Debian Patches

Status for openssl/3.0.18-1~deb12u2

Patch Description Author Forwarded Bugs Origin Last update
debian-targets.patch debian-targets Debian OpenSSL Team <pkg-openssl-devel@lists.alioth.debian.org> no 2017-11-05
man-section.patch man-section Debian OpenSSL Team <pkg-openssl-devel@lists.alioth.debian.org> no 2017-11-05
no-symbolic.patch no-symbolic Debian OpenSSL Team <pkg-openssl-devel@lists.alioth.debian.org> no 2017-11-05
pic.patch pic Debian OpenSSL Team <pkg-openssl-devel@lists.alioth.debian.org> no 2017-11-05
c_rehash-compat.patch also create old hash for compatibility Ludwig Nussel <ludwig.nussel@suse.de> no 2010-04-21
Configure-allow-to-enable-ktls-if-target-does-not-start-w.patch Configure: allow to enable ktls if target does not start with Linux
The Debian build system uses a `debian' target which sets CFLAGS and
then we have for instance debian-amd64 which inherits from
linux-x86_64 and debian. So far so good.

Since the target name does not start with `linux', the build system does not
enable ktls. So in order to get enabled, I
added a
`enable => [ "ktls" ],'
to the generic linux config which sets it explicit). Having this set, we can
check for it instead matching the target name.

This commit is based on changes for afalgeng in commit
9e381e8a01859 ("Configure: allow to enable afalgeng if target does not start with Linux")		 Sebastian Andrzej Siewior <sebastian@breakpoint.cc> no 2021-04-01
Remove-the-provider-section.patch Remove the provider section.
The provider section breaks libssl1.1 users. Remove it for now.		 Sebastian Andrzej Siewior <sebastian@breakpoint.cc> no 2022-06-08
conf-Serialize-allocation-free-of-ssl_names.patch conf: Serialize allocation/free of ssl_names.
The access to `ssl_names' is not fully serialized. With multiple threads
it is possible that more than one thread starts to clean up `ssl_names'.
This leads to occasional segfaults if more than one terminates and
performs the clean up.		 Sebastian Andrzej Siewior <sebastian@breakpoint.cc> no 2022-09-19
Fix-tests-for-new-default-security-level.patch Fix tests for new default security level
Fix tests that were expecting a default security level of 1 to work with
the new default of 2.

(Merged from https://github.com/openssl/openssl/pull/16760)		 Matt Caswell <matt@openssl.org> no 2021-10-05
Correct-handling-of-AEAD-encrypted-CMS-with-inadmissibly-.patch Correct handling of AEAD-encrypted CMS with inadmissibly long IV
Fixes CVE-2025-15467		 Igor Ustinov <igus68@gmail.com> no 2026-01-12
Some-comments-to-clarify-functions-usage.patch Some comments to clarify functions usage Igor Ustinov <igus68@gmail.com> no 2026-01-12
Test-for-handling-of-AEAD-encrypted-CMS-with-inadmissibly.patch Test for handling of AEAD-encrypted CMS with inadmissibly long IV Igor Ustinov <igus68@gmail.com> no 2026-01-11
Fix-heap-buffer-overflow-in-BIO_f_linebuffer.patch Fix heap buffer overflow in BIO_f_linebuffer
When a FIO_f_linebuffer is part of a bio chain, and the next BIO
preforms short writes, the remainder of the unwritten buffer is copied
unconditionally to the internal buffer ctx->obuf, which may not be
sufficiently sized to handle the remaining data, resulting in a buffer
overflow.

Fix it by only copying data when ctx->obuf has space, flushing to the
next BIO to increase available storage if needed.

Fixes CVE-2025-68160		 Neil Horman <nhorman@openssl.org> no 2026-01-07
Fix-OCB-AES-NI-HW-stream-path-unauthenticated-unencrypted.patch Fix OCB AES-NI/HW stream path unauthenticated/unencrypted trailing bytes

When ctx->stream (e.g., AES‑NI or ARMv8 CE) is available, the fast path
encrypts/decrypts full blocks but does not advance in/out pointers. The
tail-handling code then operates on the base pointers, effectively reprocessing
the beginning of the buffer while leaving the actual trailing bytes
unencrypted (encryption) or using the wrong plaintext (decryption). The
authentication checksum excludes the true tail.

CVE-2025-69418		 Norbert Pocs <norbertp@openssl.org> no 2026-01-08
Harden-ASN1_mbstring_ncopy.patch Harden ASN1_mbstring_ncopy
Reported by Murali Aniruddhan


(Merged from https://github.com/openssl/openssl/pull/29376)		 Norbert Pocs <norbertp@openssl.org> no 2025-12-11
Check-return-code-of-UTF8_putc.patch Check return code of UTF8_putc

(Merged from https://github.com/openssl/openssl/pull/29376)		 Norbert Pocs <norbertp@openssl.org> no 2025-12-11
Verify-ASN1-object-s-types-before-attempting-to-access-th.patch Verify ASN1 object's types before attempting to access them as a particular type

Issue was reported in ossl_ess_get_signing_cert but is also present in
ossl_ess_get_signing_cert_v2.

Fixes CVE-2025-69420		 Bob Beck <beck@openssl.org> no 2026-01-07
Add-NULL-check-to-PKCS12_item_decrypt_d2i_ex.patch Add NULL check to PKCS12_item_decrypt_d2i_ex
Address CVE-2025-69421

Add NULL check for oct parameter		 Andrew Dinh <andrewd@openssl.org> no 2026-01-08
Ensure-ASN1-types-are-checked-before-use.patch Ensure ASN1 types are checked before use.
Some of these were fixed by LibreSSL in commit https://github.com/openbsd/src/commit/aa1f637d454961d22117b4353f98253e984b3ba8
this fix includes the other fixes in that commit, as well as fixes for others found by a scan
for a similar unvalidated access paradigm in the tree.

(Merged from https://github.com/openssl/openssl/pull/29582)		 Bob Beck <beck@openssl.org> no 2026-01-07

All known versions for source package 'openssl'

Links