Release date:
2026-10-28 08:44:19 UTC
Description:
* SECURITY UPDATE: security hardening in CMS key unwrapping
- debian/patches/openssl-1.1.1-cve-2026-63072.patch: size the key-unwrap
output buffer in cms_kek_cipher() for the largest amount the unwrap
primitive can write, rather than the length reported for the unwrapped
key
- debian/patches/openssl-1.1.1-cve-2026-63072-unwrap-pad.patch: cleanse
padded_len rather than inlen on the four CRYPTO_128_unwrap_pad()
integrity-failure paths, so the exported primitive no longer writes 8
bytes past an output buffer sized per its own documented contract
- CVE-2026-63072
Updated packages:
-
alt-openssl11_1.1.1w-3.12_amd64.deb
sha:3d4a6e9cc850e58f3a8db367e27fad77008cca2e
-
alt-openssl11-dev_1.1.1w-3.12_amd64.deb
sha:fb75ee04c99d53ff7a82e8110b835dfc7116e039
-
alt-openssl11-doc_1.1.1w-3.12_all.deb
sha:1b6ddb3468d760db8335c9e89a0902d80f070004
-
alt-openssl11-libs_1.1.1w-3.12_amd64.deb
sha:34952327399a86b4fe696d2dced4bbf1b71e5942
-
alt-openssl11_1.1.1w-3.12_arm64.deb
sha:1d8d05bef96e4d1c743ed6c9e31a5f6da4597830
-
alt-openssl11-dev_1.1.1w-3.12_arm64.deb
sha:9a57ce5864182a4b9b7fae42552df041eb5ea73c
-
alt-openssl11-libs_1.1.1w-3.12_arm64.deb
sha:4d1f07da8e8418f8aeca08ef062af797a776c9a3
Notes:
This page is generated automatically and has not been checked for errors. For clarification or
corrections please contact the
CloudLinux Packaging Team.
