Skip to content

Comments

Don't keep the store open in by_store_ctrl_ex#28198

Closed
mattcaswell wants to merge 3 commits intoopenssl:masterfrom
mattcaswell:fix-by-store-race
Closed

Don't keep the store open in by_store_ctrl_ex#28198
mattcaswell wants to merge 3 commits intoopenssl:masterfrom
mattcaswell:fix-by-store-race

Conversation

@mattcaswell
Copy link
Member

@mattcaswell mattcaswell commented Aug 7, 2025

Previously #27529 made a change to by_store_ctrl_ex in order to open the OSSL_STORE early. The reason given in that PR is:

"This way, we can call OSSL_STORE_open_ex() in by_store_ctrl_ex(), and get to see possible errors when the URI is loaded"

That PR then kept the store open until cache_objects is called and then reused it. Unfortunately by the time cache_objects() is called we could be in a multi-threaded scenario where the X509_STORE is being shared by multiple threads. We then get a race condition where multiple threads are all using (and ultimately closing) the same OSSL_STORE_CTX.

The purpose of keeping the OSSL_STORE object between by_store_ctrl_ex() and cache_objects is presumably an optimisation to avoid having to open the store twice. But this does not work because of the above issue.

We just take the hit and open it again.

Fixes #28171

@mattcaswell mattcaswell marked this pull request as draft August 7, 2025 17:06
@mattcaswell mattcaswell mentioned this pull request Aug 7, 2025
Closed
@esyr
Copy link
Member

esyr commented Aug 7, 2025

I guess it also fixes #28065.

@mattcaswell mattcaswell mentioned this pull request Aug 8, 2025
Closed
jogme
jogme approved these changes Aug 8, 2025
View reviewed changes
Copy link
Contributor

@jogme jogme left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM!

nhorman
nhorman previously approved these changes Aug 8, 2025
View reviewed changes
@t8m
Copy link
Member

t8m commented Aug 8, 2025

I assume this will revert the performance improvement reported in #27529 (comment) though. Unfortunately I am afraid there is no way around that.

Will you take it out of draft @mattcaswell ?

@levitte
Copy link
Member

levitte commented Aug 11, 2025

Unfortunately, there's the risk that there are errors when reopening the URI in cache_objects, i.e. that this effectively reverts what #27529 was meant to fix (invisible errors, 'cause cache_objects can't report errors in any sensible way).

Mind you, I do understand the reasons for this PR, but it seems we're weighing one bad outcome against another.

@kroeckx
Copy link
Member

kroeckx commented Aug 11, 2025

Can you clarify why cache_objects can't report errors in any sensible way?

@levitte
Copy link
Member

levitte commented Aug 11, 2025

Can you clarify why cache_objects can't report errors in any sensible way?

Sure. It goes back to #27461, which was about STORE URIs not being reported on when giving them (when by_store_ctrl_ex is called), but later, when trying to use objects. It's even more exasperating when multiple stores are given, and tried through one after the other, and errors are ignored on the assumption that the desired object simply wasn't found (i.e. that finding it continues in the next store).

So cache_objects can report errors, but depending on where it's called, those reports may be confusing

@kroeckx
Copy link
Member

kroeckx commented Aug 11, 2025

And there is no cache per location?

@levitte
Copy link
Member

levitte commented Aug 11, 2025

Not sure I understand the question... CACHED_STORE is indeed a per-location struct. However, the error queue isn't cached per location.

@mattcaswell
Copy link
Member Author

mattcaswell commented Aug 11, 2025

Unfortunately, there's the risk that there are errors when reopening the URI in cache_objects, i.e. that this effectively reverts what #27529 was meant to fix

That risk existed even in #27529. In #27529 it only reused the currently open store once. After that it reopened it again anyway (because it closed the store at the end of cache_objects and set store->ctx = NULL). Since cache_objects is called regularly there was plenty of opportunity for errors.

@mattcaswell
Copy link
Member Author

mattcaswell commented Aug 11, 2025

Will you take it out of draft @mattcaswell ?

I think there is more work to be done. I'd like to confirm the performance impact (which I hope is negligible) - and I'd like to write a test. Unfortunately that won't happen until next week at the earliest.

@levitte
Copy link
Member

levitte commented Aug 11, 2025

Unfortunately, there's the risk that there are errors when reopening the URI in cache_objects, i.e. that this effectively reverts what #27529 was meant to fix

That risk existed even in #27529. In #27529 it only reused the currently open store once. After that it reopened it again anyway (because it closed the store at the end of cache_objects and set store->ctx = NULL). Since cache_objects is called regularly there was plenty of opportunity for errors.

Oh, good point

@mattcaswell
Copy link
Member Author

mattcaswell commented Aug 18, 2025

I assume this will revert the performance improvement reported in #27529 (comment) though. Unfortunately I am afraid there is no way around that.

That performance improvement was seen in the x509storeissuer performance test.

I've run this test on my local machine with 16 threads (the default case you see the performance graphs) both before and after this patch. In each case I ran it three times:

Before this patch:

$ ./x509storeissuer certs 16
Average time per X509_STORE_CTX_get1_issuer() call: 16.897261us
$ ./x509storeissuer certs 16
Average time per X509_STORE_CTX_get1_issuer() call: 17.511345us
$ ./x509storeissuer certs 16
Average time per X509_STORE_CTX_get1_issuer() call: 17.745438us

After this patch:

$ ./x509storeissuer certs 16
Average time per X509_STORE_CTX_get1_issuer() call: 17.158155us
$ ./x509storeissuer certs 16
Average time per X509_STORE_CTX_get1_issuer() call: 16.858598us
$ ./x509storeissuer certs 16
Average time per X509_STORE_CTX_get1_issuer() call: 16.936092us

Any performance impact appears negligible.

@mattcaswell
Don't keep the store open in by_store_ctrl_ex
a1835cf 
Previously openssl#27529 made a change to `by_store_ctrl_ex` in order to open
the OSSL_STORE early. The reason given in that PR is:

"This way, we can call OSSL_STORE_open_ex() in by_store_ctrl_ex(), and
get to see possible errors when the URI is loaded"

That PR then kept the store open until cache_objects is called and then
reused it. Unfortunately by the time cache_objects() is called we could be
in a multi-threaded scenario where the X509_STORE is being shared by
multiple threads. We then get a race condition where multiple threads are
all using (and ultimately closing) the same `OSSL_STORE_CTX`.

The purpose of keeping the `OSSL_STORE` object between by_store_ctrl_ex()
and `cache_objects` is presumably an optimisation to avoid having to open
the store twice. But this does not work because of the above issue.

We just take the hit and open it again.

Fixes openssl#28171
@mattcaswell mattcaswell force-pushed the fix-by-store-race branch 2 times, most recently from aa9c77a to bdaa78c Compare August 19, 2025 11:36
@mattcaswell
Add a test for accessing an X509_STORE from multiple threads
238a29e 
Check we don't have any threading issues when accessing an X509_STORE
simultaneously
@mattcaswell mattcaswell marked this pull request as ready for review August 19, 2025 11:40
@mattcaswell
Copy link
Member Author

mattcaswell commented Aug 19, 2025

I've now added a test for this and taken it out of draft. Please review.

Ping @openssl/committers.

@mattcaswell mattcaswell added branch: master Applies to master branch approval: review pending This pull request needs review by a committer triaged: bug The issue/pr is/fixes a bug branch: 3.0 Applies to openssl-3.0 branch severity: regression The issue/pr is a regression from previous released version tests: present The PR has suitable tests present labels Aug 19, 2025
openssl-machine pushed a commit that referenced this pull request Aug 21, 2025
@mattcaswell @t8m
Fix a race in by_store_subject
f0c9ea7 
When looking in the stack of objects in the store we need to ensure we
are holding a read lock for the store.

Issue detected via thread sanitizer after the test from the previous
commit was added.

Reviewed-by: Saša Nedvědický <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
(Merged from #28198)

(cherry picked from commit 07f65e1)
@t8m
Copy link
Member

t8m commented Aug 21, 2025

Merged to the master, 3.5, 3.4, 3.3 and 3.2 branches (fixing trivial conflicts). The test case will need bigger adjustments for 3.0. @mattcaswell please submit a backport to 3.0 as a separate PR. Thank you.

@t8m t8m closed this Aug 21, 2025
@t8m t8m removed the branch: 3.0 Applies to openssl-3.0 branch label Aug 21, 2025
@mattcaswell mattcaswell mentioned this pull request Aug 29, 2025
Closed
@mattcaswell
Copy link
Member Author

mattcaswell commented Aug 29, 2025

Back for 3.0 in #28385

esyr added a commit to esyr/openssl that referenced this pull request Sep 15, 2025
@esyr
CHANGES.md, NEWS.md: update for 3.5.3
2c3da19 
CHANGES.md:
 * openssl#28198
 * openssl#28398
 * openssl#28411
 * openssl#28447
 * openssl#28449

NEWS.md:
 * openssl#28447

Release: Yes
Signed-off-by: Eugene Syromiatnikov <[email protected]>
@esyr esyr mentioned this pull request Sep 15, 2025
Closed
esyr added a commit to esyr/openssl that referenced this pull request Sep 16, 2025
@esyr
CHANGES.md, NEWS.md: update for 3.5.3
dc2c086 
CHANGES.md:
 * openssl#28198
 * openssl#28398
 * openssl#28411
 * openssl#28447
 * openssl#28449

NEWS.md:
 * openssl#28447

Release: Yes
Signed-off-by: Eugene Syromiatnikov <[email protected]>
openssl-machine pushed a commit that referenced this pull request Sep 16, 2025
@esyr
CHANGES.md, NEWS.md: update for 3.5.3
9a267ec 
CHANGES.md:
 * #28198
 * #28398
 * #28411
 * #28447
 * #28449

NEWS.md:
 * #28447

Release: Yes
Signed-off-by: Eugene Syromiatnikov <[email protected]>

Reviewed-by: Neil Horman <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
(Merged from #28558)
esyr added a commit to esyr/openssl that referenced this pull request Sep 30, 2025
@esyr
CHANGES.md: update for 3.0.18
0b0f337 
3.0.18 CHANGES.md includes the following:
 * openssl#28098
 * openssl#28198
 * openssl#28398
 * openssl#28411
 * openssl#28449
 * openssl#28504
 * openssl#28535
 * openssl#28591
 * openssl#28624

Release: Yes
Signed-off-by: Eugene Syromiatnikov <[email protected]>
@esyr esyr mentioned this pull request Sep 30, 2025
Closed
esyr added a commit to esyr/openssl that referenced this pull request Sep 30, 2025
@esyr
CHANGES.md, NEWS.md: update for 3.2.6
101d2cd 
3.2.6 CHANGES.md includes the following:
 * openssl#28098
 * openssl#28198
 * openssl#28398
 * openssl#28411
 * openssl#28449
 * openssl#28504
 * openssl#28535
 * openssl#28591
 * openssl#28603
 * openssl#28624
 * openssl#28642

3.2.6 NEWS.md do not have any updates.

Updated the changes and news in the previous branches.

Release: Yes
Signed-off-by: Eugene Syromiatnikov <[email protected]>
esyr added a commit to esyr/openssl that referenced this pull request Sep 30, 2025
@esyr
CHANGES.md, NEWS.md: update for 3.3.5
e438dbe 
3.3.5 CHANGES.md includes the following:
 * openssl#28098
 * openssl#28198
 * openssl#28398
 * openssl#28411
 * openssl#28449
 * openssl#28504
 * openssl#28535
 * openssl#28591
 * openssl#28603
 * openssl#28624
 * openssl#28642

3.3.5 NEWS.md do not have any updates.

Updated the changes and news in the previous branches.

Release: Yes
Signed-off-by: Eugene Syromiatnikov <[email protected]>
esyr added a commit to esyr/openssl that referenced this pull request Sep 30, 2025
@esyr
CHANGES.md, NEWS.md: update for 3.4.3
6373a7a 
3.4.3 CHANGES.md includes the following:
 * openssl#28098
 * openssl#28198
 * openssl#28398
 * openssl#28411
 * openssl#28415
 * openssl#28449
 * openssl#28504
 * openssl#28535
 * openssl#28591
 * openssl#28603
 * openssl#28624
 * openssl#28642

3.4.3 NEWS.md do not have any updates.

Updated the changes and news in the previous branches.

Release: Yes
Signed-off-by: Eugene Syromiatnikov <[email protected]>
esyr added a commit to esyr/openssl that referenced this pull request Sep 30, 2025
@esyr
CHANGES.md, NEWS.md: update for 3.3.5
a979052 
3.3.5 CHANGES.md includes the following:
 * openssl#28098
 * openssl#28198
 * openssl#28398
 * openssl#28411
 * openssl#28449
 * openssl#28504
 * openssl#28535
 * openssl#28591
 * openssl#28603
 * openssl#28624
 * openssl#28642

3.3.5 NEWS.md do not have any updates.

Updated the changes and news in the previous branches.

Release: Yes
Signed-off-by: Eugene Syromiatnikov <[email protected]>
esyr added a commit to esyr/openssl that referenced this pull request Sep 30, 2025
@esyr
CHANGES.md, NEWS.md: update for 3.4.3
95115e6 
3.4.3 CHANGES.md includes the following:
 * openssl#28098
 * openssl#28198
 * openssl#28398
 * openssl#28411
 * openssl#28415
 * openssl#28449
 * openssl#28504
 * openssl#28535
 * openssl#28591
 * openssl#28603
 * openssl#28624
 * openssl#28642

3.4.3 NEWS.md do not have any updates.

Updated the changes and news in the previous branches.

Release: Yes
Signed-off-by: Eugene Syromiatnikov <[email protected]>
esyr added a commit to esyr/openssl that referenced this pull request Sep 30, 2025
@esyr
CHANGES.md, NEWS.md: update for 3.2.6
ccf53a9 
3.2.6 CHANGES.md includes the following:
 * openssl#28098
 * openssl#28198
 * openssl#28398
 * openssl#28411
 * openssl#28449
 * openssl#28504
 * openssl#28535
 * openssl#28591
 * openssl#28603
 * openssl#28624
 * openssl#28642

3.2.6 NEWS.md do not have any updates.

Updated the changes and news in the previous branches.

Release: Yes
Signed-off-by: Eugene Syromiatnikov <[email protected]>
esyr added a commit to esyr/openssl that referenced this pull request Sep 30, 2025
@esyr
CHANGES.md: update for 3.0.18
f4345be 
3.0.18 CHANGES.md includes the following:
 * openssl#28098
 * openssl#28198
 * openssl#28398
 * openssl#28411
 * openssl#28449
 * openssl#28504
 * openssl#28535
 * openssl#28591
 * openssl#28624

Release: Yes
Signed-off-by: Eugene Syromiatnikov <[email protected]>
openssl-machine pushed a commit that referenced this pull request Sep 30, 2025
@esyr
CHANGES.md: update for 3.4.3
124edf8 
3.4.3 CHANGES.md includes the following:
 * #28198
 * #28398
 * #28411
 * #28415
 * #28449

Release: Yes
Signed-off-by: Eugene Syromiatnikov <[email protected]>

Reviewed-by: Neil Horman <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
openssl-machine pushed a commit that referenced this pull request Sep 30, 2025
@esyr
CHANGES.md: update for 3.3.5
8e91919 
3.3.5 CHANGES.md includes the following:
 * #28198
 * #28398
 * #28411
 * #28449

Release: Yes
Signed-off-by: Eugene Syromiatnikov <[email protected]>

Reviewed-by: Neil Horman <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
openssl-machine pushed a commit that referenced this pull request Sep 30, 2025
@esyr
CHANGES.md: update for 3.2.6
47b6751 
3.2.6 CHANGES.md includes the following:
 * #28198
 * #28398
 * #28411
 * #28449

Release: Yes
Signed-off-by: Eugene Syromiatnikov <[email protected]>

Reviewed-by: Neil Horman <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
openssl-machine pushed a commit that referenced this pull request Sep 30, 2025
@esyr
CHANGES.md: update for 3.0.18
963062d 
3.0.18 CHANGES.md includes the following:
 * #28198
 * #28398
 * #28411
 * #28449

Release: Yes
Signed-off-by: Eugene Syromiatnikov <[email protected]>

Reviewed-by: Neil Horman <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
brainhoard-github pushed a commit to distro-core-curated-mirrors/poky-contrib that referenced this pull request Oct 6, 2025
@petermarko @sakoman
openssl: upgrade 3.2.4 -> 3.2.6
986ab2f 
3.2.6 has fixed 3.2.5 regression which broke python3 ptests so we can
upgrade now. We can also drop CVE-2025-27587 patch which was taken
instead of 3.2.5 upgrade under:
openssl/openssl#28198

Release information:
https://github.com/openssl/openssl/blob/openssl-3.0/NEWS.md#major-changes-between-openssl-3017-and-openssl-3018-30-sep-2025

OpenSSL 3.2.6 is a security patch release. The most severe CVE fixed in this release is Moderate.
This release incorporates the following bug fixes and mitigations:
* Fix Out-of-bounds read & write in RFC 3211 KEK Unwrap. (CVE-2025-9230)
* Fix Timing side-channel in SM2 algorithm on 64 bit ARM. (CVE-2025-9231)
* Fix Out-of-bounds read in HTTP client no_proxy handling. (CVE-2025-9232)

Release information:
https://github.com/openssl/openssl/blob/openssl-3.2/NEWS.md#major-changes-between-openssl-324-and-openssl-325-1-jul-2025

OpenSSL 3.2.5 is a bug fix release.
This release incorporates the following bug fixes and mitigations:
* Miscellaneous minor bug fixes.

(From OE-Core rev: 64c05c878253978980edf74903873b3d3f860b93)

Signed-off-by: Peter Marko <[email protected]>
Signed-off-by: Steve Sakoman <[email protected]>
brainhoard-github pushed a commit to distro-core-curated-mirrors/poky-contrib that referenced this pull request Oct 7, 2025
@petermarko @sakoman
openssl: upgrade 3.2.4 -> 3.2.6
d078a20 
3.2.6 has fixed 3.2.5 regression which broke python3 ptests so we can
upgrade now. We can also drop CVE-2025-27587 patch which was taken
instead of 3.2.5 upgrade under:
openssl/openssl#28198

Release information:
https://github.com/openssl/openssl/blob/openssl-3.0/NEWS.md#major-changes-between-openssl-3017-and-openssl-3018-30-sep-2025

OpenSSL 3.2.6 is a security patch release. The most severe CVE fixed in this release is Moderate.
This release incorporates the following bug fixes and mitigations:
* Fix Out-of-bounds read & write in RFC 3211 KEK Unwrap. (CVE-2025-9230)
* Fix Timing side-channel in SM2 algorithm on 64 bit ARM. (CVE-2025-9231)
* Fix Out-of-bounds read in HTTP client no_proxy handling. (CVE-2025-9232)

Release information:
https://github.com/openssl/openssl/blob/openssl-3.2/NEWS.md#major-changes-between-openssl-324-and-openssl-325-1-jul-2025

OpenSSL 3.2.5 is a bug fix release.
This release incorporates the following bug fixes and mitigations:
* Miscellaneous minor bug fixes.

(From OE-Core rev: f6db0fad3b9dc4649501da3545f7292400702444)

Signed-off-by: Peter Marko <[email protected]>
Signed-off-by: Steve Sakoman <[email protected]>
brainhoard-github pushed a commit to distro-core-curated-mirrors/poky-contrib that referenced this pull request Oct 9, 2025
@petermarko @sakoman
openssl: upgrade 3.2.4 -> 3.2.6
d289ba1 
3.2.6 has fixed 3.2.5 regression which broke python3 ptests so we can
upgrade now. We can also drop CVE-2025-27587 patch which was taken
instead of 3.2.5 upgrade under:
openssl/openssl#28198

Release information:
https://github.com/openssl/openssl/blob/openssl-3.0/NEWS.md#major-changes-between-openssl-3017-and-openssl-3018-30-sep-2025

OpenSSL 3.2.6 is a security patch release. The most severe CVE fixed in this release is Moderate.
This release incorporates the following bug fixes and mitigations:
* Fix Out-of-bounds read & write in RFC 3211 KEK Unwrap. (CVE-2025-9230)
* Fix Timing side-channel in SM2 algorithm on 64 bit ARM. (CVE-2025-9231)
* Fix Out-of-bounds read in HTTP client no_proxy handling. (CVE-2025-9232)

Release information:
https://github.com/openssl/openssl/blob/openssl-3.2/NEWS.md#major-changes-between-openssl-324-and-openssl-325-1-jul-2025

OpenSSL 3.2.5 is a bug fix release.
This release incorporates the following bug fixes and mitigations:
* Miscellaneous minor bug fixes.

(From OE-Core rev: f6db0fad3b9dc4649501da3545f7292400702444)

Signed-off-by: Peter Marko <[email protected]>
Signed-off-by: Steve Sakoman <[email protected]>
brainhoard-github pushed a commit to distro-core-curated-mirrors/poky-contrib that referenced this pull request Oct 10, 2025
@petermarko @sakoman
openssl: upgrade 3.2.4 -> 3.2.6
bd37b00 
3.2.6 has fixed 3.2.5 regression which broke python3 ptests so we can
upgrade now. We can also drop CVE-2025-27587 patch which was taken
instead of 3.2.5 upgrade under:
openssl/openssl#28198

Release information:
https://github.com/openssl/openssl/blob/openssl-3.0/NEWS.md#major-changes-between-openssl-3017-and-openssl-3018-30-sep-2025

OpenSSL 3.2.6 is a security patch release. The most severe CVE fixed in this release is Moderate.
This release incorporates the following bug fixes and mitigations:
* Fix Out-of-bounds read & write in RFC 3211 KEK Unwrap. (CVE-2025-9230)
* Fix Timing side-channel in SM2 algorithm on 64 bit ARM. (CVE-2025-9231)
* Fix Out-of-bounds read in HTTP client no_proxy handling. (CVE-2025-9232)

Release information:
https://github.com/openssl/openssl/blob/openssl-3.2/NEWS.md#major-changes-between-openssl-324-and-openssl-325-1-jul-2025

OpenSSL 3.2.5 is a bug fix release.
This release incorporates the following bug fixes and mitigations:
* Miscellaneous minor bug fixes.

(From OE-Core rev: f8a7f941c9ac1dbcaeb8cddec2b1e7388c6eded0)

Signed-off-by: Peter Marko <[email protected]>
Signed-off-by: Steve Sakoman <[email protected]>
halstead pushed a commit to openembedded/openembedded-core that referenced this pull request Oct 13, 2025
@petermarko @sakoman
openssl: upgrade 3.2.4 -> 3.2.6
ef6bbf3 
3.2.6 has fixed 3.2.5 regression which broke python3 ptests so we can
upgrade now. We can also drop CVE-2025-27587 patch which was taken
instead of 3.2.5 upgrade under:
openssl/openssl#28198

Release information:
https://github.com/openssl/openssl/blob/openssl-3.0/NEWS.md#major-changes-between-openssl-3017-and-openssl-3018-30-sep-2025

OpenSSL 3.2.6 is a security patch release. The most severe CVE fixed in this release is Moderate.
This release incorporates the following bug fixes and mitigations:
* Fix Out-of-bounds read & write in RFC 3211 KEK Unwrap. (CVE-2025-9230)
* Fix Timing side-channel in SM2 algorithm on 64 bit ARM. (CVE-2025-9231)
* Fix Out-of-bounds read in HTTP client no_proxy handling. (CVE-2025-9232)

Release information:
https://github.com/openssl/openssl/blob/openssl-3.2/NEWS.md#major-changes-between-openssl-324-and-openssl-325-1-jul-2025

OpenSSL 3.2.5 is a bug fix release.
This release incorporates the following bug fixes and mitigations:
* Miscellaneous minor bug fixes.

Signed-off-by: Peter Marko <[email protected]>
Signed-off-by: Steve Sakoman <[email protected]>
halstead pushed a commit to yoctoproject/poky that referenced this pull request Oct 13, 2025
@petermarko @sakoman
openssl: upgrade 3.2.4 -> 3.2.6
2f0df03 
3.2.6 has fixed 3.2.5 regression which broke python3 ptests so we can
upgrade now. We can also drop CVE-2025-27587 patch which was taken
instead of 3.2.5 upgrade under:
openssl/openssl#28198

Release information:
https://github.com/openssl/openssl/blob/openssl-3.0/NEWS.md#major-changes-between-openssl-3017-and-openssl-3018-30-sep-2025

OpenSSL 3.2.6 is a security patch release. The most severe CVE fixed in this release is Moderate.
This release incorporates the following bug fixes and mitigations:
* Fix Out-of-bounds read & write in RFC 3211 KEK Unwrap. (CVE-2025-9230)
* Fix Timing side-channel in SM2 algorithm on 64 bit ARM. (CVE-2025-9231)
* Fix Out-of-bounds read in HTTP client no_proxy handling. (CVE-2025-9232)

Release information:
https://github.com/openssl/openssl/blob/openssl-3.2/NEWS.md#major-changes-between-openssl-324-and-openssl-325-1-jul-2025

OpenSSL 3.2.5 is a bug fix release.
This release incorporates the following bug fixes and mitigations:
* Miscellaneous minor bug fixes.

(From OE-Core rev: ef6bbf39c10ff7bd8ad36d5d2f59ddd0756e0141)

Signed-off-by: Peter Marko <[email protected]>
Signed-off-by: Steve Sakoman <[email protected]>
jpuhlman pushed a commit to MontaVista-OpenSourceTechnology/poky that referenced this pull request Nov 4, 2025
@petermarko @jpuhlman
openssl: upgrade 3.2.4 -> 3.2.6
75c9162 
Source: poky
MR: 204763, 296373
Type: Security Fix
Disposition: Merged from poky
ChangeID: 2f0df03
Description:

3.2.6 has fixed 3.2.5 regression which broke python3 ptests so we can
upgrade now. We can also drop CVE-2025-27587 patch which was taken
instead of 3.2.5 upgrade under:
openssl/openssl#28198

Release information:
https://github.com/openssl/openssl/blob/openssl-3.0/NEWS.md#major-changes-between-openssl-3017-and-openssl-3018-30-sep-2025

OpenSSL 3.2.6 is a security patch release. The most severe CVE fixed in this release is Moderate.
This release incorporates the following bug fixes and mitigations:
* Fix Out-of-bounds read & write in RFC 3211 KEK Unwrap. (CVE-2025-9230)
* Fix Timing side-channel in SM2 algorithm on 64 bit ARM. (CVE-2025-9231)
* Fix Out-of-bounds read in HTTP client no_proxy handling. (CVE-2025-9232)

Release information:
https://github.com/openssl/openssl/blob/openssl-3.2/NEWS.md#major-changes-between-openssl-324-and-openssl-325-1-jul-2025

OpenSSL 3.2.5 is a bug fix release.
This release incorporates the following bug fixes and mitigations:
* Miscellaneous minor bug fixes.

(From OE-Core rev: ef6bbf39c10ff7bd8ad36d5d2f59ddd0756e0141)

Signed-off-by: Peter Marko <[email protected]>
Signed-off-by: Steve Sakoman <[email protected]>
Signed-off-by: Jeremy A. Puhlman <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@Sashan Sashan Sashan approved these changes

@t8m t8m t8m approved these changes

@jogme jogme jogme approved these changes

@nhorman nhorman nhorman left review comments

@levitte levitte Awaiting requested review from levitte

Assignees

No one assigned

Labels

approval: ready to merge The 24 hour grace period has passed, ready to merge branch: master Applies to master branch branch: 3.2 Applies to openssl-3.2 (EOL) branch: 3.3 Applies to openssl-3.3 branch: 3.4 Applies to openssl-3.4 branch: 3.5 Applies to openssl-3.5 severity: regression The issue/pr is a regression from previous released version tests: present The PR has suitable tests present triaged: bug The issue/pr is/fixes a bug

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

concurrent TLS connection segfault in x509 storage (regression on 3.0.17)

9 participants

@mattcaswell @esyr @t8m @levitte @kroeckx @openssl-machine @Sashan @nhorman @jogme