Release date:
2026-10-28 08:07:16 UTC
Description:
* SECURITY UPDATE: security hardening in CMS key unwrapping
- debian/patches/openssl-1.1.1-cve-2026-63072.patch: size the key-unwrap
output buffer in cms_kek_cipher() for the largest amount the unwrap
primitive can write, rather than the length reported for the unwrapped
key
- debian/patches/openssl-1.1.1-cve-2026-63072-unwrap-pad.patch: cleanse
padded_len rather than inlen on the four CRYPTO_128_unwrap_pad()
integrity-failure paths, so the exported primitive no longer writes 8
bytes past an output buffer sized per its own documented contract
- CVE-2026-63072
Updated packages:
-
alt-openssl11_1.1.1w-3.12_amd64.deb
sha:11e15b3f23b0a027756bab17bf9e3759452f983d
-
alt-openssl11-dev_1.1.1w-3.12_amd64.deb
sha:9f6d330ab0a40c23d124d4780f62a27a49daef00
-
alt-openssl11-doc_1.1.1w-3.12_all.deb
sha:e88a3bd7f45fa22d1b3dfff25374032c98dbfe8d
-
alt-openssl11-libs_1.1.1w-3.12_amd64.deb
sha:b665b7ae27903412c0414dba2a2f230bccee2685
Notes:
This page is generated automatically and has not been checked for errors. For clarification or
corrections please contact the
CloudLinux Packaging Team.
