NetBSD Problem Report #60382

From manu@netbsd.org  Mon Jun 29 00:57:12 2026
Return-Path: <manu@netbsd.org>
Received: from mail.netbsd.org (mail.netbsd.org [199.233.217.200])
	(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
	 key-exchange X25519 server-signature RSA-PSS (2048 bits)
	 client-signature RSA-PSS (2048 bits))
	(Client CN "mail.netbsd.org", Issuer "R13" (not verified))
	by mollari.NetBSD.org (Postfix) with ESMTPS id BD0161A923A
	for <gnats-bugs@gnats.NetBSD.org>; Mon, 29 Jun 2026 00:57:12 +0000 (UTC)
Message-Id: <20260629005712.52C7084CFE@mail.netbsd.org>
Date: Mon, 29 Jun 2026 00:57:12 +0000 (UTC)
From: manu@netbsd.org
Reply-To: manu@netbsd.org
To: gnats-bugs@NetBSD.org
Subject: OpenSSL 3.0.21 upgrade for netbsd-10
X-Send-Pr-Version: 3.95
X-From4GNATS: "manu@netbsd.org via gnats" <gnats-admin@NetBSD.org>

>Number:         60382
>Category:       lib
>Synopsis:       OpenSSL 3.0.21 upgrade for netbsd-10
>Confidential:   no
>Severity:       non-critical
>Priority:       medium
>Responsible:    lib-bug-people
>State:          open
>Class:          change-request
>Submitter-Id:   net
>Arrival-Date:   Mon Jun 29 01:00:00 +0000 2026
>Last-Modified:  Mon Jun 29 09:10:01 +0000 2026
>Originator:     Emmanuel Dreyfus
>Release:        NetBSD 10.0_STABLE
>Organization:
NetBSD
>Environment:
System: NetBSD homeworld.NetBSD.org 10.0_STABLE NetBSD 10.0_STABLE (NBMAIL) #0: Tue May 28 07:37:21 UTC 2024 spz@franklin.NetBSD.org:/home/netbsd/10/amd64/obj/sys/arch/amd64/compile/NBMAIL amd64
Architecture: x86_64
Machine: amd64
>Description:
netbsd-10 includes OpenSSL 3.0.12, and this version had
many CVE reported:
CVE-2026-45447  CVE-2026-45446  CVE-2025-68160  CVE-2025-9232   CVE-2024-0727
CVE-2026-34182  CVE-2026-31790  CVE-2025-69418  CVE-2024-13176  CVE-2023-6237
CVE-2026-45445  CVE-2026-28387  CVE-2025-69419  CVE-2024-9143   CVE-2023-6129
CVE-2026-7383   CVE-2026-28388  CVE-2025-69420  CVE-2024-6119   CVE-2023-5678
CVE-2026-9076   CVE-2026-28389  CVE-2025-69421  CVE-2024-5535   
CVE-2026-34180  CVE-2026-28390  CVE-2026-22795  CVE-2024-4741   
CVE-2026-42766  CVE-2026-31789  CVE-2026-22796  CVE-2024-4603   
CVE-2026-42770  CVE-2025-15467  CVE-2025-9230   CVE-2024-2511  

This PR is about updating to OpenSSL 3.0.21 for fixing above
mentionned CVE.

>How-To-Repeat:

>Fix:
This patch updates OpenSSL to 3.0.21. It is huge: 194k lines. Most of 
it is the unmodified import of openssl-3.0.1 in 
src/crypto/external/bsd/openssl/dist

How is was crafted  (procedure from src/doc/3RDPARTY with dditional
details):
- unpack openssl tarball in src/crypto/external/bsd/openssl/dist
- Run openssl2netbsd to get rid of the RCSID identifiers
- in src/crypto/external/bsd/openssl/dist
  ./configure
  make include/openssl/opensslv.h
  make include/openssl/fipskey.h
  cp include/openssl/opensslv.h include/openssl/fipskey.h \
     include/openssl/configuration.h  ../include/openssl
- clear dist and unpack openssl again
- review header filer modifications and merge changes
- run make in /usr/src/crypto/external/bsd/openssl/lib/libcrypto/man
  to regen man pages.
- run make in /usr/src/crypto/external/bsd/openssl/lib/libcrypto/arch/*
  to regen assembly files

The big patch:
https://dl.espci.fr/ticket/d02beafc0a42f837d86847ea007de62e

>Audit-Trail:
From: Martin Husemann <martin@duskware.de>
To: gnats-bugs@netbsd.org
Cc: nia@NetBSD.org
Subject: Re: lib/60382: OpenSSL 3.0.21 upgrade for netbsd-10
Date: Mon, 29 Jun 2026 10:20:33 +0200

 On Mon, Jun 29, 2026 at 01:00:02AM +0000, manu@netbsd.org via gnats wrote:
 > This PR is about updating to OpenSSL 3.0.21 for fixing above
 > mentionned CVE.

 We just did that last saturday - sorry for the duplicated
 work, but maybe you can compare results and see if there are differences?

 #       $NetBSD: 3RDPARTY,v 1.1905.2.18 2026/06/27 14:40:34 martin Exp $
 [..]
 Package:        OpenSSL
 Version:        1.0.2o/1.1.1t/3.0.21
 Current Vers:   1.0.2zm/1.1.1zd/3.0.21/3.2.6/3.3.7/3.4.5/3.5.7/3.6.3/4.0.1


 Martin

From: Emmanuel Dreyfus <manu@netbsd.org>
To: gnats-bugs@netbsd.org
Cc: 
Subject: Re: lib/60382: OpenSSL 3.0.21 upgrade for netbsd-10
Date: Mon, 29 Jun 2026 08:55:47 +0000

 On Mon, Jun 29, 2026 at 08:25:02AM +0000, Martin Husemann via gnats wrote:
 >  We just did that last saturday - sorry for the duplicated
 >  work, but maybe you can compare results and see if there are differences?

 Sure, I will.

 Off-topic, but the subject is almost the same: is anyone working
 on the OpenSSH upgrade?

 -- 
 Emmanuel Dreyfus
 manu@netbsd.org

From: Martin Husemann <martin@duskware.de>
To: gnats-bugs@netbsd.org
Cc: manu@netbsd.org, nia@NetBSD.org
Subject: Re: lib/60382: OpenSSL 3.0.21 upgrade for netbsd-10
Date: Mon, 29 Jun 2026 11:09:24 +0200

 On Mon, Jun 29, 2026 at 09:00:03AM +0000, Emmanuel Dreyfus via gnats wrote:
 >  Off-topic, but the subject is almost the same: is anyone working
 >  on the OpenSSH upgrade?

 I am not aware of anyone. Nia?

 Martin

Home	PR Database Search