CVE fixes 01.07.26

Author: 5kt

prepare_source

@@ -1,7 +1,7 @@
 git_src -b debian/openssl-3.5.5-1 https://salsa.debian.org/debian/openssl.git
 import_upstream_patches
 
-version_suffix="gl50"
+version_suffix="gl51"
 fips_version_suffix="${version_suffix}"
 sed "s/SED_MARKER_FOR_FIPS_VERSION/$fips_version_suffix/" <patches-debian/rules.patch.tpl > patches-debian/rules.patch
 apply_patches patches-debian

upstream_patches/Add-negative-length-validation-in-EVP_EncryptUpdate-.patch

@@ -0,0 +1,118 @@
+From: Pranavjeet-Naidu <pranavjeetnaidu@gmail.com>
+Date: Wed, 25 Mar 2026 05:15:30 +0530
+Subject: Add negative length validation in EVP_EncryptUpdate and
+ EVP_DecryptUpdate
+
+Added input length validation checks to prevent potential security issues
+when negative values are passed to EVP_EncryptUpdate and EVP_DecryptUpdate.
+These functions cast inl (int) to size_t without validation, which could lead
+to unexpectedly large buffer allocation attempts or unintended behavior with
+negative inputs.
+
+Validation is performed early in both functions to ensure only valid,
+non-negative lengths are processed. Error is reported via EVP_R_INVALID_LENGTH.
+
+Fixes: https://github.com/openssl/openssl/issues/30486
+
+Reviewed-by: Paul Dale <paul.dale@oracle.com>
+Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
+Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
+MergeDate: Tue Mar 31 02:10:52 2026
+(Merged from https://github.com/openssl/openssl/pull/30560)
+
+(cherry picked from commit d29c165122bd480ca736a3eeb21d88a6b433ead3)
+---
+ crypto/evp/evp_enc.c  | 10 ++++++++++
+ test/evp_extra_test.c | 41 +++++++++++++++++++++++++++++++++++++++++
+ 2 files changed, 51 insertions(+)
+
+diff --git a/crypto/evp/evp_enc.c b/crypto/evp/evp_enc.c
+index 5584e06d7e..97ea6fd153 100644
+--- a/crypto/evp/evp_enc.c
++++ b/crypto/evp/evp_enc.c
+@@ -979,6 +979,11 @@ int EVP_EncryptUpdate(EVP_CIPHER_CTX *ctx, unsigned char *out, int *outl,
+     size_t soutl, inl_ = (size_t)inl;
+     int blocksize;
+ 
++    if (inl < 0) {
++        ERR_raise(ERR_LIB_EVP, EVP_R_INVALID_LENGTH);
++        return 0;
++    }
++
+     if (ossl_likely(outl != NULL)) {
+         *outl = 0;
+     } else {
+@@ -1128,6 +1133,11 @@ int EVP_DecryptUpdate(EVP_CIPHER_CTX *ctx, unsigned char *out, int *outl,
+     size_t soutl, inl_ = (size_t)inl;
+     int blocksize;
+ 
++    if (inl < 0) {
++        ERR_raise(ERR_LIB_EVP, EVP_R_INVALID_LENGTH);
++        return 0;
++    }
++
+     if (ossl_likely(outl != NULL)) {
+         *outl = 0;
+     } else {
+diff --git a/test/evp_extra_test.c b/test/evp_extra_test.c
+index d45f497f03..573732bfec 100644
+--- a/test/evp_extra_test.c
++++ b/test/evp_extra_test.c
+@@ -6547,6 +6547,45 @@ static int test_invalid_ctx_for_digest(void)
+     return ret;
+ }
+ 
++static int test_evp_cipher_negative_length(void)
++{
++    EVP_CIPHER_CTX *ctx = NULL;
++    EVP_CIPHER *cipher = NULL;
++    unsigned char key[16] = { 0 };
++    unsigned char iv[16] = { 0 };
++    unsigned char buffer[32] = { 0 };
++    int outl = 0;
++    int ret = 0;
++
++    if (!TEST_ptr(ctx = EVP_CIPHER_CTX_new()))
++        goto end;
++
++    if (!TEST_ptr(cipher = EVP_CIPHER_fetch(testctx, "AES-128-CBC", testpropq)))
++        goto end;
++
++    /* Initialize encryption context */
++    if (!TEST_int_eq(EVP_EncryptInit_ex2(ctx, cipher, key, iv, NULL), 1))
++        goto end;
++
++    /* Test EVP_EncryptUpdate with negative length - should fail */
++    if (!TEST_int_eq(EVP_EncryptUpdate(ctx, buffer, &outl, (unsigned char *)"test", -1), 0))
++        goto end;
++
++    /* Reinitialize for decryption */
++    if (!TEST_int_eq(EVP_DecryptInit_ex2(ctx, cipher, key, iv, NULL), 1))
++        goto end;
++
++    /* Test EVP_DecryptUpdate with negative length - should fail */
++    if (!TEST_int_eq(EVP_DecryptUpdate(ctx, buffer, &outl, (unsigned char *)"test", -1), 0))
++        goto end;
++
++    ret = 1;
++end:
++    EVP_CIPHER_free(cipher);
++    EVP_CIPHER_CTX_free(ctx);
++    return ret;
++}
++
+ static int test_evp_cipher_pipeline(void)
+ {
+     OSSL_PROVIDER *fake_pipeline = NULL;
+@@ -6950,6 +6989,8 @@ int setup_tests(void)
+ 
+     ADD_TEST(test_invalid_ctx_for_digest);
+ 
++    ADD_TEST(test_evp_cipher_negative_length);
++
+     ADD_TEST(test_evp_cipher_pipeline);
+ 
+     return 1;
+-- 
+2.53.0
+

upstream_patches/CVE-2026-34180.patch

@@ -0,0 +1,94 @@
+From: Viktor Dukhovni <openssl-users@dukhovni.org>
+Date: Tue, 7 Apr 2026 22:40:55 +1000
+Subject: Avoid length truncation in ASN1_STRING_set
+
+The ASN1_STRING_set() function takes an `int` length, make sure the
+argument is not inadvertently truncated when it is called from
+asn1_ex_c2i().
+
+Fixes CVE-2026-34180
+
+Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
+Reviewed-by: Norbert Pocs <norbertp@openssl.org>
+Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
+MergeDate: Mon Jun  8 14:13:56 2026
+(cherry picked from commit 5f525cace61a53311ee533374919356c700847d9)
+---
+ crypto/asn1/tasn_dec.c | 24 +++++++++++++++++-------
+ 1 file changed, 17 insertions(+), 7 deletions(-)
+
+diff --git a/crypto/asn1/tasn_dec.c b/crypto/asn1/tasn_dec.c
+index 91c2e524f55b9..e9532b9f48f74 100644
+--- a/crypto/asn1/tasn_dec.c
++++ b/crypto/asn1/tasn_dec.c
+@@ -54,7 +54,7 @@ static int asn1_d2i_ex_primitive(ASN1_VALUE **pval,
+     const ASN1_ITEM *it,
+     int tag, int aclass, char opt,
+     ASN1_TLC *ctx);
+-static int asn1_ex_c2i(ASN1_VALUE **pval, const unsigned char *cont, int len,
++static int asn1_ex_c2i(ASN1_VALUE **pval, const unsigned char *cont, long len,
+     int utype, char *free_cont, const ASN1_ITEM *it);
+ 
+ /* Table to convert tags to bit values, used for MSTRING type */
+@@ -855,19 +855,24 @@ static int asn1_d2i_ex_primitive(ASN1_VALUE **pval,
+ 
+ /* Translate ASN1 content octets into a structure */
+ 
+-static int asn1_ex_c2i(ASN1_VALUE **pval, const unsigned char *cont, int len,
++static int asn1_ex_c2i(ASN1_VALUE **pval, const unsigned char *cont, long len,
+     int utype, char *free_cont, const ASN1_ITEM *it)
+ {
+     ASN1_VALUE **opval = NULL;
+     ASN1_STRING *stmp;
+     ASN1_TYPE *typ = NULL;
+     int ret = 0;
++    int ilen = (int)len;
+     const ASN1_PRIMITIVE_FUNCS *pf;
+     ASN1_INTEGER **tint;
+     pf = it->funcs;
+ 
+-    if (pf && pf->prim_c2i)
+-        return pf->prim_c2i(pval, cont, len, utype, free_cont, it);
++    if (pf && pf->prim_c2i) {
++        if (len == (long)ilen)
++            return pf->prim_c2i(pval, cont, ilen, utype, free_cont, it);
++        ERR_raise(ERR_LIB_ASN1, ASN1_R_TOO_LONG);
++        return 0;
++    }
+     /* If ANY type clear type and set pointer to internal value */
+     if (it->utype == V_ASN1_ANY) {
+         if (*pval == NULL) {
+@@ -885,7 +890,8 @@ static int asn1_ex_c2i(ASN1_VALUE **pval, const unsigned char *cont, int len,
+     }
+     switch (utype) {
+     case V_ASN1_OBJECT:
+-        if (!ossl_c2i_ASN1_OBJECT((ASN1_OBJECT **)pval, &cont, len))
++        if (len != (long)ilen
++            || !ossl_c2i_ASN1_OBJECT((ASN1_OBJECT **)pval, &cont, ilen))
+             goto err;
+         break;
+ 
+@@ -940,6 +946,10 @@ static int asn1_ex_c2i(ASN1_VALUE **pval, const unsigned char *cont, int len,
+     case V_ASN1_SET:
+     case V_ASN1_SEQUENCE:
+     default:
++        if (len != (long)ilen) {
++            ERR_raise(ERR_LIB_ASN1, ASN1_R_TOO_LONG);
++            goto err;
++        }
+         if (utype == V_ASN1_BMPSTRING && (len & 1)) {
+             ERR_raise(ERR_LIB_ASN1, ASN1_R_BMPSTRING_IS_WRONG_LENGTH);
+             goto err;
+@@ -970,10 +980,10 @@ static int asn1_ex_c2i(ASN1_VALUE **pval, const unsigned char *cont, int len,
+         }
+         /* If we've already allocated a buffer use it */
+         if (*free_cont) {
+-            ASN1_STRING_set0(stmp, (unsigned char *)cont /* UGLY CAST! */, len);
++            ASN1_STRING_set0(stmp, (unsigned char *)cont /* UGLY CAST! */, ilen);
+             *free_cont = 0;
+         } else {
+-            if (!ASN1_STRING_set(stmp, cont, len)) {
++            if (!ASN1_STRING_set(stmp, cont, ilen)) {
+                 ERR_raise(ERR_LIB_ASN1, ERR_R_ASN1_LIB);
+                 ASN1_STRING_free(stmp);
+                 *pval = NULL;

upstream_patches/CVE-2026-34181.patch

@@ -0,0 +1,81 @@
+From: Alicja Kario <hkario@redhat.com>
+Date: Wed, 29 Apr 2026 16:29:35 +0200
+Subject: pkcs12: verify that the pbmac1 key length is safe
+
+Short mac keys (as short as 1 byte) can be used to probe the
+system under attack to accept a PKCS#12 file created by an attacker
+even if the attacker doesn't know the password used for MAC protection.
+
+Fixes CVE-2026-34181
+
+(also update the reference to the PBMAC1 PKCS#12 RFC)
+
+Signed-off-by: Alicja Kario <hkario@redhat.com>
+---
+ crypto/pkcs12/p12_mutl.c      |  8 +++++---
+ test/recipes/80-test_pkcs12.t | 13 ++++++++-----
+ 2 files changed, 13 insertions(+), 8 deletions(-)
+
+diff --git a/crypto/pkcs12/p12_mutl.c b/crypto/pkcs12/p12_mutl.c
+index 01956252df76..15072e12f26b 100644
+--- a/crypto/pkcs12/p12_mutl.c
++++ b/crypto/pkcs12/p12_mutl.c
+@@ -144,11 +144,13 @@ static int PBMAC1_PBKDF2_HMAC(OSSL_LIB_CTX *ctx, const char *propq,
+     }
+     pbkdf2_salt = pbkdf2_param->salt->value.octet_string;
+ 
+-    /* RFC 9579 specifies missing key length as invalid */
++    /* RFC 9879 specifies missing key length as invalid */
+     if (pbkdf2_param->keylength != NULL)
+         keylen = ASN1_INTEGER_get(pbkdf2_param->keylength);
+-    if (keylen <= 0 || keylen > EVP_MAX_MD_SIZE) {
+-        ERR_raise(ERR_LIB_PKCS12, PKCS12_R_PARSE_ERROR);
++    /* RFC 9879 specifies too short key length as untrustworthy too */
++    if (keylen < 20 || keylen > EVP_MAX_MD_SIZE) {
++        ERR_raise_data(ERR_LIB_PKCS12, PKCS12_R_PARSE_ERROR,
++            "Invalid Key length (%d is not in the range 20..64)", keylen);
+         goto err;
+     }
+ 
+diff --git a/test/recipes/80-test_pkcs12.t b/test/recipes/80-test_pkcs12.t
+index d258b7eb0e47..56ab93803e7a 100644
+--- a/test/recipes/80-test_pkcs12.t
++++ b/test/recipes/80-test_pkcs12.t
+@@ -56,7 +56,7 @@ $ENV{OPENSSL_WIN32_UTF8}=1;
+ 
+ my $no_fips = disabled('fips') || ($ENV{NO_FIPS} // 0);
+ 
+-plan tests => $no_fips ? 53 : 59;
++plan tests => $no_fips ? 55 : 61;
+ 
+ # Test different PKCS#12 formats
+ ok(run(test(["pkcs12_format_test"])), "test pkcs12 formats");
+@@ -205,8 +205,11 @@ for my $instance (sort keys %pbmac1_tests) {
+     }
+ }
+ 
+-# Test pbmac1 pkcs12 good files, RFC 9579
+-for my $file ("pbmac1_256_256.good.p12", "pbmac1_512_256.good.p12", "pbmac1_512_512.good.p12")
++# Test pbmac1 pkcs12 good files, RFC 9579, and one extra with shorter key
++# length
++for my $file ("pbmac1_256_256.good.p12", "pbmac1_512_256.good.p12",
++              "pbmac1_512_512.good.p12",
++              "pbmac1_256_256.good-shorter-key-len.p12")
+ {
+     my $path = srctop_file("test", "recipes", "80-test_pkcs12_data", $file);
+     ok(run(app(["openssl", "pkcs12", "-in", $path, "-password", "pass:1234", "-noenc"])),
+@@ -235,12 +238,12 @@ unless ($no_fips) {
+     }
+ }
+ 
+-# Test pbmac1 pkcs12 bad files, RFC 9579 and CVE-2025-11187
++# Test pbmac1 pkcs12 bad files, RFC 9579, CVE-2025-11187 and CVE-2026-34181
+ for my $file ("pbmac1_256_256.bad-iter.p12", "pbmac1_256_256.bad-salt.p12",
+               "pbmac1_256_256.no-len.p12", "pbmac1_256_256.bad-len.p12",
+               "pbmac1_256_256.bad-salt-type.p12", "pbmac1_256_256.negative-len.p12",
+               "pbmac1_256_256.no-salt.p12", "pbmac1_256_256.very-big-len.p12",
+-              "pbmac1_256_256.zero-len.p12")
++              "pbmac1_256_256.zero-len.p12", "pbmac1_256_256.bad-key-len.p12")
+ {
+     my $path = srctop_file("test", "recipes", "80-test_pkcs12_data", $file);
+     with({ exit_checker => sub { return shift == 1; } },

upstream_patches/CVE-2026-34182.patch

@@ -0,0 +1,50 @@
+From: Neil Horman <nhorman@openssl.org>
+Date: Fri, 17 Apr 2026 13:21:50 -0400
+Subject: Reject potentially forged encrypted CMS AuthEnvelopedData messages
+
+1. Adjust ossl_cms_EncryptedContent_init_bio to not accept non-AEAD
+ciphers.
+
+If a forged CMS message with AuthEnvelopedData is received with
+a non-AEAD cipher specified, we silently accept that and decrypt
+the message, skipping any authentication, which violates RFC 5083.
+
+We also add checks to ensure we fail if we try to encrypt
+AuthEnvelopedData without using an AEAD cipher.
+
+2. Ensure that tag lengths on cms AEAD data is the recommended size.
+
+RFC 5084 recommends that mac tags be at least 12 bytes for AES-GCM
+and 4 bytes for AES-CCM on AuthEnvelopedData. As this code is not
+algorith-specific we add a check for a minimal size and just use the
+lower limit which is sufficient to prevent this attack.
+
+Without this check, its possible to set the tag length to 1 and within
+256 guesses, forge a CMS message.
+
+Fixes CVE-2026-34182
+---
+diff --git a/crypto/cms/cms_enc.c b/crypto/cms/cms_enc.c
+index 08afb5ab11..ba7082cebd 100644
+--- a/crypto/cms/cms_enc.c
++++ b/crypto/cms/cms_enc.c
+@@ -109,13 +109,15 @@ BIO *ossl_cms_EncryptedContent_init_bio(CMS_EncryptedContentInfo *ec,
+                 goto err;
+             }
+             piv = aparams.iv;
+-            if (ec->taglen > 0
+-                && EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_SET_TAG,
+-                       ec->taglen, ec->tag)
+-                    <= 0) {
++
++            if (ec->taglen < 4 || ec->taglen > 16
++                || EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_SET_TAG, (int)ec->taglen, ec->tag) <= 0) {
+                 ERR_raise(ERR_LIB_CMS, CMS_R_CIPHER_AEAD_SET_TAG_ERROR);
+                 goto err;
+             }
++        } else if (auth) {
++            ERR_raise(ERR_LIB_CMS, CMS_R_UNSUPPORTED_CONTENT_ENCRYPTION_ALGORITHM);
++            goto err;
+         }
+     }
+     len = EVP_CIPHER_CTX_get_key_length(ctx);