Release date:
2026-10-28 08:03:31 UTC
Description:
* SECURITY UPDATE: security hardening in CMS key unwrapping
- debian/patches/openssl-1.1.1-cve-2026-63072.patch: size the key-unwrap
output buffer in cms_kek_cipher() for the largest amount the unwrap
primitive can write, rather than the length reported for the unwrapped
key
- debian/patches/openssl-1.1.1-cve-2026-63072-unwrap-pad.patch: cleanse
padded_len rather than inlen on the four CRYPTO_128_unwrap_pad()
integrity-failure paths, so the exported primitive no longer writes 8
bytes past an output buffer sized per its own documented contract
- CVE-2026-63072
Updated packages:
-
alt-openssl11_1.1.1w-3.12_amd64.deb
sha:f39ac11ff236bd57b77c0d367c2efdba90350ccc
-
alt-openssl11-dev_1.1.1w-3.12_amd64.deb
sha:86261a87a073cac002f2a24792aa4531b36b8e16
-
alt-openssl11-doc_1.1.1w-3.12_all.deb
sha:78e9a3a4fcdb76fac9a278260477392cdae52f1d
-
alt-openssl11-libs_1.1.1w-3.12_amd64.deb
sha:d211f4212835acc4827877e23b23fd2538ae4532
Notes:
This page is generated automatically and has not been checked for errors. For clarification or
corrections please contact the
CloudLinux Packaging Team.
