Backport CVE fixes and latest changes to FIPS, update suffix

Author: Akendo

prepare_source

@@ -3,7 +3,7 @@ version="$version_orig-1"
 git_src --branch "debian/openssl-$version" "https://salsa.debian.org/debian/openssl.git"
 
 import_upstream_patches
-version_suffix="gl46~bp1877"
+version_suffix="gl51~bp1877"
 fips_version_suffix=$(echo "${version_suffix}" | cut -d~ -f1)
 sed "s/SED_MARKER_FOR_FIPS_VERSION/$fips_version_suffix/" <patches-debian/rules.patch.tpl > patches-debian/rules.patch
 apply_patches patches-debian

upstream_patches/0047-FIPS-RSA-no-padding-decrypt-indicator.patch

@@ -0,0 +1,51 @@
+From ba4c73c0665a7cb40e1dbab64f778edaa4c19bfd Mon Sep 17 00:00:00 2001
+From: nkraetzschmar <9020053+nkraetzschmar@users.noreply.github.com>
+Date: Mon, 29 Jun 2026 12:12:09 +0000
+Subject: [PATCH] providers: flag RSA decrypt with no padding as unapproved
+
+FIPS 140-3 IG 2.4.B treats raw RSA primitives as component algorithms
+that must not be used standalone. Patch 0032 already gates the encrypt
+path against pad_mode == RSA_NO_PADDING; mirror that behaviour in
+rsa_decrypt() so a decrypt call with no padding goes through
+OSSL_FIPS_IND_ON_UNAPPROVED and reuses the existing
+rsa_no_padding_disabled config flag.
+---
+ providers/fips/self_test_kats.c                 | 2 +-
+ providers/implementations/asymciphers/rsa_enc.c | 8 ++++++++
+ 2 files changed, 9 insertions(+), 1 deletion(-)
+
+diff --git a/providers/fips/self_test_kats.c b/providers/fips/self_test_kats.c
+index e17cd2cd8e..e96aba1613 100644
+--- a/providers/fips/self_test_kats.c
++++ b/providers/fips/self_test_kats.c
+@@ -880,7 +880,7 @@ static int self_test_asym_cipher(const ST_KAT_ASYM_CIPHER *t, OSSL_SELF_TEST *st
+ 
+     OSSL_SELF_TEST_onbegin(st, OSSL_SELF_TEST_TYPE_KAT_ASYM_CIPHER, t->desc);
+ 
+-    if (t->encrypt && strcmp(t->algorithm, "RSA") == 0)
++    if (strcmp(t->algorithm, "RSA") == 0)
+         extra_postinit_params = rsa_encrypt_fips_params;
+ 
+     bnctx = BN_CTX_new_ex(libctx);
+diff --git a/providers/implementations/asymciphers/rsa_enc.c b/providers/implementations/asymciphers/rsa_enc.c
+index 330fc71f7b..fa5181c99e 100644
+--- a/providers/implementations/asymciphers/rsa_enc.c
++++ b/providers/implementations/asymciphers/rsa_enc.c
+@@ -259,6 +259,14 @@ static int rsa_decrypt(void *vprsactx, unsigned char *out, size_t *outlen,
+         ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_PADDING_MODE);
+         return 0;
+     }
++    if (prsactx->pad_mode == RSA_NO_PADDING
++        && !OSSL_FIPS_IND_ON_UNAPPROVED(prsactx, OSSL_FIPS_IND_SETTABLE2,
++            prsactx->libctx, "RSA Decrypt",
++            "No padding",
++            ossl_fips_config_rsa_no_padding_disabled)) {
++        ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_PADDING_MODE);
++        return 0;
++    }
+ #endif
+ 
+     if (prsactx->pad_mode == RSA_PKCS1_WITH_TLS_PADDING) {
+-- 
+2.47.3
+

upstream_patches/0048-FIPS-ECDSA-sign-component-indicator.patch

@@ -0,0 +1,63 @@
+From 4dbdc399da1c996d6aaaa85cf6d40ea91ca81695 Mon Sep 17 00:00:00 2001
+From: nkraetzschmar <9020053+nkraetzschmar@users.noreply.github.com>
+Date: Mon, 29 Jun 2026 12:51:47 +0000
+Subject: [PATCH] providers: flag ECDSA standalone-component signing as
+ unapproved
+
+FIPS 140-3 IG 2.4.B treats raw asymmetric primitives as component
+algorithms that may only be claimed as approved in the context of a
+higher-level approved operation. Patch 0034 already gates ECDSA verify
+with verify_message == 0; mirror that on the sign side by gating
+ecdsa_sign_directly() when operation == EVP_PKEY_OP_SIGN (i.e.
+EVP_PKEY_sign() rather than EVP_PKEY_sign_message()) through
+OSSL_FIPS_IND_ON_UNAPPROVED, behind a new
+ecdsa_sign_component_disallowed config flag.
+---
+ providers/fips/include/fips_indicator_params.inc | 1 +
+ providers/implementations/signature/ecdsa_sig.c  | 8 ++++++++
+ util/perl/OpenSSL/paramnames.pm                  | 1 +
+ 3 files changed, 10 insertions(+)
+
+diff --git a/providers/fips/include/fips_indicator_params.inc b/providers/fips/include/fips_indicator_params.inc
+index 6e2a2dc845..45cd3463bc 100644
+--- a/providers/fips/include/fips_indicator_params.inc
++++ b/providers/fips/include/fips_indicator_params.inc
+@@ -38,3 +38,4 @@ OSSL_FIPS_PARAM(slh_dsa_sign_entropy_check, SLH_DSA_SIGN_ENTROPY_CHECK, 1)
+ OSSL_FIPS_PARAM(slh_dsa_seed_check, SLH_DSA_SEED_CHECK, 1)
+ OSSL_FIPS_PARAM(rsa_verify_min_modulus_disallowed, RSA_VERIFY_MIN_MODULUS_DISABLED, 1)
+ OSSL_FIPS_PARAM(ecdsa_p192_verify_disallowed, ECDSA_P192_VERIFY_DISABLED, 1)
++OSSL_FIPS_PARAM(ecdsa_sign_component_disallowed, ECDSA_SIGN_COMPONENT_DISABLED, 1)
+diff --git a/providers/implementations/signature/ecdsa_sig.c b/providers/implementations/signature/ecdsa_sig.c
+index 08f8ee828e..25709b6fa0 100644
+--- a/providers/implementations/signature/ecdsa_sig.c
++++ b/providers/implementations/signature/ecdsa_sig.c
+@@ -331,6 +331,14 @@ static int ecdsa_sign_directly(void *vctx,
+     if (!ossl_prov_is_running())
+         return 0;
+ 
++#ifdef FIPS_MODULE
++    if (ctx->operation == EVP_PKEY_OP_SIGN
++        && !OSSL_FIPS_IND_ON_UNAPPROVED(ctx, OSSL_FIPS_IND_SETTABLE4,
++            ctx->libctx, "ECDSA Sign", "Component signing",
++            ossl_fips_config_ecdsa_sign_component_disallowed))
++        return 0;
++#endif
++
+     if (sig == NULL) {
+         *siglen = ecsize;
+         return 1;
+diff --git a/util/perl/OpenSSL/paramnames.pm b/util/perl/OpenSSL/paramnames.pm
+index 7f3859aa90..cf3b28b09a 100644
+--- a/util/perl/OpenSSL/paramnames.pm
++++ b/util/perl/OpenSSL/paramnames.pm
+@@ -54,6 +54,7 @@ my %params = (
+     'PROV_PARAM_RSA_NO_PAD_DISABLED' => "rsa-no-pad-disabled", # uint
+     'PROV_PARAM_RSA_VERIFY_MIN_MODULUS_DISABLED' => "rsa-verify-min-modulus-disabled", # uint
+     'PROV_PARAM_ECDSA_P192_VERIFY_DISABLED' => "ecdsa-p192-verify-disabled", # uint
++    'PROV_PARAM_ECDSA_SIGN_COMPONENT_DISABLED' => "ecdsa-sign-component-disabled", # uint
+     'PROV_PARAM_HKDF_KEY_CHECK' =>         "hkdf-key-check",         # uint
+     'PROV_PARAM_KBKDF_KEY_CHECK' =>        "kbkdf-key-check",        # uint
+     'PROV_PARAM_TLS13_KDF_KEY_CHECK' =>    "tls13-kdf-key-check",    # uint
+-- 
+2.47.3
+

upstream_patches/0049-FIPS-RSA-no-padding-verify-indicator.patch

@@ -0,0 +1,37 @@
+From f2b2545d228c209994d6cacd00e6844722b18ab7 Mon Sep 17 00:00:00 2001
+From: nkraetzschmar <9020053+nkraetzschmar@users.noreply.github.com>
+Date: Mon, 29 Jun 2026 13:12:06 +0000
+Subject: [PATCH] providers: flag RSA verify with no padding as unapproved
+
+FIPS 140-3 IG 2.4.B does not list the RSA signature verification
+primitive among the components that may be validated; running
+EVP_PKEY_verify() against a raw RSA modular exponentiation with
+RSA_NO_PADDING therefore must not be reported as an approved service.
+Patch 0039 already gates the equivalent sign-side path; add the
+matching hook in rsa_verify_directly() reusing the existing
+rsa_no_padding_disabled config flag.
+---
+ providers/implementations/signature/rsa_sig.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/providers/implementations/signature/rsa_sig.c b/providers/implementations/signature/rsa_sig.c
+index a6b7123709..cfe2a2381c 100644
+--- a/providers/implementations/signature/rsa_sig.c
++++ b/providers/implementations/signature/rsa_sig.c
+@@ -1074,6 +1074,13 @@ static int rsa_verify_directly(PROV_RSA_CTX *prsactx,
+         ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_KEY_LENGTH);
+         return 0;
+     }
++    if (prsactx->pad_mode == RSA_NO_PADDING
++        && !OSSL_FIPS_IND_ON_UNAPPROVED(prsactx, OSSL_FIPS_IND_SETTABLE7,
++            prsactx->libctx, "RSA Verify", "No padding",
++            ossl_fips_config_rsa_no_padding_disabled)) {
++        ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_PADDING_MODE);
++        return 0;
++    }
+ #endif
+ 
+     if (prsactx->md != NULL) {
+-- 
+2.47.3
+

upstream_patches/0050-disable-hybrid-MLKEM-keygen-and-check.patch

@@ -0,0 +1,43 @@
+From 5c7d0f954e55c04c1f7ae22d6219e02b69b6e06b Mon Sep 17 00:00:00 2001
+From: nkraetzschmar <9020053+nkraetzschmar@users.noreply.github.com>
+Date: Mon, 29 Jun 2026 15:15:56 +0000
+Subject: [PATCH] providers: flag hybrid ML-KEM keygen and check as unapproved
+
+Patch 0046 marked the X25519MLKEM768, X448MLKEM1024, SecP256r1MLKEM768
+and SecP384r1MLKEM1024 hybrid schemes as unapproved in the FIPS
+provider's KEM dispatch table, which makes encapsulation and
+decapsulation report non-approved. The keymgmt dispatch table for the
+same schemes was left at FIPS_DEFAULT_PROPERTIES, so EVP_PKEY_keygen
+and EVP_PKEY_check still report approved. Flip those four entries to
+FIPS_UNAPPROVED_PROPERTIES as well.
+---
+ providers/fips/fipsprov.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/providers/fips/fipsprov.c b/providers/fips/fipsprov.c
+index 54de206b17..c03f240219 100644
+--- a/providers/fips/fipsprov.c
++++ b/providers/fips/fipsprov.c
+@@ -623,15 +623,15 @@ static const OSSL_ALGORITHM fips_keymgmt[] = {
+     { PROV_NAMES_ML_KEM_1024, FIPS_DEFAULT_PROPERTIES, ossl_ml_kem_1024_keymgmt_functions,
+         PROV_DESCS_ML_KEM_1024 },
+ #if !defined(OPENSSL_NO_ECX)
+-    { PROV_NAMES_X25519MLKEM768, FIPS_DEFAULT_PROPERTIES, ossl_mlx_x25519_kem_kmgmt_functions,
++    { PROV_NAMES_X25519MLKEM768, FIPS_UNAPPROVED_PROPERTIES, ossl_mlx_x25519_kem_kmgmt_functions,
+         PROV_DESCS_X25519MLKEM768 },
+-    { PROV_NAMES_X448MLKEM1024, FIPS_DEFAULT_PROPERTIES, ossl_mlx_x448_kem_kmgmt_functions,
++    { PROV_NAMES_X448MLKEM1024, FIPS_UNAPPROVED_PROPERTIES, ossl_mlx_x448_kem_kmgmt_functions,
+         PROV_DESCS_X448MLKEM1024 },
+ #endif
+ #if !defined(OPENSSL_NO_EC)
+-    { PROV_NAMES_SecP256r1MLKEM768, FIPS_DEFAULT_PROPERTIES, ossl_mlx_p256_kem_kmgmt_functions,
++    { PROV_NAMES_SecP256r1MLKEM768, FIPS_UNAPPROVED_PROPERTIES, ossl_mlx_p256_kem_kmgmt_functions,
+         PROV_DESCS_SecP256r1MLKEM768 },
+-    { PROV_NAMES_SecP384r1MLKEM1024, FIPS_DEFAULT_PROPERTIES, ossl_mlx_p384_kem_kmgmt_functions,
++    { PROV_NAMES_SecP384r1MLKEM1024, FIPS_UNAPPROVED_PROPERTIES, ossl_mlx_p384_kem_kmgmt_functions,
+         PROV_DESCS_SecP384r1MLKEM1024 },
+ #endif
+ #endif
+-- 
+2.47.3
+

upstream_patches/00xx-disable-sha1.patch

@@ -0,0 +1,77 @@
+:100644 100644 b3b95ed76b 0000000000 M	test/recipes/30-test_evp_data/evpmd_sha.txt
+
+diff --git a/test/recipes/30-test_evp_data/evpmd_sha.txt b/test/recipes/30-test_evp_data/evpmd_sha.txt
+index b3b95ed76b..b3d4da9411 100644
+--- a/test/recipes/30-test_evp_data/evpmd_sha.txt
++++ b/test/recipes/30-test_evp_data/evpmd_sha.txt
+@@ -14,17 +14,17 @@
+ 
+-Title = SHA tests from (RFC6234 section 8.5 and others)
+-
+-Digest = SHA1
+-Input = "abc"
+-Output = a9993e364706816aba3e25717850c26c9cd0d89d
+-
+-Digest = SHA1
+-Input = "abcdbcdecdefdefgefghfghighijhijkijkljklmklmnlmnomnopnopq"
+-Output = 84983e441c3bd26ebaae4aa1f95129e5e54670f1
+-
+-Digest = SHA1
+-Input = "a"
+-Ncopy = 1000
+-Count = 1000
+-Output = 34aa973cd4c4daa4f61eeb2bdbad27316534016f
++#Title = SHA tests from (RFC6234 section 8.5 and others)
++#
++#Digest = SHA1
++#Input = "abc"
++#Output = a9993e364706816aba3e25717850c26c9cd0d89d
++#
++#Digest = SHA1
++#Input = "abcdbcdecdefdefgefghfghighijhijkijkljklmklmnlmnomnopnopq"
++#Output = 84983e441c3bd26ebaae4aa1f95129e5e54670f1
++#
++#Digest = SHA1
++#Input = "a"
++#Ncopy = 1000
++#Count = 1000
++#Output = 34aa973cd4c4daa4f61eeb2bdbad27316534016f
+ 
+:100644 100644 d14005a89a 0000000000 M	doc/man7/OSSL_PROVIDER-FIPS.pod
+
+diff --git a/doc/man7/OSSL_PROVIDER-FIPS.pod b/doc/man7/OSSL_PROVIDER-FIPS.pod
+index d14005a89a..688b1b464d 100644
+--- a/doc/man7/OSSL_PROVIDER-FIPS.pod
++++ b/doc/man7/OSSL_PROVIDER-FIPS.pod
+@@ -429,4 +429,2 @@ Symmetric cipher tests used with the "KAT_Cipher" type.
+ 
+-=item "SHA1" (B<OSSL_SELF_TEST_DESC_MD_SHA1>)
+-
+ =item "SHA2" (B<OSSL_SELF_TEST_DESC_MD_SHA2>)
+:100644 100644 de736794a9 0000000000 M	include/openssl/self_test.h
+
+diff --git a/include/openssl/self_test.h b/include/openssl/self_test.h
+index de736794a9..4161985b4b 100644
+--- a/include/openssl/self_test.h
++++ b/include/openssl/self_test.h
+@@ -63,3 +63,2 @@ extern "C" {
+ #define OSSL_SELF_TEST_DESC_ASYM_RSA_DEC "RSA_Decrypt"
+-#define OSSL_SELF_TEST_DESC_MD_SHA1 "SHA1"
+ #define OSSL_SELF_TEST_DESC_MD_SHA2 "SHA2"
+:100644 100644 6abab0a7a1 0000000000 M	providers/fips/self_test_data.inc
+
+:100644 100644 6abab0a7a1 0000000000 M	providers/fips/self_test_data.inc
+
+diff --git a/providers/fips/self_test_data.inc b/providers/fips/self_test_data.inc
+index 6abab0a7a1..14a3a0e2b9 100644
+--- a/providers/fips/self_test_data.inc
++++ b/providers/fips/self_test_data.inc
+@@ -200,8 +200,2 @@ static const ST_KAT_DIGEST st_kat_digest_tests[] =
+ {
+-    {
+-         OSSL_SELF_TEST_DESC_MD_SHA1,
+-         "SHA1",
+-         ITM_STR(sha1_pt),
+-         ITM(sha1_digest),
+-    },
+     {