Debian Patches

Status for wolfssl/5.7.2-0.1+deb13u2

Patch Description Author Forwarded Bugs Origin Last update
multi-arch.patch Make header files multi-arch compatible Exclude architecture dependent option HAVE___UINT128 from config.h Felix Lechner no debian
dfsg.patch Strike references to removed non-DFSG sources from build files=================================================================== Felix Lechner <felix.lechner@lease-up.com> not-needed
fix-hurd-i386-flags.patch Fix type definition for socklen_t on hurd-i386 Based on http://bugs.mysql.com/bug.php?id=22326 Felix Lechner <felix.lechner@lease-up.com> not-needed 2017-04-22
CVE-2025-7394.patch Reseed DRBG in RAND_poll() Josh Holtrop <josh@wolfssl.com> no 2025-06-05
disable-crl-monitor.patch Disable CRL monitor on all architectures CRL monitor is unavailable on Debian architecture kFreeBSD, causes FTBFS Felix Lechner <felix.lechner@lease-up.com> not-needed debian 2017-04-22
disable-jobserver.patch Disable job server for autopkgtest. The Debian CI system kept showing regressions for using multiple make jobs:
.
FAIL stderr: make[2]: warning: -j3 forced in submake: resetting jobserver mode.
.
Perhaps this will disable the jobserver.		 Felix Lechner <felix.lechner@lease-up.com> not-needed
handle-debian-files.diff Handling existing debian directory=================================================================== Jacob Barthelmeh no other
CVE-2026-5194.patch CVE-2026-5194 - require certificate signature OID to match issuer key OID
===================================================================		 wolfSSL not-needed debian upstream, https://github.com/wolfSSL/wolfssl/commit/abce5be989ccd0665e2b9445abb856886975dfd1 2026-06-29
CVE-2026-55962.patch CVE-2026-55962 - require client cert on outstanding TLS1.3 post-handshake auth
===================================================================		 wolfSSL not-needed debian upstream, https://github.com/wolfSSL/wolfssl/commit/f23544f09476d420becdfabd781eec0dd1a9c597 2026-06-29
CVE-2026-55967.patch CVE-2026-55967 - reject AES-GCM cumulative size overflow in streaming update
===================================================================		 wolfSSL not-needed debian upstream, https://github.com/wolfSSL/wolfssl/commit/5def276e07e23b7b3b5842afbe526b4d3703ce13 2026-06-29
CVE-2026-6092.patch CVE-2026-6092 - enforce Encrypt-then-MAC on TLS resumption path
===================================================================		 wolfSSL not-needed debian upstream, https://github.com/wolfSSL/wolfssl/commit/af5369636a938faf4a79d1f550d3b206c51fafec 2026-06-29
CVE-2026-6094.patch CVE-2026-6094 - bound encrypted content size in PKCS7 EnvelopedData
===================================================================		 wolfSSL not-needed debian upstream, https://github.com/wolfSSL/wolfssl/commit/1397268aa12e2cf3f80c3acfa9b6036b809c08ef 2026-06-29
CVE-2026-6329.patch CVE-2026-6329 - reject PKCS#12 MAC length mismatch
===================================================================		 wolfSSL not-needed debian upstream, https://github.com/wolfSSL/wolfssl/commit/9c304bdc099140ad2fdc41ef2f2602af9768c8a1 2026-06-29
CVE-2026-6331.patch CVE-2026-6331 - require exact HMAC tag length in EVP_DigestVerifyFinal A zero-length or truncated tag passed to wolfSSL_EVP_DigestVerifyFinal() was
accepted, because the length check only rejected oversized tags and an
XMEMCMP() of length zero returns a match. Require the supplied tag length to
equal the MAC length exactly.

===================================================================		 wolfSSL not-needed debian upstream, https://github.com/wolfSSL/wolfssl/commit/0749f20c33516897d8c5e2ab083b855e2d17d665 2026-06-29
CVE-2026-6678.patch CVE-2026-6678 - fix integer underflow in wc_PKCS7_DecryptOri
===================================================================		 wolfSSL not-needed debian upstream, https://github.com/wolfSSL/wolfssl/commit/84fb0f694cfaac4187c0beba4298a4a8a7995235 2026-06-29
CVE-2026-6681.patch CVE-2026-6681 - respect caller output buffer size in PKCS7 decode
===================================================================		 wolfSSL not-needed debian upstream, https://github.com/wolfSSL/wolfssl/commit/1de4020fe4f3f911641ac0477227249d4dda2157 2026-06-29
CVE-2026-6731.patch CVE-2026-6731 - apply DNS name constraints to Subject CN when no SAN
===================================================================		 wolfSSL not-needed debian upstream, https://github.com/wolfSSL/wolfssl/commit/e7b7fddacb4cc794e5dfc7693586d87a539f5aad 2026-06-29
CVE-2026-6325.patch CVE-2026-6325 - bound index in SetSuitesHashSigAlgo to prevent OOB write wolfSSL not-needed debian upstream, https://github.com/wolfSSL/wolfssl/commit/f540bb3ddfef89db637809392522247ce3e8200c
CVE-2026-55961.patch CVE-2026-55961 - reject degenerate certs-only PKCS#7 in wolfSSL_PKCS7_verify
===================================================================		 wolfSSL not-needed debian upstream, https://github.com/wolfSSL/wolfssl/commit/d382439c7c63c07294cf4fcece0aa56a35399d15 2026-06-29
CVE-2026-7511.patch CVE-2026-7511 - report the verifying cert as the PKCS#7 signer
===================================================================		 wolfSSL not-needed debian upstream, https://github.com/wolfSSL/wolfssl/commit/b7f6e77a95bfeda306b22dd34394e49c0a6c8a8c 2026-06-29
CVE-2026-6450.patch CVE-2026-6450 - reject CRLs with unrecognized critical extensions=================================================================== wolfSSL not-needed debian upstream, https://github.com/wolfSSL/wolfssl/commit/857141da35b67a14a580fb26ec57af1efa68a1d9
CVE-2026-55960.patch CVE-2026-55960 - validate negotiated certificate type for raw public keys wolfSSL not-needed debian upstream, https://github.com/wolfSSL/wolfssl/commit/c929798460656431bdeeffbf701a74521f403f36
CVE-2026-5194-digest-sizes.patch CVE-2026-5194 - enforce minimum/maximum digest sizes in signature ops Companion to CVE-2026-5194.patch (asn.c signature-OID match). Backports the
wolfcrypt-level digest-size enforcement half of upstream commit abce5be9: adds
WC_MIN_DIGEST_SIZE (hash.h) and rejects too-small/too-large hash inputs in the
ECC and DSA sign/verify primitives, the Ed25519ph/Ed448ph prehash length,
wc_SignatureVerifyHash and the PKCS7 ECDSA verify path. The upstream internal.c
EccVerify guard is omitted: it is redundant (EccVerify calls the now-guarded
wc_ecc_verify_hash) and its context mis-binds to Ed25519Sign on 5.7.2. The
enum->define header refactor, kernel module port, dilithium (not built) and
test-only hunks are likewise omitted.
===================================================================		 wolfSSL not-needed debian upstream, https://github.com/wolfSSL/wolfssl/commit/abce5be989ccd0665e2b9445abb856886975dfd1

All known versions for source package 'wolfssl'

Links