[renovate]

This PR contains the following updates:

Package	Update	Change
libressl/portable	minor	v4.2.1 → v4.4.0

---

Release Notes

libressl/portable

v4.4.0

Compare Source

Security fix: Removed eMudhra emSign ECC Root CA - G3 from cert.pem

because of weak keys of some subordinate CAs. For purposes of
interoperability, uncompromised intermediates were added.
Upgrade note: Reinstalls no longer overwrite cert.pem, so this may
need a manual merge if your package manager does not take care of
this. 'CN=emSign ECC Root CA - G3' should not appear in cert.pem.

The versioning scheme has changed slightly

• See https://github.com/libressl/portable#versioning for details
• The actual release of 4.4.0 will be in the second half of October.
  API and ABI won't change.

Portable changes

• Fixed nc(1) network functionality on macOS.
• Enabled control flow protection for assembly with CMake.
• Fixed building on AIX, which lacks vsyslog().
• Fixed incorrect SHA-3 and SHAKE output on AIX with compilers
  that do not define BYTE_ORDER.
• Fixed building with newer llvm-mingw, which now ships endian.h.
• Added support for building on macOS Golden Gate, 27.0
• Fixed incorrect code generation by the MSVC ARM64 optimizer in
  constant-time bignum code.
• Enabled assembly on MSVC x64 with CMake generators that were not
  detected as 64-bit, such as "NMake Makefiles".
• Enabled SHA assembly on ELF AArch64 with CMake.
• Enabled bignum assembly on RISC-V with autotools.
• MIPS32 and MIPS64 assembly can be explicitly enabled.
• The CMake build now applies the same exploit-mitigation compiler
  and linker flags as the autotools build.
• Autotools hardening flag detection now honors user-supplied
  CFLAGS/LDFLAGS.
• Fixed default OPENSSLDIR on MinGW autotools builds to use a valid
  absolute path.
• Fixed CMake setting TLS_DEFAULT_CA_FILE to a relative path, and
  allow overriding TLS_DEFAULT_CA_FILE in CMake builds.
• Reinstalling no longer overwrites an existing cert.pem,
  openssl.cnf and x509v3.cnf.
• CMake builds now use the builtin arc4random on older macOS,
  FreeBSD and NetBSD releases with weakly seeded arc4random.
• Fixed openssl(1), nc(1) and ocspcheck(1) silently running without
  pledge and unveil on hosts that provide them.
• nc(1) now reports an error when -m minttl is not supported,
  rather than silently ignoring it.
• readpassphrase() now sets close-on-exec on the tty descriptor.
• Fixed buffer overflows in the getdelim() compatibility function.
• Windows compatibility layer fixes:
  • Changed struct timeval on MSVC to match winsock, fixing memory
    corruption in DTLSv1_get_timeout() and the datagram BIO
    timeout controls.
  • poll() now waits for the requested timeout instead of
    returning early, reports failed connects as POLLERR and
    returns errors instead of timeouts. This fixes openssl(1)
    s_client, s_server and ocsp spinning or missing errors.
  • connect() reports EINPROGRESS for non-blocking connections.
  • accept4() honors SOCK_NONBLOCK.
  • read() and write() no longer truncate lengths of 2 GiB or more.
  • pread() and pwrite() restore the file offset on error.
  • ftruncate() and fdopen() work on descriptors from open(),
    fixing tls_load_file() with a password.
  • socketpair() emulation now verifies its peer, and sets
    close-on-exec on the right handle.
  • Socket errors without an explicit mapping now set errno.
  • Fixed a double free in pthread_mutex_destroy().
  • Fixed a resource leak in openssl(1) speed.
  • snprintf() is always NUL-terminated on pre-2015 MSVC.
  • Fixed an out-of-bounds write in opendir() and error handling
    in getprogname().

Internal improvements

• Minor code cleanup for PKCS#7.
• Clear unused bits for the maximum of RFC 3779 IP address ranges.
• Cleanup passes over the DTLS code, avoiding many contortions.
• Zero out the failure_key in ML-KEM code.
• Improve portability in preprocessor based SHA assembly.
• Removed a few vestigial #ifdefs from public and internal headers.
• Introduce and use dtls12_handshake_msg framework.
• Rename union from _ to u in the ui code. Avoids Windows CE #ifdef.
• Clean up and simplify signature algorithm handling after removal
  of TLSv1.0 and TLSv1.1.
• Add a point at infinity check to ecdh_compute_key().
• Fix incorrect purpose check in unreachable non-legacy path of the
  modern X.509 verifier.
• Improve TLSv1.3 server handling of no shared groups.
• Correct secondary key share handling for HelloRetryRequests.
• Fix EXFLAG_CRITICAL mishandling in the crl_cb().
• Among CRLs with the same score prefer the one with the most recent
  thisUpdate to match BoringSSL and OpenSSL behavior.
• Clean up sequence number and message header handling in DTLS.
• Remove redundant BIO_write() length assertions in b64_write().
• Report invalid base64 BIO state as an internal error rather than
  asserting.
• Improve SHA-3 performance by using an unrolled and interleaved
  algorithm.
• Allocate TLSv1.3 receive buffers lazily.
• Simplify handling of remaining record content on switch to the
  legacy stack.
• Avoid harmless narrowing of the return value in dtls1_ctrl().
• Remove NID_md5_sha1 support from tls1_PRF().
• Remove DTLS unprocessed records queue.
• Remove DTLS application data queue.
• Remove SSL3_FLAGS_NO_RENEGOTIATE_CIPHERS which was never set.

Compatibility changes

• The misnamed tls_peer_cert_chain_pem() has been deprecated and may
  be removed in a future release. tls_peer_cert_chain_verified_pem()
  and tls_peer_cert_bundle_unverified_pem() should be used instead.
• Use X25519MLKEM768 as the preferred group for TLSv1.3 connections
  in libtls.
• Ensure libtls keeps working with future OpenSSL releases that will
  stop NUL-terminating ASN.1 strings. This is an old bug in libtls
  that will bite, probably starting with OpenSSL 4.2.
• CRYPTO_cleanup_all_ex_data() is now a no-op. It was not thread
  safe and the actual cleanup is now done by OPENSSL_cleanup().
• Align X509_check_ca() with modern OpenSSL. While it has long been
  documented that it only works after calling X509_check_purpose(),
  it still makes sense to "fail closed", i.e., indicate a non-CA.
• Added OIDs for CCR, ErikIndex, ErikPartition, ErikSegmentIndex,
  and communityDefinition.

Bug fixes

• Fix PKCS7_set_{un,}signed_attributes() to allow caller to free
  on failure rather than risking a double free.
• Initialize decode_error and invalid_key variables in TLS key share
  code to avoid branching on uninitialized memory.
• Record extension length between type and data in the ClientHello
  hash to ensure identical framing in first and second CH.
• Fix out of bound writes in the s_client XMSS mode.
• Ensure EC_GROUP_check and X509_CRL_verify failures result in "app"
  failures in openssl ecparam and openssl crl.
• Do not fail accept on reverse DNS lookup failures in s_socket.
• Ensure X509V3_EXT_print() only returns 0 and 1.
• Avoid calling memcmp() on NULL in IPAddressFamily_cmp().
• In libtls disallow wildcard matching of a TLD specified as a FQDN.
• Unbreak some aspects of TLSv1.2 with custom curve lists.
• Ensure a peer-provided EC public key uses uncompressed encoding.
• Send decode_error alert on failure to decode an EC peer pubkey.
• Avoid NULL dereference and out-of-bounds read in password-based
  CMS decryption.
• Add some missing bounds check to ASN1_mbstrinc_copy().
• Avoid freeing a caller-owned buffer in PKCS7_verify().
• Remove SSL_OP_LEGACY_SERVER_CONNECT from default options.
• Send illegal parameter alerts for various HelloRetryRequest
  violations.
• Check that the server selected ciphersuite is valid for use with
  TLSv1.2.
• Unlock CRYPTO_LOCK_UI on ui_open_session() failure to avoid
  a deadlock.
• Check HMAC() return value to avoid later use of uninitialized
  in openssl(1).
• Use correct alert for key_share without supported_groups.
• Don't drop X509_V_ERR_HOSTNAME_MISMATCH when verify callback
  returns 1. It has long been documented that this is ill advised
  but some applications still do it.
• Ensure the server selects an ALPN protocol that we advertised or
  abort the handshake with illegal_parameter.
• Fix streaming of PKCS#7 objects with omitted content.
• Avoid OOB access due to type confusion in PKCS7_stream()
• Plug leak and various other bugs in asn1_multi(), a helper to
  handle sequences and sets in config parsing.
• Fix RFC 3779 inheritance checks for leaves as far as possible
  without breaking the RPKI. Still allow the immediate issuer to
  omit one of the extensions because otherwise about one third of
  RFC 9286 Manifests would become invalid.
• Correct a botched size check in dtls1_process_fragment()
• Avoid confusing delta CRLs as full CRLs.
• When copying an RSA-PSS EVP_PKEY_CTX, ensure saltlen and minimal
  saltlen restrictions are copied rather than using the defaults.
• Allow DTLS clients to receive unexpected Finished messages.
• Cache the leaf's extensions before adding it to a validated
  chain to make name constraints check work more reliably.
• Ensure the whole subject is searched for email addresses and
  common names.
• Check for embedded NULs in emails and subjectAltname in the
  essentially unused legacy NAME_CONSTRAINTS_*() API.
• Remove support for nameRelativeToCRLIssuer in the CRL Distribution
  Point extension. Per RFC 5280 it SHOULD not be used by conforming
  CAs and it was eating memory for breakfast pre-signature.

Security and reliability fixes

• Fix parsing issues in X.509 name constraints URI host parsing.
  Handle IPv6 literals correctly and don't allow specially crafted
  userinfo to bypass host checks.
• Limit size of buffered DTLS handshake messages to avoid overly
  large memory consumption on small handshake message fragments.
• Fix an OCSP responder authorization bypass for clients using
  tls_config_ocsp_require_stapling(), of which only OpenBSD nc(1)
  and ftp(1) are known when they're used with the "muststaple" key
  word.

Testing and proactive security

• Improved test coverage for DTLS and TLS renegotiation.
• Add X.509 CRL regress from pre-Apache2-licensed BoringSSL.
• Rework the testing framework to be memory based rather than
  file based. Match Go's output format more closely.

Full changelog: https://github.com/libressl/portable/blob/v4.4.0/ChangeLog

v4.3.4

Compare Source

Security fix

• Removed eMudhra emSign ECC Root CA - G3 from cert.pem because of weak keys of some subordinate CAs. For purposes of interoperability, uncompromised intermediates were added.

Full changelog: https://github.com/libressl/portable/blob/v4.3.4/ChangeLog

v4.3.3

Compare Source

Portable changes

• Added support for building on macOS Golden Gate, 27.0
• Fixed incorrect code generation by the MSVC ARM64 optimizer in
  constant-time bignum code.
• Allow overriding TLS_DEFAULT_CA_FILE in CMake builds.
• Windows socketpair() emulation now sets close-on-exec on the right
  handle.

Security and reliability fixes

• Remove RelativeDistinguishedName support for CRL distribution points
• Ensure verify callbacks always returning 1 can see a hostname
  mismatch
• Correct botched size check in dtls1_preprocess_fragment()
• Limit size of buffered DTLS handshake messages
• Avoid potential overread on interrupted retransmission in DTLS
• Fix OCSP responder authorization bypass in libtls and ocspcheck(8)

Full changelog: https://github.com/libressl/portable/blob/OPENBSD_7_9/ChangeLog

v4.3.2

Compare Source

Portable Changes

• Rework portable assembly handling with LIBRESSL_USE_ASSEMBLY
• Add SHA assembly for elf-aarch64
• Add definition of ssize_t to cms.h for Windows
• Fix posix_open() implementation so it properly signals failure
• Fix SIGALRM handler for openssl speed on Windows
• Fix overwrite of user CFLAGS/LDFLAGS in hardening flag detection

Bug fixes

• Allow the verify callback to override the error for overlong
  cert chains again.

Full changelog: https://github.com/libressl/portable/blob/master/ChangeLog

v4.3.1

Compare Source

Portable Changes

• Add missing <limits.h> to fix build on some OS.

Full changelog: https://github.com/libressl/portable/blob/master/ChangeLog

v4.3.0

Compare Source

Internal improvements

• Remove the unused sequence number from X509_REVOKED.
• Replace a call to atoi() with strtonum() in nc(1) and replace a
  misleading use of ntohs() with htons().
• openssl(1) speed now uses HMAC-SHA256 for its hmac benchmark.
• Reimplemented only use of ASN1_PRINTABLE_type() in openssl(1) ca.
  The API will be removed in an upcoming release.
• Add curve NID to EC_POINT objects so the library has a clue on which
  curve a given EC_POINT is supposed to live.
• Use curve NID to check for compatibility between group and points
  in various EC API. This isn't 100% failsafe but good enough for sane
  uses.
• Require SSE in order to use gcm_{gmult,ghash}_4bit_mmx().
  On rare i386 machines suporting MMX but not SSE this could result
  in an illegal instruction.
• Cleaned up asn1t.h to make it somewhat readable and more robust by
  using C99 initializers in particular.
• Further assembly macro improvements for -portable.
• Add fast path for well-known DH primes in DH_check() (including
  those from RFC 7919). Some projects still fiddle with this in 2025.
• Rewrite ec_point_cmp() for readability and robustness.
• Improve EVP_{Open,Seal}Init() internals. This is legacy API that
  cannot be removed since one scripting language still exposes it.
• ASN1_BIT_STRING_set_bit() now trims trailing zero bits itself rather
  than relying on i2c_ASN1_BIT_STRING() to do that when encoding.
• Fix and add workarounds to libtls to improve const correctness and
  to avoid warnings when compiling with OpenSSL 4.
• Prefix EC_KEY methods with ec_key_ to avoid problems in some static
  links.
• Remove mac_packet, a leftover from accepting SSLv2 ClientHellos.
• Remove ssl_server_legacy_first_packet().
• In addition to what was done in LibreSSL 4.0 for the version
  handling, disable TLSv1.1 and lower also on the method level.
• Remove workaround for SSL 3.0/TLS 1.0 CBC vulnerability.
• Refactor ocsp_find_signer_sk() to avoid neglecting the ASN.1's
  semantics by direct reaching into deeply nested OCSP structures.

Compatibility changes

• Expose X509_VERIFY_PARAM_set_hostflags() as a public symbol.
• Provide SSL_SESSION_dup().
• BIGNUMs now use the C99 types uint64_t/uint32_t for the word width.
  Fixes long-standing issues with 32-bit longs on 64-bit Windows.
• Many unused BN_* macros with incomprehensible names were removed:
  BN_LONG, BN_BITS{,4}, BN_MASK2{,l,h,h1}, BN_TBIT, BN_DEC_CONV,
  BN_{DEC,HEX}_FMT{1,2}, ...
• openssl(1) cms no longer accepts the unsupported -compress and
  -uncompress switches.
• Added PKCS7_NO_DUAL_CONTENT flag/behavior. This is incorrect legacy
  behavior but some language bindings decided to rely on it in 2025.
• Remove STABLE_FLAGS_MALLOC but keep STABLE_NO_MASK because there is
  still one user...
• Fix ASN1_ADB_END macro to have compatible signature with OpenSSL.
  The adb_cb() argument is currently ignored.
• Unexport ASN1_LONG_UNDEF.

New features

• Support for MLKEM768_X25519 keyshare in TLS.
  https://datatracker.ietf.org/doc/draft-ietf-tls-ecdhe-mlkem/
• Added ML-KEM benchmarks to openssl(1) speed.
• Added support for starttls protocol sieve.
• Add support for RSASSA-PSS with pubkey OID RSASSA-PSS to libssl.

Bug fixes

• Ensure the group selected by a TLSv1.3 server for a
  HelloRetryRequest is not one for which the client has
  already sent a key share.
• Plug memory leak in CMS_EncryptedData_encrypt().
• Plug possible memory leak and double free in nref_nos().
• Removed always zero test results for some no longer available
  legacy primitives in openssl(1) speed.
• List SHA-3 digests in openssl(1) help output.
• Fix encoding of bit strings with trailing zeroes on which
  ASN1_STRING_FLAG_BITS_LEFT is not set.
• Add missing NULL pointer check to PKCS12_item_decrypt_d2i().
• Avoid type confusion leading to 1-byte read at address 0x00-0xff
  in PKCS#12 parsing.
• Fix type confusion in timestamp response parsing for v2 signing
  certs.
• Fix EVP_SealInit() to return 0 on error, not -1.
• Replace incorrect strncmp() with strcmp() in CRL distribution point
  config parsing.
• openssl x509 -text writes its output to the file specified by -out
  like all other openssl(1) subcommands.
• Stop Delta CRL processing in the verifier if the cRLNumber is
  missing. This is flagged on deserialization, but nothing checks
  that flag. This can lead to a NULL dereference if the verification
  has enabled Delta CRL checking by setting X509_V_FLAG_USE_DELTAS.
• Fix NULL dereference that can be triggered with malformed OAEP
  parameter encoding for CMS decryption.
• Add missing length checks before BIO_new_mem_buf() in libtls.
• Improve libtls error reporting consistency, avoid reporting
  unrelated errnos.
• Fix SAN dNSName constraints: instead of substring matching,
  match exactly and allow zero or more components in front of
  the candidate.

Reliability fix

• Fix off-by-one error in the X.509 verifier depth checking. This can
  lead to a 4-byte overwrite on heap allocated memory for clients
  talking to a malicious server or for servers that have client
  certificate verification enabled. In addition, the maximum depth
  must be set to the maximum allowed value of 32.
  Thanks to Calif.io in collaboration with Claude and Anthropic
  Research, for reporting the issue.

Testing and proactive security

• Port Wycheproof tests to testvectors_v1 and improve coverage
  and correctness. Add tests for ML-KEM in particular.

Full changelog: https://github.com/libressl/portable/blob/master/ChangeLog

v4.2.3

Compare Source

Security fix

• Removed eMudhra emSign ECC Root CA - G3 from cert.pem because of weak keys of some subordinate CAs. For purposes of interoperability, uncompromised intermediates were added.

Full changelog: https://github.com/libressl/portable/blob/v4.2.3/ChangeLog

v4.2.2

Compare Source

Portable changes

• Added support for building on macOS Golden Gate, 27.0
• Fixed incorrect code generation by the MSVC ARM64 optimizer in
  constant-time bignum code.
• Windows socketpair() emulation now sets close-on-exec on the right
  handle.

Security and reliability fixes

• Remove RelativeDistinguishedName support for CRL distribution points
• Fix off-by-one in the X.509 verifier depth checking
• Ensure verify callbacks always returning 1 can see a hostname
  mismatch
• Correct botched size check in dtls1_preprocess_fragment()
• Limit size of buffered DTLS handshake messages
• Avoid potential overread on interrupted retransmission in DTLS
• Fix OCSP responder authorization bypass in libtls and ocspcheck(8)

Full changelog: https://github.com/libressl/portable/blob/OPENBSD_7_8/ChangeLog

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud