")

Avoid crashes in users, see https://bugs.debian.org/1110254		 Sebastian Andrzej Siewior <sebastian@breakpoint.cc> no 2025-08-04
use_proxy-Add-missing-terminating-NUL-byte.patch use_proxy(): Add missing terminating NUL byte
Fixes CVE-2025-9232

There is a missing terminating NUL byte after strncpy() call.
Issue and a proposed fix reported by Stanislav Fort (Aisle Research).		 Tomas Mraz <tomas@openssl.org> no 2025-09-11
kek_unwrap_key-Fix-incorrect-check-of-unwrapped-key-size.patch kek_unwrap_key(): Fix incorrect check of unwrapped key size
Fixes CVE-2025-9230

The check is off by 8 bytes so it is possible to overread by
up to 8 bytes and overwrite up to 4 bytes.		 Viktor Dukhovni <openssl-users@dukhovni.org> no 2025-09-11

All known versions for source package 'openssl'

Links