[scarthgap][PATCH] openssl: fix CVE-2025-15468

[scarthgap][PATCH] openssl: fix CVE-2025-15468

[Hitendra Prajapati]

Upstream-Status: Backport from https://github.com/openssl/openssl/commit/1f08e54bad32843044fe8a675948d65e3b4ece65

Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
---
 .../openssl/openssl/CVE-2025-15468.patch      | 39 +++++++++++++++++++
 .../openssl/openssl_3.2.6.bb                  |  1 +
 2 files changed, 40 insertions(+)
 create mode 100644 meta/recipes-connectivity/openssl/openssl/CVE-2025-15468.patch

diff --git a/meta/recipes-connectivity/openssl/openssl/CVE-2025-15468.patch b/meta/recipes-connectivity/openssl/openssl/CVE-2025-15468.patch
new file mode 100644
index 0000000000..dcd862bedf
--- /dev/null
+++ b/meta/recipes-connectivity/openssl/openssl/CVE-2025-15468.patch
@@ -0,0 +1,39 @@
+From 1f08e54bad32843044fe8a675948d65e3b4ece65 Mon Sep 17 00:00:00 2001
+From: Daniel Kubec <kubec@openssl.org>
+Date: Fri, 9 Jan 2026 14:33:24 +0100
+Subject: [PATCH] ossl_quic_get_cipher_by_char(): Add a NULL guard before
+ dereferencing SSL_CIPHER
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Fixes CVE-2025-15468
+
+Reviewed-by: Saša Nedvědický <sashan@openssl.org>
+Reviewed-by: Tomas Mraz <tomas@openssl.org>
+MergeDate: Mon Jan 26 19:36:04 2026
+(cherry picked from commit 293b55de0c434a99d0e744d0521170ca280606a9)
+
+CVE: CVE-2025-15468
+Upstream-Status: Backport [https://github.com/openssl/openssl/commit/1f08e54bad32843044fe8a675948d65e3b4ece65]
+Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
+---
+ ssl/quic/quic_impl.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/ssl/quic/quic_impl.c b/ssl/quic/quic_impl.c
+index 98b6a0a..4abde64 100644
+--- a/ssl/quic/quic_impl.c
++++ b/ssl/quic/quic_impl.c
+@@ -3646,6 +3646,8 @@ const SSL_CIPHER *ossl_quic_get_cipher_by_char(const unsigned char *p)
+ {
+     const SSL_CIPHER *ciph = ssl3_get_cipher_by_char(p);
+ 
++    if (ciph == NULL)
++        return NULL;
+     if ((ciph->algorithm2 & SSL_QUIC) == 0)
+         return NULL;
+ 
+-- 
+2.50.1
+
diff --git a/meta/recipes-connectivity/openssl/openssl_3.2.6.bb b/meta/recipes-connectivity/openssl/openssl_3.2.6.bb
index fac62245d7..4fd13d52fe 100644
--- a/meta/recipes-connectivity/openssl/openssl_3.2.6.bb
+++ b/meta/recipes-connectivity/openssl/openssl_3.2.6.bb
@@ -16,6 +16,7 @@ SRC_URI = "https://github.com/openssl/openssl/releases/download/openssl-${PV}/op
            file://CVE-2025-15467-01.patch \
            file://CVE-2025-15467-02.patch \
            file://CVE-2025-15467-03.patch \
+           file://CVE-2025-15468.patch \
            "
 
 SRC_URI:append:class-nativesdk = " \
-- 
2.50.1

Re: [OE-core] [scarthgap][PATCH] openssl: fix CVE-2025-15468

[Yoann Congal]

On Mon Feb 2, 2026 at 5:34 AM CET, Hitendra Prajapati via lists.openembedded.org wrote:
> Upstream-Status: Backport from https://github.com/openssl/openssl/commit/1f08e54bad32843044fe8a675948d65e3b4ece65
>
> Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
> ---
>  .../openssl/openssl/CVE-2025-15468.patch      | 39 +++++++++++++++++++
>  .../openssl/openssl_3.2.6.bb                  |  1 +
>  2 files changed, 40 insertions(+)
>  create mode 100644 meta/recipes-connectivity/openssl/openssl/CVE-2025-15468.patch

Hello,

Thanks for the patch.

(Same as CVE-2025-15467)
As far as I can tell, CVE-2025-69419 does also impact whinlatter. Can you
send a fix there (either by then backport or maybe an upgrade?)

Thanks!
-- 
Yoann Congal
Smile ECS

Re: [OE-core] [scarthgap][PATCH] openssl: fix CVE-2025-15468

[Yoann Congal]

On Mon Feb 2, 2026 at 5:34 AM CET, Hitendra Prajapati via lists.openembedded.org wrote:
> Upstream-Status: Backport from https://github.com/openssl/openssl/commit/1f08e54bad32843044fe8a675948d65e3b4ece65
>

Same remark as https://lists.openembedded.org/g/openembedded-core/topic/117540534#msg231419

Can you send a V2 with an improved commit message please? Content of the
patch looks good.

Thanks!

> Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
> ---
>  .../openssl/openssl/CVE-2025-15468.patch      | 39 +++++++++++++++++++
>  .../openssl/openssl_3.2.6.bb                  |  1 +
>  2 files changed, 40 insertions(+)
>  create mode 100644 meta/recipes-connectivity/openssl/openssl/CVE-2025-15468.patch
>
> diff --git a/meta/recipes-connectivity/openssl/openssl/CVE-2025-15468.patch b/meta/recipes-connectivity/openssl/openssl/CVE-2025-15468.patch
> new file mode 100644
> index 0000000000..dcd862bedf
> --- /dev/null
> +++ b/meta/recipes-connectivity/openssl/openssl/CVE-2025-15468.patch
> @@ -0,0 +1,39 @@
> +From 1f08e54bad32843044fe8a675948d65e3b4ece65 Mon Sep 17 00:00:00 2001
> +From: Daniel Kubec <kubec@openssl.org>
> +Date: Fri, 9 Jan 2026 14:33:24 +0100
> +Subject: [PATCH] ossl_quic_get_cipher_by_char(): Add a NULL guard before
> + dereferencing SSL_CIPHER
> +MIME-Version: 1.0
> +Content-Type: text/plain; charset=UTF-8
> +Content-Transfer-Encoding: 8bit
> +
> +Fixes CVE-2025-15468
> +
> +Reviewed-by: Saša Nedvědický <sashan@openssl.org>
> +Reviewed-by: Tomas Mraz <tomas@openssl.org>
> +MergeDate: Mon Jan 26 19:36:04 2026
> +(cherry picked from commit 293b55de0c434a99d0e744d0521170ca280606a9)
> +
> +CVE: CVE-2025-15468
> +Upstream-Status: Backport [https://github.com/openssl/openssl/commit/1f08e54bad32843044fe8a675948d65e3b4ece65]
> +Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
> +---
> + ssl/quic/quic_impl.c | 2 ++
> + 1 file changed, 2 insertions(+)
> +
> +diff --git a/ssl/quic/quic_impl.c b/ssl/quic/quic_impl.c
> +index 98b6a0a..4abde64 100644
> +--- a/ssl/quic/quic_impl.c
> ++++ b/ssl/quic/quic_impl.c
> +@@ -3646,6 +3646,8 @@ const SSL_CIPHER *ossl_quic_get_cipher_by_char(const unsigned char *p)
> + {
> +     const SSL_CIPHER *ciph = ssl3_get_cipher_by_char(p);
> + 
> ++    if (ciph == NULL)
> ++        return NULL;
> +     if ((ciph->algorithm2 & SSL_QUIC) == 0)
> +         return NULL;
> + 
> +-- 
> +2.50.1
> +
> diff --git a/meta/recipes-connectivity/openssl/openssl_3.2.6.bb b/meta/recipes-connectivity/openssl/openssl_3.2.6.bb
> index fac62245d7..4fd13d52fe 100644
> --- a/meta/recipes-connectivity/openssl/openssl_3.2.6.bb
> +++ b/meta/recipes-connectivity/openssl/openssl_3.2.6.bb
> @@ -16,6 +16,7 @@ SRC_URI = "https://github.com/openssl/openssl/releases/download/openssl-${PV}/op
>             file://CVE-2025-15467-01.patch \
>             file://CVE-2025-15467-02.patch \
>             file://CVE-2025-15467-03.patch \
> +           file://CVE-2025-15468.patch \
>             "
>  
>  SRC_URI:append:class-nativesdk = " \


-- 
Yoann Congal
Smile ECS