diff --git a/Feature-support-SM2-CMS-signature.patch b/Feature-support-SM2-CMS-signature.patch index b579537c0f8c026696d863ae94bf8152c24ce1d4..5c87cc78c9f8737e08b9bb1c0fdffa77912246cf 100644 --- a/Feature-support-SM2-CMS-signature.patch +++ b/Feature-support-SM2-CMS-signature.patch @@ -10,7 +10,7 @@ Signed-off-by: Huaxin Lu 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/crypto/cms/cms_sd.c b/crypto/cms/cms_sd.c -index 34c021b..093b41c 100644 +index 2093657..083edd2 100644 --- a/crypto/cms/cms_sd.c +++ b/crypto/cms/cms_sd.c @@ -232,7 +232,7 @@ static int cms_sd_asn1_ctrl(CMS_SignerInfo *si, int cmd) @@ -19,9 +19,9 @@ index 34c021b..093b41c 100644 - if (EVP_PKEY_is_a(pkey, "DSA") || EVP_PKEY_is_a(pkey, "EC")) + if (EVP_PKEY_is_a(pkey, "DSA") || EVP_PKEY_is_a(pkey, "EC") || EVP_PKEY_is_a(pkey, "SM2")) - return ossl_cms_ecdsa_dsa_sign(si, cmd); + return ossl_cms_ecdsa_dsa_sign(si, cmd) > 0; else if (EVP_PKEY_is_a(pkey, "RSA") || EVP_PKEY_is_a(pkey, "RSA-PSS")) - return ossl_cms_rsa_sign(si, cmd); + return ossl_cms_rsa_sign(si, cmd) > 0; diff --git a/crypto/evp/p_lib.c b/crypto/evp/p_lib.c index f6acb5b..9567bb0 100644 --- a/crypto/evp/p_lib.c diff --git a/backport-A-null-pointer-dereference-occurs-when-memory-alloca.patch b/backport-A-null-pointer-dereference-occurs-when-memory-alloca.patch deleted file mode 100644 index afd87baea87f23507507763391a05655e159f6d8..0000000000000000000000000000000000000000 --- a/backport-A-null-pointer-dereference-occurs-when-memory-alloca.patch +++ /dev/null @@ -1,36 +0,0 @@ -From a8da305fa3dd6e34ba5aab3978281f652fd12883 Mon Sep 17 00:00:00 2001 -From: yangyangtiantianlonglong -Date: Mon, 31 Jul 2023 07:04:41 -0700 -Subject: [PATCH] A null pointer dereference occurs when memory allocation - fails - -Fixes #21605 - -Reviewed-by: Hugo Landau -Reviewed-by: Matthias St. Pierre -Reviewed-by: Paul Dale -(Merged from https://github.com/openssl/openssl/pull/21606) ---- - ssl/ssl_sess.c | 5 ++++- - 1 file changed, 4 insertions(+), 1 deletion(-) - -diff --git a/ssl/ssl_sess.c b/ssl/ssl_sess.c -index cda6b7cc5b..2a5d21be79 100644 ---- a/ssl/ssl_sess.c -+++ b/ssl/ssl_sess.c -@@ -139,8 +139,11 @@ SSL_SESSION *ssl_session_dup(SSL_SESSION *src, int ticket) - dest->references = 1; - - dest->lock = CRYPTO_THREAD_lock_new(); -- if (dest->lock == NULL) -+ if (dest->lock == NULL) { -+ OPENSSL_free(dest); -+ dest = NULL; - goto err; -+ } - - if (!CRYPTO_new_ex_data(CRYPTO_EX_INDEX_SSL_SESSION, dest, &dest->ex_data)) - goto err; --- -2.27.0 - diff --git a/backport-Add-a-test-for-CVE-2023-3446.patch b/backport-Add-a-test-for-CVE-2023-3446.patch deleted file mode 100644 index 6c5f7342d2cbe819c6e3fa27bd5ed44827349652..0000000000000000000000000000000000000000 --- a/backport-Add-a-test-for-CVE-2023-3446.patch +++ /dev/null @@ -1,63 +0,0 @@ -From 8a62fd996cb1c22383ec75b4155d54dec4a1b0ee Mon Sep 17 00:00:00 2001 -From: Matt Caswell -Date: Fri, 7 Jul 2023 14:39:48 +0100 -Subject: [PATCH] Add a test for CVE-2023-3446 - -Confirm that the only errors DH_check() finds with DH parameters with an -excessively long modulus is that the modulus is too large. We should not -be performing time consuming checks using that modulus. - -Reviewed-by: Paul Dale -Reviewed-by: Tom Cosgrove -Reviewed-by: Bernd Edlinger -Reviewed-by: Tomas Mraz -(Merged from https://github.com/openssl/openssl/pull/21451) - -(cherry picked from commit ede782b4c8868d1f09c9cd237f82b6f35b7dba8b) ---- - test/dhtest.c | 15 +++++++++++++-- - 1 file changed, 13 insertions(+), 2 deletions(-) - -diff --git a/test/dhtest.c b/test/dhtest.c -index 7b587f3cfa..f8dd8f3aa7 100644 ---- a/test/dhtest.c -+++ b/test/dhtest.c -@@ -73,7 +73,7 @@ static int dh_test(void) - goto err1; - - /* check fails, because p is way too small */ -- if (!DH_check(dh, &i)) -+ if (!TEST_true(DH_check(dh, &i))) - goto err2; - i ^= DH_MODULUS_TOO_SMALL; - if (!TEST_false(i & DH_CHECK_P_NOT_PRIME) -@@ -124,6 +124,17 @@ static int dh_test(void) - /* We'll have a stale error on the queue from the above test so clear it */ - ERR_clear_error(); - -+ /* Modulus of size: dh check max modulus bits + 1 */ -+ if (!TEST_true(BN_set_word(p, 1)) -+ || !TEST_true(BN_lshift(p, p, OPENSSL_DH_CHECK_MAX_MODULUS_BITS))) -+ goto err3; -+ -+ /* -+ * We expect no checks at all for an excessively large modulus -+ */ -+ if (!TEST_false(DH_check(dh, &i))) -+ goto err3; -+ - /* - * II) key generation - */ -@@ -138,7 +149,7 @@ static int dh_test(void) - goto err3; - - /* ... and check whether it is valid */ -- if (!DH_check(a, &i)) -+ if (!TEST_true(DH_check(a, &i))) - goto err3; - if (!TEST_false(i & DH_CHECK_P_NOT_PRIME) - || !TEST_false(i & DH_CHECK_P_NOT_SAFE_PRIME) --- -2.27.0 - diff --git a/backport-Add-testcases-for-empty-associated-data-entries-with.patch b/backport-Add-testcases-for-empty-associated-data-entries-with.patch deleted file mode 100644 index 74126e7e23bd94d08e478e581af2a65ee9f68868..0000000000000000000000000000000000000000 --- a/backport-Add-testcases-for-empty-associated-data-entries-with.patch +++ /dev/null @@ -1,66 +0,0 @@ -From 96318a8d21bed334d78797eca5b32790775d5f05 Mon Sep 17 00:00:00 2001 -From: Tomas Mraz -Date: Tue, 4 Jul 2023 17:50:37 +0200 -Subject: [PATCH] Add testcases for empty associated data entries with AES-SIV - -Reviewed-by: Matt Caswell -Reviewed-by: Paul Dale -(Merged from https://github.com/openssl/openssl/pull/21384) - -(cherry picked from commit 3993bb0c0c87e3ed0ab4274e4688aa814e164cfc) ---- - .../30-test_evp_data/evpciph_aes_siv.txt | 31 +++++++++++++++++++ - 1 file changed, 31 insertions(+) - -diff --git a/test/recipes/30-test_evp_data/evpciph_aes_siv.txt b/test/recipes/30-test_evp_data/evpciph_aes_siv.txt -index a78a49158d..e434f13f41 100644 ---- a/test/recipes/30-test_evp_data/evpciph_aes_siv.txt -+++ b/test/recipes/30-test_evp_data/evpciph_aes_siv.txt -@@ -20,6 +20,19 @@ Tag = 85632d07c6e8f37f950acd320a2ecc93 - Plaintext = 112233445566778899aabbccddee - Ciphertext = 40c02b9690c4dc04daef7f6afe5c - -+Cipher = aes-128-siv -+Key = fffefdfcfbfaf9f8f7f6f5f4f3f2f1f0f0f1f2f3f4f5f6f7f8f9fafbfcfdfeff -+Tag = f1c5fdeac1f15a26779c1501f9fb7588 -+Plaintext = 112233445566778899aabbccddee -+Ciphertext = 27e946c669088ab06da58c5c831c -+ -+Cipher = aes-128-siv -+Key = fffefdfcfbfaf9f8f7f6f5f4f3f2f1f0f0f1f2f3f4f5f6f7f8f9fafbfcfdfeff -+AAD = -+Tag = d1022f5b3664e5a4dfaf90f85be6f28a -+Plaintext = 112233445566778899aabbccddee -+Ciphertext = b66cff6b8eca0b79f083b39a0901 -+ - Cipher = aes-128-siv - Key = 7f7e7d7c7b7a79787776757473727170404142434445464748494a4b4c4d4e4f - AAD = 00112233445566778899aabbccddeeffdeaddadadeaddadaffeeddccbbaa99887766554433221100 -@@ -29,6 +42,24 @@ Tag = 7bdb6e3b432667eb06f4d14bff2fbd0f - Plaintext = 7468697320697320736f6d6520706c61696e7465787420746f20656e6372797074207573696e67205349562d414553 - Ciphertext = cb900f2fddbe404326601965c889bf17dba77ceb094fa663b7a3f748ba8af829ea64ad544a272e9c485b62a3fd5c0d - -+Cipher = aes-128-siv -+Key = 7f7e7d7c7b7a79787776757473727170404142434445464748494a4b4c4d4e4f -+AAD = 00112233445566778899aabbccddeeffdeaddadadeaddadaffeeddccbbaa99887766554433221100 -+AAD = -+AAD = 09f911029d74e35bd84156c5635688c0 -+Tag = 83ce6593a8fa67eb6fcd2819cedfc011 -+Plaintext = 7468697320697320736f6d6520706c61696e7465787420746f20656e6372797074207573696e67205349562d414553 -+Ciphertext = 30d937b42f71f71f93fc2d8d702d3eac8dc7651eefcd81120081ff29d626f97f3de17f2969b691c91b69b652bf3a6d -+ -+Cipher = aes-128-siv -+Key = 7f7e7d7c7b7a79787776757473727170404142434445464748494a4b4c4d4e4f -+AAD = -+AAD = 00112233445566778899aabbccddeeffdeaddadadeaddadaffeeddccbbaa99887766554433221100 -+AAD = 09f911029d74e35bd84156c5635688c0 -+Tag = 77dd4a44f5a6b41302121ee7f378de25 -+Plaintext = 7468697320697320736f6d6520706c61696e7465787420746f20656e6372797074207573696e67205349562d414553 -+Ciphertext = 0fcd664c922464c88939d71fad7aefb864e501b0848a07d39201c1067a7288f3dadf0131a823a0bc3d588e8564a5fe -+ - Cipher = aes-192-siv - Key = fffefdfcfbfaf9f8f7f6f5f4f3f2f1f0f0f1f2f3f4f5f6f7f8f9fafbfcfdfefffffefdfcfbfaf9f8f7f6f5f4f3f2f1f0 - AAD = 101112131415161718191a1b1c1d1e1f2021222324252627 --- -2.27.0 - diff --git a/backport-Do-not-ignore-empty-associated-data-with-AES-SIV-mod.patch b/backport-Do-not-ignore-empty-associated-data-with-AES-SIV-mod.patch deleted file mode 100644 index 98b1a0b648ba4874dcd95dfc05510de89a02d605..0000000000000000000000000000000000000000 --- a/backport-Do-not-ignore-empty-associated-data-with-AES-SIV-mod.patch +++ /dev/null @@ -1,57 +0,0 @@ -From 00e2f5eea29994d19293ec4e8c8775ba73678598 Mon Sep 17 00:00:00 2001 -From: Tomas Mraz -Date: Tue, 4 Jul 2023 17:30:35 +0200 -Subject: [PATCH] Do not ignore empty associated data with AES-SIV mode - -The AES-SIV mode allows for multiple associated data items -authenticated separately with any of these being 0 length. - -The provided implementation ignores such empty associated data -which is incorrect in regards to the RFC 5297 and is also -a security issue because such empty associated data then become -unauthenticated if an application expects to authenticate them. - -Fixes CVE-2023-2975 - -Reviewed-by: Matt Caswell -Reviewed-by: Paul Dale -(Merged from https://github.com/openssl/openssl/pull/21384) - -(cherry picked from commit c426c281cfc23ab182f7d7d7a35229e7db1494d9) ---- - .../implementations/ciphers/cipher_aes_siv.c | 18 +++++++++++------- - 1 file changed, 11 insertions(+), 7 deletions(-) - -diff --git a/providers/implementations/ciphers/cipher_aes_siv.c b/providers/implementations/ciphers/cipher_aes_siv.c -index 45010b90db..b396c8651a 100644 ---- a/providers/implementations/ciphers/cipher_aes_siv.c -+++ b/providers/implementations/ciphers/cipher_aes_siv.c -@@ -120,14 +120,18 @@ static int siv_cipher(void *vctx, unsigned char *out, size_t *outl, - if (!ossl_prov_is_running()) - return 0; - -- if (inl == 0) { -- *outl = 0; -- return 1; -- } -+ /* Ignore just empty encryption/decryption call and not AAD. */ -+ if (out != NULL) { -+ if (inl == 0) { -+ if (outl != NULL) -+ *outl = 0; -+ return 1; -+ } - -- if (outsize < inl) { -- ERR_raise(ERR_LIB_PROV, PROV_R_OUTPUT_BUFFER_TOO_SMALL); -- return 0; -+ if (outsize < inl) { -+ ERR_raise(ERR_LIB_PROV, PROV_R_OUTPUT_BUFFER_TOO_SMALL); -+ return 0; -+ } - } - - if (ctx->hw->cipher(ctx, out, in, inl) <= 0) --- -2.27.0 - diff --git a/backport-Fix-DH_check-excessive-time-with-over-sized-modulus.patch b/backport-Fix-DH_check-excessive-time-with-over-sized-modulus.patch deleted file mode 100644 index 53ddf3bf74cbdea5742fa0589040b8006c896d98..0000000000000000000000000000000000000000 --- a/backport-Fix-DH_check-excessive-time-with-over-sized-modulus.patch +++ /dev/null @@ -1,74 +0,0 @@ -From 1fa20cf2f506113c761777127a38bce5068740eb Mon Sep 17 00:00:00 2001 -From: Matt Caswell -Date: Thu, 6 Jul 2023 16:36:35 +0100 -Subject: [PATCH] Fix DH_check() excessive time with over sized modulus - -The DH_check() function checks numerous aspects of the key or parameters -that have been supplied. Some of those checks use the supplied modulus -value even if it is excessively large. - -There is already a maximum DH modulus size (10,000 bits) over which -OpenSSL will not generate or derive keys. DH_check() will however still -perform various tests for validity on such a large modulus. We introduce a -new maximum (32,768) over which DH_check() will just fail. - -An application that calls DH_check() and supplies a key or parameters -obtained from an untrusted source could be vulnerable to a Denial of -Service attack. - -The function DH_check() is itself called by a number of other OpenSSL -functions. An application calling any of those other functions may -similarly be affected. The other functions affected by this are -DH_check_ex() and EVP_PKEY_param_check(). - -CVE-2023-3446 - -Reviewed-by: Paul Dale -Reviewed-by: Tom Cosgrove -Reviewed-by: Bernd Edlinger -Reviewed-by: Tomas Mraz -(Merged from https://github.com/openssl/openssl/pull/21451) - -(cherry picked from commit 9e0094e2aa1b3428a12d5095132f133c078d3c3d) ---- - crypto/dh/dh_check.c | 6 ++++++ - include/openssl/dh.h | 6 +++++- - 2 files changed, 11 insertions(+), 1 deletion(-) - -diff --git a/crypto/dh/dh_check.c b/crypto/dh/dh_check.c -index 0b391910d6..84a926998e 100644 ---- a/crypto/dh/dh_check.c -+++ b/crypto/dh/dh_check.c -@@ -152,6 +152,12 @@ int DH_check(const DH *dh, int *ret) - if (nid != NID_undef) - return 1; - -+ /* Don't do any checks at all with an excessively large modulus */ -+ if (BN_num_bits(dh->params.p) > OPENSSL_DH_CHECK_MAX_MODULUS_BITS) { -+ ERR_raise(ERR_LIB_DH, DH_R_MODULUS_TOO_LARGE); -+ return 0; -+ } -+ - if (!DH_check_params(dh, ret)) - return 0; - -diff --git a/include/openssl/dh.h b/include/openssl/dh.h -index b97871eca7..36420f51d8 100644 ---- a/include/openssl/dh.h -+++ b/include/openssl/dh.h -@@ -89,7 +89,11 @@ int EVP_PKEY_CTX_get0_dh_kdf_ukm(EVP_PKEY_CTX *ctx, unsigned char **ukm); - # include - - # ifndef OPENSSL_DH_MAX_MODULUS_BITS --# define OPENSSL_DH_MAX_MODULUS_BITS 10000 -+# define OPENSSL_DH_MAX_MODULUS_BITS 10000 -+# endif -+ -+# ifndef OPENSSL_DH_CHECK_MAX_MODULUS_BITS -+# define OPENSSL_DH_CHECK_MAX_MODULUS_BITS 32768 - # endif - - # define OPENSSL_DH_FIPS_MIN_MODULUS_BITS 1024 --- -2.27.0 - diff --git a/backport-Make-DH_check-set-some-error-bits-in-recently-added-.patch b/backport-Make-DH_check-set-some-error-bits-in-recently-added-.patch deleted file mode 100644 index 91e94170344243274e85cbd6ed97f6340b28e3df..0000000000000000000000000000000000000000 --- a/backport-Make-DH_check-set-some-error-bits-in-recently-added-.patch +++ /dev/null @@ -1,39 +0,0 @@ -From e648db50d9a63f71cab5cb78424c2932d019a744 Mon Sep 17 00:00:00 2001 -From: Bernd Edlinger -Date: Sun, 23 Jul 2023 14:27:54 +0200 -Subject: [PATCH] Make DH_check set some error bits in recently added error - -The pre-existing error cases where DH_check returned zero -are not related to the dh params in any way, but are only -triggered by out-of-memory errors, therefore having *ret -set to zero feels right, but since the new error case is -triggered by too large p values that is something different. -On the other hand some callers of this function might not -be prepared to handle the return value correctly but only -rely on *ret. Therefore we set some error bits in *ret as -additional safety measure. - -Reviewed-by: Paul Dale -Reviewed-by: Tomas Mraz -(Merged from https://github.com/openssl/openssl/pull/21524) - -(cherry picked from commit 81d10e61a4b7d5394d08a718bf7d6bae20e818fc) ---- - crypto/dh/dh_check.c | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/crypto/dh/dh_check.c b/crypto/dh/dh_check.c -index 84a926998e..aef6f9b1b7 100644 ---- a/crypto/dh/dh_check.c -+++ b/crypto/dh/dh_check.c -@@ -155,6 +155,7 @@ int DH_check(const DH *dh, int *ret) - /* Don't do any checks at all with an excessively large modulus */ - if (BN_num_bits(dh->params.p) > OPENSSL_DH_CHECK_MAX_MODULUS_BITS) { - ERR_raise(ERR_LIB_DH, DH_R_MODULUS_TOO_LARGE); -+ *ret = DH_MODULUS_TOO_LARGE | DH_CHECK_P_NOT_PRIME; - return 0; - } - --- -2.27.0 - diff --git a/backport-dhtest.c-Add-test-of-DH_check-with-q-p-1.patch b/backport-dhtest.c-Add-test-of-DH_check-with-q-p-1.patch deleted file mode 100644 index d5d78907a71d8f52d03c643b9b002612d847dfe4..0000000000000000000000000000000000000000 --- a/backport-dhtest.c-Add-test-of-DH_check-with-q-p-1.patch +++ /dev/null @@ -1,53 +0,0 @@ -From 2255f6c74e6c8b702adcf352b04c5d3e6c759745 Mon Sep 17 00:00:00 2001 -From: Tomas Mraz -Date: Tue, 25 Jul 2023 15:23:43 +0200 -Subject: [PATCH] dhtest.c: Add test of DH_check() with q = p + 1 - -This must fail with DH_CHECK_INVALID_Q_VALUE and -with DH_CHECK_Q_NOT_PRIME unset. - -Reviewed-by: Matt Caswell -Reviewed-by: Paul Dale -Reviewed-by: Tom Cosgrove -Reviewed-by: Todd Short -(Merged from https://github.com/openssl/openssl/pull/21550) - -(cherry picked from commit ad5d35572695d7b5748b2bd4fb1afaa189b29e28) -(cherry picked from commit 1478ffad3f123550ec1014642d5c880dfbe270ef) ---- - test/dhtest.c | 12 ++++++++++++ - 1 file changed, 12 insertions(+) - -diff --git a/test/dhtest.c b/test/dhtest.c -index f8dd8f3aa7..d02b3b7c58 100644 ---- a/test/dhtest.c -+++ b/test/dhtest.c -@@ -124,6 +124,15 @@ static int dh_test(void) - /* We'll have a stale error on the queue from the above test so clear it */ - ERR_clear_error(); - -+ if (!TEST_ptr(BN_copy(q, p)) || !TEST_true(BN_add(q, q, BN_value_one()))) -+ goto err3; -+ -+ if (!TEST_true(DH_check(dh, &i))) -+ goto err3; -+ if (!TEST_true(i & DH_CHECK_INVALID_Q_VALUE) -+ || !TEST_false(i & DH_CHECK_Q_NOT_PRIME)) -+ goto err3; -+ - /* Modulus of size: dh check max modulus bits + 1 */ - if (!TEST_true(BN_set_word(p, 1)) - || !TEST_true(BN_lshift(p, p, OPENSSL_DH_CHECK_MAX_MODULUS_BITS))) -@@ -135,6 +144,9 @@ static int dh_test(void) - if (!TEST_false(DH_check(dh, &i))) - goto err3; - -+ /* We'll have a stale error on the queue from the above test so clear it */ -+ ERR_clear_error(); -+ - /* - * II) key generation - */ --- -2.27.0 - diff --git a/openssl-3.0-build.patch b/openssl-3.0-build.patch index 83243e127118475749e45803bd03014ec883fd57..b8f9c5aaf62c081728782e7e44d23d11100e0816 100644 --- a/openssl-3.0-build.patch +++ b/openssl-3.0-build.patch @@ -21,7 +21,7 @@ index b578a3c..1ad81c3 100644 "linux-arm64ilp32" => { # https://wiki.linaro.org/Platform/arm64-ilp32 inherit_from => [ "linux-generic32" ], diff --git a/Configurations/unix-Makefile.tmpl b/Configurations/unix-Makefile.tmpl -index 110ba06..712a779 100644 +index a48fae5..56b4292 100644 --- a/Configurations/unix-Makefile.tmpl +++ b/Configurations/unix-Makefile.tmpl @@ -611,7 +611,7 @@ install_sw: install_dev install_engines install_modules install_runtime @@ -32,7 +32,7 @@ index 110ba06..712a779 100644 +install_docs: install_man_docs uninstall_docs: uninstall_man_docs uninstall_html_docs - $(RM) -r $(DESTDIR)$(DOCDIR) + $(RM) -r "$(DESTDIR)$(DOCDIR)" -- 2.27.0 diff --git a/openssl-3.0.9.tar.gz b/openssl-3.0.12.tar.gz similarity index 63% rename from openssl-3.0.9.tar.gz rename to openssl-3.0.12.tar.gz index 5c2971456306505e6f24ddd425ceed9946fa48cf..4fb7c5f6e5f63dc609156763733126550081dd7e 100644 Binary files a/openssl-3.0.9.tar.gz and b/openssl-3.0.12.tar.gz differ diff --git a/openssl.spec b/openssl.spec index fe4084f7d01a88ca2ab65a1553f4417c3b6d8fb2..2dff76c5bbe154e2b0c5dd2715712899946c03e4 100644 --- a/openssl.spec +++ b/openssl.spec @@ -1,8 +1,8 @@ %define soversion 3 Name: openssl Epoch: 1 -Version: 3.0.9 -Release: 5 +Version: 3.0.12 +Release: 1 Summary: Cryptography and SSL/TLS Toolkit License: OpenSSL and SSLeay URL: https://www.openssl.org/ @@ -23,17 +23,9 @@ Patch11: Backport-Fix-SM4-test-failures-on-big-endian-ARM-processors.patch Patch12: Backport-Apply-SM4-optimization-patch-to-Kunpeng-920.patch Patch13: Backport-SM4-AESE-optimization-for-ARMv8.patch Patch14: Backport-Fix-SM4-XTS-build-failure-on-Mac-mini-M1.patch -Patch15: backport-Add-testcases-for-empty-associated-data-entries-with.patch -Patch16: backport-Do-not-ignore-empty-associated-data-with-AES-SIV-mod.patch -Patch17: backport-Add-a-test-for-CVE-2023-3446.patch -Patch18: backport-Fix-DH_check-excessive-time-with-over-sized-modulus.patch -Patch19: backport-Make-DH_check-set-some-error-bits-in-recently-added-.patch -Patch20: backport-DH_check-Do-not-try-checking-q-properties-if-it-is-o.patch -Patch21: backport-dhtest.c-Add-test-of-DH_check-with-q-p-1.patch -Patch22: Backport-support-decode-SM2-parameters.patch -Patch23: Feature-support-SM2-CMS-signature.patch -Patch24: Feature-use-default-id-if-SM2-id-is-not-set.patch -Patch25: backport-A-null-pointer-dereference-occurs-when-memory-alloca.patch +Patch15: Backport-support-decode-SM2-parameters.patch +Patch16: Feature-support-SM2-CMS-signature.patch +Patch17: Feature-use-default-id-if-SM2-id-is-not-set.patch BuildRequires: gcc gcc-c++ perl make lksctp-tools-devel coreutils util-linux zlib-devel Requires: coreutils %{name}-libs%{?_isa} = %{epoch}:%{version}-%{release} @@ -234,6 +226,9 @@ make test || : %ldconfig_scriptlets libs %changelog +* Thu Jan 04 2024 wangcheng - 1:3.0.12-1 +- Upgrade to 3.0.12 + * Fri Sep 22 2023 dongyuzhen - 1:3.0.9-5 - Backport some upstream patches