FreeBSD source tree https://cgit-dev.freebsd.org/src/atom?h=main 2026-06-10T15:31:07Z 2026-06-10T15:31:07Z Enji Cooper ngie@FreeBSD.org 2026-06-10T15:25:28Z urn:sha1:1523ccfd9c8c254f7928143d31c305384b05fd11 This change is a security release which resolves several issues with OpenSSL 3.5, the highest severity issue being ranked "High". Users are strongly encouraged to update to this release. More information about the release (from a high level) can be found in the release notes [1]. 1. https://github.com/openssl/openssl/blob/openssl-3.5.7/NEWS.md All conflicts were resolved with `--theirs`, taking the release diff over the local diff; the conflicts occurred due to preemptive security fixes applied by so@ in e508c343. MFC after: 3 days (the important security issues have been preemptively addressed) Merge commit '3a71a35ad9dad0e5d2cad8efecc8ba9d57c42d43' Conflicts: crypto/openssl/include/internal/quic_channel.h crypto/openssl/ssl/quic/quic_channel_local.h crypto/openssl/ssl/quic/quic_rx_depack.c crypto/openssl/test/cmsapitest.c crypto/openssl/test/evp_extra_test.c 2025-08-07T13:50:32Z Pierre Pronchery khorben@FreeBSD.org 2025-08-07T13:50:32Z urn:sha1:e7be843b4a162e68651d3911f0357ed464915629 Approved by: philip (mentor) Sponsored by: Alpha-Omega Beach Cleaning Project Sponsored by: The FreeBSD Foundation 2024-09-08T04:31:22Z Enji Cooper ngie@FreeBSD.org 2024-09-08T04:30:17Z urn:sha1:a7148ab39c03abd4d1a84997c70bf96f15dd2a09 This release incorporates the following bug fixes and mitigations: - Fixed possible denial of service in X.509 name checks ([CVE-2024-6119]) - Fixed possible buffer overread in SSL_select_next_proto() ([CVE-2024-5535]) Release notes can be found at: https://openssl-library.org/news/openssl-3.0-notes/index.html Co-authored-by: gordon MFC after: 1 week Differential Revision: https://reviews.freebsd.org/D46602 Merge commit '108164cf95d9594884c2dcccba2691335e6f221b' 2024-06-26T23:50:13Z Enji Cooper ngie@FreeBSD.org 2024-06-26T23:50:13Z urn:sha1:44096ebd22ddd0081a357011714eff8963614b65 This release resolves 3 upstream found CVEs: - Fixed potential use after free after SSL_free_buffers() is called (CVE-2024-4741) - Fixed an issue where checking excessively long DSA keys or parameters may be very slow (CVE-2024-4603) - Fixed unbounded memory growth with session handling in TLSv1.3 (CVE-2024-2511) MFC after: 3 days Merge commit '1070e7dca8223387baf5155524b28f62bfe7da3c' 2024-02-02T21:21:36Z Cy Schubert cy@FreeBSD.org 2024-02-02T21:10:22Z urn:sha1:e0c4386e7e71d93b0edc0c8fa156263fc4a8b0b6 * Fixed PKCS12 Decoding crashes ([CVE-2024-0727]) * Fixed Excessive time spent checking invalid RSA public keys ([CVE-2023-6237]) * Fixed POLY1305 MAC implementation corrupting vector registers on PowerPC CPUs which support PowerISA 2.07 ([CVE-2023-6129]) * Fix excessive time spent in DH check / generation with large Q parameter value ([CVE-2023-5678]) Release notes can be found at https://www.openssl.org/news/openssl-3.0-notes.html. Approved by: emaste MFC after: 3 days Merge commit '9dd13e84fa8eca8f3462bd55485aa3da8c37f54a' 2023-08-10T16:07:32Z Pierre Pronchery pierre@freebsdfoundation.org 2023-08-10T16:07:32Z urn:sha1:aa7957345732816fb0ba8308798d2f79f45597f9 OpenSSL 3.0.10 addresses: - CVE-2023-3817 - CVE-2023-3446 - CVE-2023-2975 (Note that the vendor branch commit incorrectly referenced 3.0.9.) Relnotes: Yes Pull request: https://github.com/freebsd/freebsd-src/pull/808 Sponsored by: The FreeBSD Foundation 2023-06-23T22:53:36Z Pierre Pronchery pierre@freebsdfoundation.org 2023-06-23T22:53:35Z urn:sha1:b077aed33b7b6aefca7b17ddb250cf521f938613 Migrate to OpenSSL 3.0 in advance of FreeBSD 14.0. OpenSSL 1.1.1 (the version we were previously using) will be EOL as of 2023-09-11. Most of the base system has already been updated for a seamless switch to OpenSSL 3.0. For many components we've added `-DOPENSSL_API_COMPAT=0x10100000L` to CFLAGS to specify the API version, which avoids deprecation warnings from OpenSSL 3.0. Changes have also been made to avoid OpenSSL APIs that were already deprecated in OpenSSL 1.1.1. The process of updating to contemporary APIs can continue after this merge. Additional changes are still required for libarchive and Kerberos- related libraries or tools; workarounds will immediately follow this commit. Fixes are in progress in the upstream projects and will be incorporated when those are next updated. There are some performance regressions in benchmarks (certain tests in `openssl speed`) and in some OpenSSL consumers in ports (e.g. haproxy). Investigation will continue for these. Netflix's testing showed no functional regression and a rather small, albeit statistically significant, increase in CPU consumption with OpenSSL 3.0. Thanks to ngie@ and des@ for updating base system components, to antoine@ and bofh@ for ports exp-runs and port fixes/workarounds, and to Netflix and everyone who tested prior to commit or contributed to this update in other ways. PR: 271615 PR: 271656 [exp-run] Relnotes: Yes Sponsored by: The FreeBSD Foundation 2023-05-30T14:40:04Z Jung-uk Kim jkim@FreeBSD.org 2023-05-30T14:24:15Z urn:sha1:8f1ef87a6b93af292e68f8e33087e2df6325e9bb (cherry picked from commit 8ecb489345f08012fdc92a202a40119891cac330) 2023-02-07T18:51:38Z Jung-uk Kim jkim@FreeBSD.org 2023-02-07T18:51:38Z urn:sha1:640242a5915761ce63205bdb0542fa3c1473c0ff Merge commit '0d51f658515c605fcc4a8073cb5a8e0d7d904088' 2022-03-15T23:37:45Z Jung-uk Kim jkim@FreeBSD.org 2022-03-15T23:35:22Z urn:sha1:5ac766ab8ec23e780f108b7903d46e553d5e39d1