From 54cf737988c85b0e6f94965b91830a3961f34656 Mon Sep 17 00:00:00 2001 From: Markus Theil Date: Tue, 1 Jul 2025 17:18:21 +0200 Subject: [PATCH 1/2] openssl_3_5: 3.5.0 -> 3.5.1 Taken from OpenSSL Release Page: OpenSSL 3.5.1 is a security patch release. The most severe CVE fixed in this release is Low. This release incorporates the following bug fixes and mitigations: - Fix x509 application adds trusted use instead of rejected use. ([CVE-2025-4575]) Signed-off-by: Markus Theil --- .../libraries/openssl/3.5/CVE-2025-4575.patch | 61 ------------------- .../libraries/openssl/3.5/quic_accept.patch | 32 ---------- .../development/libraries/openssl/default.nix | 10 +-- 3 files changed, 2 insertions(+), 101 deletions(-) delete mode 100644 pkgs/development/libraries/openssl/3.5/CVE-2025-4575.patch delete mode 100644 pkgs/development/libraries/openssl/3.5/quic_accept.patch diff --git a/pkgs/development/libraries/openssl/3.5/CVE-2025-4575.patch b/pkgs/development/libraries/openssl/3.5/CVE-2025-4575.patch deleted file mode 100644 index 7ce31037264f..000000000000 --- a/pkgs/development/libraries/openssl/3.5/CVE-2025-4575.patch +++ /dev/null @@ -1,61 +0,0 @@ -From e96d22446e633d117e6c9904cb15b4693e956eaa Mon Sep 17 00:00:00 2001 -From: Tomas Mraz -Date: Tue, 20 May 2025 16:34:10 +0200 -Subject: [PATCH] apps/x509.c: Fix the -addreject option adding trust instead - of rejection - -Fixes CVE-2025-4575 - -Reviewed-by: Dmitry Belyavskiy -Reviewed-by: Paul Dale -(Merged from https://github.com/openssl/openssl/pull/27672) - -(cherry picked from commit 0eb9acc24febb1f3f01f0320cfba9654cf66b0ac) ---- - apps/x509.c | 2 +- - test/recipes/25-test_x509.t | 12 +++++++++++- - 2 files changed, 12 insertions(+), 2 deletions(-) - -diff --git a/apps/x509.c b/apps/x509.c -index fdae8f383a667..0c340c15b321a 100644 ---- a/apps/x509.c -+++ b/apps/x509.c -@@ -465,7 +465,7 @@ int x509_main(int argc, char **argv) - prog, opt_arg()); - goto opthelp; - } -- if (!sk_ASN1_OBJECT_push(trust, objtmp)) -+ if (!sk_ASN1_OBJECT_push(reject, objtmp)) - goto end; - trustout = 1; - break; -diff --git a/test/recipes/25-test_x509.t b/test/recipes/25-test_x509.t -index 09b61708ff8a5..dfa0a428f5f0c 100644 ---- a/test/recipes/25-test_x509.t -+++ b/test/recipes/25-test_x509.t -@@ -16,7 +16,7 @@ use OpenSSL::Test qw/:DEFAULT srctop_file/; - - setup("test_x509"); - --plan tests => 134; -+plan tests => 138; - - # Prevent MSys2 filename munging for arguments that look like file paths but - # aren't -@@ -110,6 +110,16 @@ ok(run(app(["openssl", "x509", "-new", "-force_pubkey", $key, "-subj", "/CN=EE", - && run(app(["openssl", "verify", "-no_check_time", - "-trusted", $ca, "-partial_chain", $caout]))); - -+# test trust decoration -+ok(run(app(["openssl", "x509", "-in", $ca, "-addtrust", "emailProtection", -+ "-out", "ca-trusted.pem"]))); -+cert_contains("ca-trusted.pem", "Trusted Uses: E-mail Protection", -+ 1, 'trusted use - E-mail Protection'); -+ok(run(app(["openssl", "x509", "-in", $ca, "-addreject", "emailProtection", -+ "-out", "ca-rejected.pem"]))); -+cert_contains("ca-rejected.pem", "Rejected Uses: E-mail Protection", -+ 1, 'rejected use - E-mail Protection'); -+ - subtest 'x509 -- x.509 v1 certificate' => sub { - tconversion( -type => 'x509', -prefix => 'x509v1', - -in => srctop_file("test", "testx509.pem") ); diff --git a/pkgs/development/libraries/openssl/3.5/quic_accept.patch b/pkgs/development/libraries/openssl/3.5/quic_accept.patch deleted file mode 100644 index 502380ab61d6..000000000000 --- a/pkgs/development/libraries/openssl/3.5/quic_accept.patch +++ /dev/null @@ -1,32 +0,0 @@ -From 38bf6f3036d1baddbe4618a219aaf17d460091d9 Mon Sep 17 00:00:00 2001 -From: Matt Caswell -Date: Mon, 7 Apr 2025 09:58:30 +0100 -Subject: [PATCH] Fix SSL_accept() -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -If you have a QUIC server SSL connection object, you should be able to -call SSL_accept() on it. - -Fixes #27282 - -Reviewed-by: Neil Horman -Reviewed-by: Saša Nedvědický -(Merged from https://github.com/openssl/openssl/pull/27283) ---- - ssl/quic/quic_method.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/ssl/quic/quic_method.c b/ssl/quic/quic_method.c -index 0de2bca47e6bb..8092855efc61a 100644 ---- a/ssl/quic/quic_method.c -+++ b/ssl/quic/quic_method.c -@@ -23,5 +23,5 @@ IMPLEMENT_quic_meth_func(OSSL_QUIC_ANY_VERSION, - - IMPLEMENT_quic_meth_func(OSSL_QUIC_ANY_VERSION, - OSSL_QUIC_server_method, -- ssl_undefined_function, -- ossl_quic_connect, ssl3_undef_enc_method) -+ ossl_quic_accept, -+ ssl_undefined_function, ssl3_undef_enc_method) diff --git a/pkgs/development/libraries/openssl/default.nix b/pkgs/development/libraries/openssl/default.nix index 81771b8ca138..a95ba32fd69d 100644 --- a/pkgs/development/libraries/openssl/default.nix +++ b/pkgs/development/libraries/openssl/default.nix @@ -388,8 +388,8 @@ in }; openssl_3_5 = common { - version = "3.5.0"; - hash = "sha256-NE0KefGpsIApsHROLMQBpD+ckKzRBE0JpTC0iFqOn8A="; + version = "3.5.1"; + hash = "sha256-UpBDsVz/pfNgd6TQr4Pz3jmYBxgdYHRB1zQZbYibZB8="; patches = [ ./3.0/nix-ssl-cert-file.patch @@ -404,12 +404,6 @@ in else ./3.5/use-etc-ssl-certs.patch ) - - # can be dropped again with 3.5.1, see: https://github.com/openssl/openssl/issues/27282 - ./3.5/quic_accept.patch - - # can be dropped again with 3.5.1 - ./3.5/CVE-2025-4575.patch ]; withDocs = true; From 663f5373602470bd99c376f0381f0081e11a9665 Mon Sep 17 00:00:00 2001 From: Markus Theil Date: Wed, 2 Jul 2025 10:28:59 +0200 Subject: [PATCH 2/2] openssl_3: 3.0.16 -> 3.0.17 - Fixes no CVEs - Bugfixes only - Upstream URL: no changes listed - Commits Changes: https://github.com/openssl/openssl/compare/openssl-3.0.16...openssl-3.0.17 Signed-off-by: Markus Theil --- pkgs/development/libraries/openssl/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/libraries/openssl/default.nix b/pkgs/development/libraries/openssl/default.nix index a95ba32fd69d..9a6b55ac6af6 100644 --- a/pkgs/development/libraries/openssl/default.nix +++ b/pkgs/development/libraries/openssl/default.nix @@ -365,8 +365,8 @@ in }; openssl_3 = common { - version = "3.0.16"; - hash = "sha256-V+A8UP6rXTGxUq8rdk8QN5rs2O6S8WyYWYPOSpn374Y="; + version = "3.0.17"; + hash = "sha256-39135OobV/86bb3msL3D8x21rJnn/dTq+eH7tuwtuM4="; patches = [ ./3.0/nix-ssl-cert-file.patch