[ol8_developer_EPEL] openssl3-devel-3.0.1-41.el8.1.x86_64

OpenSSL is a toolkit for supporting cryptography. The openssl-devel
package contains include files needed to develop applications which
support various cryptographic algorithms and protocols.

Changelog (Show File list) (Show related packages)

• Tue Sep 27 2022 Michel Alexandre Salim <salimma@fedoraproject.org> 3.0.1-41.1

  - Merge c9s openssl changes to pick up CVE fixes

• Thu Aug 11 2022 Clemens Lang <cllang@redhat.com> - 1:3.0.1-41

  - Zeroize public keys as required by FIPS 140-3
    Related: rhbz#2102542
  - Add FIPS indicator for HKDF
    Related: rhbz#2114772

• Fri Aug 05 2022 Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:3.0.1-40

  - Deal with DH keys in FIPS mode according FIPS-140-3 requirements
    Related: rhbz#2102536
  - Deal with ECDH keys in FIPS mode according FIPS-140-3 requirements
    Related: rhbz#2102537
  - Use signature for RSA pairwise test according FIPS-140-3 requirements
    Related: rhbz#2102540
  - Reseed all the parent DRBGs in chain on reseeding a DRBG
    Related: rhbz#2102541

• Mon Aug 01 2022 Clemens Lang <cllang@redhat.com> - 1:3.0.1-39

  - Use RSA-OAEP in FIPS RSA encryption/decryption FIPS self-test
  - Use Use digest_sign & digest_verify in FIPS signature self test
  - Use FFDHE2048 in Diffie-Hellman FIPS self-test
    Resolves: rhbz#2102535

• Thu Jul 14 2022 Clemens Lang <cllang@redhat.com> - 1:3.0.1-38

  - Fix segfault in EVP_PKEY_Q_keygen() when OpenSSL was not previously
    initialized.
    Resolves: rhbz#2103289
  - Improve AES-GCM performance on Power9 and Power10 ppc64le
    Resolves: rhbz#2051312
  - Improve ChaCha20 performance on Power10 ppc64le
    Resolves: rhbz#2051312

• Tue Jul 05 2022 Clemens Lang <cllang@redhat.com> - 1:3.0.1-37

  - CVE-2022-2097: AES OCB fails to encrypt some bytes on 32-bit x86
    Resolves: CVE-2022-2097

• Thu Jun 16 2022 Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:3.0.1-36

  - Ciphersuites with RSAPSK KX should be filterd in FIPS mode
  - Related: rhbz#2085088
  - FIPS provider should block RSA encryption for key transport.
  - Other RSA encryption options should still be available if key length is enough
  - Related: rhbz#2053289
  - Improve diagnostics when passing unsupported groups in TLS
  - Related: rhbz#2070197
  - Fix PPC64 Montgomery multiplication bug
  - Related: rhbz#2098199
  - Strict certificates validation shouldn't allow explicit EC parameters
  - Related: rhbz#2058663
  - CVE-2022-2068: the c_rehash script allows command injection
  - Related: rhbz#2098277

• Wed Jun 08 2022 Clemens Lang <cllang@redhat.com> - 1:3.0.1-35

  - Add explicit indicators for signatures in FIPS mode and mark signature
    primitives as unapproved.
    Resolves: rhbz#2087147

• Fri Jun 03 2022 Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:3.0.1-34

  - Some OpenSSL test certificates are expired, updating
  - Resolves: rhbz#2092456

• Thu May 26 2022 Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:3.0.1-33

  - CVE-2022-1473 openssl: OPENSSL_LH_flush() breaks reuse of memory
  - Resolves: rhbz#2089444
  - CVE-2022-1343 openssl: Signer certificate verification returned
    inaccurate response when using OCSP_NOCHECKS
  - Resolves: rhbz#2087911
  - CVE-2022-1292 openssl: c_rehash script allows command injection
  - Resolves: rhbz#2090362
  - Revert "Disable EVP_PKEY_sign/EVP_PKEY_verify in FIPS mode"
    Related: rhbz#2087147
  - Use KAT for ECDSA signature tests, s390 arch
  - Resolves: rhbz#2069235