[Buildroot] [PATCH] package/libopenssl: security bump to version 3.4.1

[Buildroot] [PATCH] package/libopenssl: security bump to version 3.4.1

[Peter Korsgaard]

Fixes the following security issues:

CVE-2024-13176: Timing side-channel in ECDSA signature computation
https://openssl-library.org/news/vulnerabilities/index.html#CVE-2024-13176

CVE-2024-12797: RFC7250 handshakes with unauthenticated servers don't abort
as expected
https://openssl-library.org/news/vulnerabilities/index.html#CVE-2024-12797

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
---
 package/libopenssl/libopenssl.hash | 4 ++--
 package/libopenssl/libopenssl.mk   | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/package/libopenssl/libopenssl.hash b/package/libopenssl/libopenssl.hash
index dad30da34e..5924c5d46a 100644
--- a/package/libopenssl/libopenssl.hash
+++ b/package/libopenssl/libopenssl.hash
@@ -1,5 +1,5 @@
-# From https://github.com/openssl/openssl/releases/download/openssl-3.4.0/openssl-3.4.0.tar.gz.sha256
-sha256  e15dda82fe2fe8139dc2ac21a36d4ca01d5313c75f99f46c4e8a27709b7294bf  openssl-3.4.0.tar.gz
+# From https://github.com/openssl/openssl/releases/download/openssl-3.4.1/openssl-3.4.1.tar.gz.sha256
+sha256  002a2d6b30b58bf4bea46c43bdd96365aaf8daa6c428782aa4feee06da197df3  openssl-3.4.1.tar.gz
 
 # License files
 sha256  7d5450cb2d142651b8afa315b5f238efc805dad827d91ba367d8516bc9d49e7a  LICENSE.txt
diff --git a/package/libopenssl/libopenssl.mk b/package/libopenssl/libopenssl.mk
index 6a59cb2ff0..c1c5b818d7 100644
--- a/package/libopenssl/libopenssl.mk
+++ b/package/libopenssl/libopenssl.mk
@@ -4,7 +4,7 @@
 #
 ################################################################################
 
-LIBOPENSSL_VERSION = 3.4.0
+LIBOPENSSL_VERSION = 3.4.1
 LIBOPENSSL_SITE = https://github.com/openssl/openssl/releases/download/openssl-$(LIBOPENSSL_VERSION)
 LIBOPENSSL_SOURCE = openssl-$(LIBOPENSSL_VERSION).tar.gz
 LIBOPENSSL_LICENSE = Apache-2.0
-- 
2.39.5

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH] package/libopenssl: security bump to version 3.4.1

[Julien Olivain]

On 11/02/2025 17:37, Peter Korsgaard wrote:
> Fixes the following security issues:
> 
> CVE-2024-13176: Timing side-channel in ECDSA signature computation
> https://openssl-library.org/news/vulnerabilities/index.html#CVE-2024-13176
> 
> CVE-2024-12797: RFC7250 handshakes with unauthenticated servers don't 
> abort
> as expected
> https://openssl-library.org/news/vulnerabilities/index.html#CVE-2024-12797
> 
> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

Applied to master, thanks.
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH] package/libopenssl: security bump to version 3.4.1

[Peter Korsgaard]

>>>>> "Peter" == Peter Korsgaard <peter@korsgaard.com> writes:

 > Fixes the following security issues:
 > CVE-2024-13176: Timing side-channel in ECDSA signature computation
 > https://openssl-library.org/news/vulnerabilities/index.html#CVE-2024-13176

 > CVE-2024-12797: RFC7250 handshakes with unauthenticated servers don't abort
 > as expected
 > https://openssl-library.org/news/vulnerabilities/index.html#CVE-2024-12797

 > Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

Committed to 2024.11.x, thanks. For 2024.02.x I will instead bump to
3.2.4 which contains the same fixes.

-- 
Bye, Peter Korsgaard
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot