<?xml version="1.0" encoding="UTF-8"?>
<otherdata xmlns="http://linux.duke.edu/metadata/other" packages="42">
<package pkgid="b2f6957588155c56483cfc30c9fcb15a4987e615fe2e2aff0e6ed2ba2bc3e394" name="glibc-micro6-experiment" arch="src">
  <version epoch="0" ver="0.2" rel="150400.3.31.1"/>
  <changelog author="giuliano.belinassi@suse.com" date="1723464000">- glibc livepatch experiment for micro 6.</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1723464001">- Update with glibc from micro 6.</changelog>
</package>
<package pkgid="8751c194bf6f5eae9e1a3a4b48c8473cfd5c7a0d196c2c9c0ee7b32e11c266de" name="glibc-micro6-experiment" arch="x86_64">
  <version epoch="0" ver="0.2" rel="150400.3.31.1"/>
  <changelog author="giuliano.belinassi@suse.com" date="1723464000">- glibc livepatch experiment for micro 6.</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1723464001">- Update with glibc from micro 6.</changelog>
</package>
<package pkgid="5ec3ea1f7c1a186f921eb871d2823c463c85b7596d38256786002b4fe549eff8" name="glibc-micro6-experiment-debuginfo" arch="x86_64">
  <version epoch="0" ver="0.2" rel="150400.3.31.1"/>
  <changelog author="giuliano.belinassi@suse.com" date="1723464000">- glibc livepatch experiment for micro 6.</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1723464001">- Update with glibc from micro 6.</changelog>
</package>
<package pkgid="eed857efa2c88c692d94421e2da8f3d23c9f330b3855aff7b235c99c14d60450" name="glibc-micro6-experiment-debugsource" arch="x86_64">
  <version epoch="0" ver="0.2" rel="150400.3.31.1"/>
  <changelog author="giuliano.belinassi@suse.com" date="1723464000">- glibc livepatch experiment for micro 6.</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1723464001">- Update with glibc from micro 6.</changelog>
</package>
<package pkgid="3dd6762c6ad521ee0dfe128895f3916165a10e61357c2ae07f8d23c642fc28a0" name="libopenssl-3-devel" arch="x86_64">
  <version epoch="0" ver="3.2.3" rel="150400.5.33.3"/>
  <changelog author="pmonreal@suse.com" date="1730116800">- Remove the hardcoded DEFAULT_SUSE cipherlist selection.
  * Remove openssl-DEFAULT_SUSE_cipher.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1730116801">- Update to 3.2.3:
  * Changes between 3.2.2 and 3.2.3:
  - Fixed possible denial of service in X.509 name checks. [CVE-2024-6119]
  - Fixed possible buffer overread in SSL_select_next_proto(). [CVE-2024-5535]
  * Changes between 3.2.1 and 3.2.2:
  - Fixed potential use after free after SSL_free_buffers() is called. [CVE-2024-4741]
  - Fixed an issue where checking excessively long DSA keys or parameters may
    be very slow. [CVE-2024-4603]
  - Improved EC/DSA nonce generation routines to avoid bias and timing
    side channel leaks.
  - Fixed an issue where some non-default TLS server configurations can cause
    unbounded memory growth when processing TLSv1.3 sessions. [CVE-2024-2511]
  - New atexit configuration switch, which controls whether the OPENSSL_cleanup
    is registered when libcrypto is unloaded. This can be used on platforms
    where using atexit() from shared libraries causes crashes on exit.
  - Fixed bug where SSL_export_keying_material() could not be used with QUIC
    connections.
  * Add openssl-skip-quic-pairwise.patch to adapt the pairwise tests.
  * Merge openssl-FIPS-release_num_in_version_string.patch into
    openssl-FIPS-services-minimize.patch
  * Rebase patches:
  - openssl-Add-changes-to-ectest-and-eccurve.patch
  - openssl-FIPS-140-3-keychecks.patch
  - openssl-FIPS-embed-hmac.patch
  - openssl-Remove-EC-curves.patch
  - openssl-skipped-tests-EC-curves.patch
  - openssl-FIPS-early-KATS.patch
  - openssl-Allow-disabling-of-SHA1-signatures.patch
  - openssl-3-FIPS-Deny-SHA-1-sigver-in-FIPS-provider.patch
  - openssl-FIPS-limit-rsa-encrypt.patch
  - openssl-FIPS-Use-OAEP-in-KATs-support-fixed-OAEP-seed.patch
  - openssl-FIPS-Use-digest_sign-digest_verify-in-self-test.patch
  - openssl-FIPS-140-3-DRBG.patch
  - openssl-FIPS-140-3-zeroization.patch
  - openssl-Add-FIPS-indicator-parameter-to-HKDF.patch
  - openssl-FIPS-Remove-X9.31-padding-from-FIPS-prov.patch
  - openssl-FIPS-Add-explicit-indicator-for-key-length.patch
  - openssl-pbkdf2-Set-minimum-password-length-of-8-bytes.patch
  - openssl-FIPS-signature-Add-indicator-for-PSS-salt-length.patch
  - openssl-3-FIPS-GCM-Implement-explicit-indicator-for-IV-gen.patch
  - openssl-FIPS-enforce-EMS-support.patch
  - openssl-3-jitterentropy-3.4.0.patch
  - openssl-3-use-include-directive.patch
  * Remove not needed patches:
  - openssl-Allow-SHA1-in-seclevel-2-if-rh-allow-sha1-signatures.patch
  - openssl-3-FIPS-PCT_rsa_keygen.patch</changelog>
  <changelog author="angel.yankov@suse.com" date="1730462400">- Support MSA 12 SHA3 on s390x [jsc#PED-10280]
  * Add openssl-3-add_EVP_DigestSqueeze_api.patch
  * Add openssl-3-support-multiple-sha3_squeeze_s390x.patch
  * Add openssl-3-add-xof-state-handling-s3_absorb.patch
  * Add openssl-3-fix-state-handling-sha3_absorb_s390x.patch
  * Add openssl-3-fix-state-handling-sha3_final_s390x.patch
  * Add openssl-3-fix-state-handling-shake_final_s390x.patch
  * Add openssl-3-fix-state-handling-keccak_final_s390x.patch
  * Add openssl-3-support-EVP_DigestSqueeze-in-digest-prov-s390x.patch
  * Add openssl-3-add-defines-CPACF-funcs.patch
  * Add openssl-3-add-hw-acceleration-hmac.patch
  * Add openssl-3-support-CPACF-sha3-shake-perf-improvement.patch
  * Add openssl-3-fix-s390x_sha3_absorb.patch
  * Add openssl-3-fix-s390x_shake_squeeze.patch</changelog>
  <changelog author="angel.yankov@suse.com" date="1730808000">- Support MSA 10 XTS on s390x [jsc#PED-10273]
  * s390x: Add hardware acceleration for full AES-XTS
  * Add openssl-3-hw-acceleration-aes-xts-s390x.patch</changelog>
  <changelog author="angel.yankov@suse.com" date="1730808001">- Support MSA 11 HMAC on s390x [jsc#PED-10274]
  * Add openssl-3-disable-hmac-hw-acceleration-with-engine-digest.patch
  * Add openssl-3-fix-hmac-digest-detection-s390x.patch
  * Add openssl-3-fix-memleak-s390x_HMAC_CTX_copy.patch</changelog>
  <changelog author="angel.yankov@suse.com" date="1730980800">- Add missing fixes for SHA3_squeeze and quic_multistream_test on
  pcc64 arch. [jsc#PED-10280]
  * Added openssl-3-fix-sha3-squeeze-ppc64.patch
  * Added openssl-3-fix-quic_multistream_test.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1731412800">- Do not use HASHBANGPERL to avoid introducing a dependency on the
  perl-base package. [bsc#1233235]</changelog>
  <changelog author="pmonreal@suse.com" date="1734436800">- Fix evp_properties section in the openssl.cnf file [bsc#1234647]
  * Rebase patches:
  - openssl-3-use-include-directive.patch
  - openssl-TESTS-Disable-default-provider-crypto-policies.patch</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1734955200">- Add support for userspace livepatching on ppc64le (jsc#PED-11850).
- Use gcc-13 for ppc64le.</changelog>
  <changelog author="lucas.mulling@suse.com" date="1738238400">- Security fix: [bsc#1236136, CVE-2024-13176]
  * Fix timing side-channel in ECDSA signature computation
  * Add openssl-CVE-2024-13176.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1739361600">- Security fix: [bsc#1236599, CVE-2024-12797]
  * RFC7250 handshakes with unauthenticated servers don't abort as
    expected.
  * Add openssl-CVE-2024-12797.patch</changelog>
  <changelog author="angel.yankov@suse.com" date="1746014400">- Security fix: [bsc#1240366, CVE-2025-27587]
  * Minerva side channel vulnerability in P-384 on PPC arch
  * Add openssl-3-p384-minerva-ppc.patch
  * Add openssl-3-p384-minerva-ppc-p9.patch</changelog>
  <changelog author="mls@suse.de" date="1751371200">- Backport mdless cms signing support [jsc#PED-12895]
  * Add openssl-3-support-mdless-cms.patch</changelog>
  <changelog author="lucas.mulling@suse.com" date="1752494400">- FIPS: Fix EMS in crypto-policies FIPS:NO-ENFORCE-EMS
  * [bsc#1230959, bsc#1232326, bsc#1231748, bsc#1246428]
  * Add patch openssl-FIPS-fix-EMS-support.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1753876800">- Increase limit for CRL download [bsc#1247148, bsc#1247144]
  * Add openssl-3-large-CRLs.patch</changelog>
  <changelog author="lucas.mulling@suse.com" date="1759233600">- Security fix: [bsc#1250232 CVE-2025-9230]
  * Fix out-of-bounds read &amp; write in RFC 3211 KEK unwrap
  * Add patch openssl3-CVE-2025-9230.patch</changelog>
  <changelog author="lucas.mulling@suse.com" date="1768824000">- Security fixes:
  * Missing ASN1_TYPE validation in PKCS#12 parsing
  - openssl-CVE-2026-22795.patch [bsc#1256839, CVE-2026-22795]
  * ASN1_TYPE Type Confusion in the PKCS7_digest_from_attributes() function
  - openssl-CVE-2026-22795.patch [bsc#1256840, CVE-2026-22796]
  * Missing ASN1_TYPE validation in TS_RESP_verify_response() function
  - openssl-CVE-2025-69420.patch [bsc#1256837, CVE-2025-69420]
  * NULL Pointer Dereference in PKCS12_item_decrypt_d2i_ex function
  - openssl-CVE-2025-69421.patch [bsc#1256838, CVE-2025-69421]
  * Out of bounds write in PKCS12_get_friendlyname() UTF-8 conversion
  - openssl-CVE-2025-69419.patch [bsc#1256836, CVE-2025-69419]
  * Heap out-of-bounds write in BIO_f_linebuffer on short writes
  - openssl-CVE-2025-68160.patch [bsc#1256834, CVE-2025-68160]
  * Unauthenticated/unencrypted trailing bytes with low-level OCB function calls
  - openssl-CVE-2025-69418.patch [bsc#1256835, CVE-2025-69418]
  * Stack buffer overflow in CMS AuthEnvelopedData parsing
  - openssl-CVE-2025-15467.patch [bsc#1256830, CVE-2025-15467]
  - openssl-CVE-2025-15467-comments.patch
  - openssl-CVE-2025-15467-test.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1774526400">- Security fixes:
  * CVE-2026-28387: Potential use-after-free in DANE client code
    (bsc#1260441)
  * CVE-2026-28388: NULL Pointer Dereference When Processing a
    Delta (bsc#1260442)
  * CVE-2026-28389: Possible NULL dereference when processing CMS
    KeyAgreeRecipientInfo (bsc#1260443)
  * CVE-2026-31789: Heap buffer overflow in hexadecimal conversion
    (bsc#1260444)
  * CVE-2026-31790: Incorrect failure handling in RSA KEM RSASVE
    encapsulation (bsc#1260445)
  * NULL pointer dereference when processing an OCSP response
    (bsc#1260446)
  * Add patches: openssl-CVE-2026-28387.patch
    openssl-CVE-2026-28388.patch openssl-CVE-2026-28388-tests.patch
    openssl-CVE-2026-28389.patch openssl-CVE-2026-31789.patch
    openssl-CVE-2026-31790.patch openssl-CVE-2026-31790-tests.patch
    openssl-NULL-pointer-dereference-in-ocsp_find_signer_sk.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1775649600">- Security fix:
  * CVE-2026-28390: NULL pointer dereference during processing of a crafted
    CMS EnvelopedData message with KeyTransportRecipientInfo (bsc#1261678)
  * Add openssl-CVE-2026-28390.patch</changelog>
  <changelog author="lucas.mulling@suse.com" date="1775822400">- Enable MD2 in legacy provider (jsc#PED-15724)</changelog>
</package>
<package pkgid="d8a78e1451e73a61fd8cf6ea1fcbefdea373b715b82303c1e17e4c91c0921f9c" name="libopenssl-3-fips-provider" arch="x86_64">
  <version epoch="0" ver="3.2.3" rel="150400.5.33.3"/>
  <changelog author="pmonreal@suse.com" date="1730116800">- Remove the hardcoded DEFAULT_SUSE cipherlist selection.
  * Remove openssl-DEFAULT_SUSE_cipher.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1730116801">- Update to 3.2.3:
  * Changes between 3.2.2 and 3.2.3:
  - Fixed possible denial of service in X.509 name checks. [CVE-2024-6119]
  - Fixed possible buffer overread in SSL_select_next_proto(). [CVE-2024-5535]
  * Changes between 3.2.1 and 3.2.2:
  - Fixed potential use after free after SSL_free_buffers() is called. [CVE-2024-4741]
  - Fixed an issue where checking excessively long DSA keys or parameters may
    be very slow. [CVE-2024-4603]
  - Improved EC/DSA nonce generation routines to avoid bias and timing
    side channel leaks.
  - Fixed an issue where some non-default TLS server configurations can cause
    unbounded memory growth when processing TLSv1.3 sessions. [CVE-2024-2511]
  - New atexit configuration switch, which controls whether the OPENSSL_cleanup
    is registered when libcrypto is unloaded. This can be used on platforms
    where using atexit() from shared libraries causes crashes on exit.
  - Fixed bug where SSL_export_keying_material() could not be used with QUIC
    connections.
  * Add openssl-skip-quic-pairwise.patch to adapt the pairwise tests.
  * Merge openssl-FIPS-release_num_in_version_string.patch into
    openssl-FIPS-services-minimize.patch
  * Rebase patches:
  - openssl-Add-changes-to-ectest-and-eccurve.patch
  - openssl-FIPS-140-3-keychecks.patch
  - openssl-FIPS-embed-hmac.patch
  - openssl-Remove-EC-curves.patch
  - openssl-skipped-tests-EC-curves.patch
  - openssl-FIPS-early-KATS.patch
  - openssl-Allow-disabling-of-SHA1-signatures.patch
  - openssl-3-FIPS-Deny-SHA-1-sigver-in-FIPS-provider.patch
  - openssl-FIPS-limit-rsa-encrypt.patch
  - openssl-FIPS-Use-OAEP-in-KATs-support-fixed-OAEP-seed.patch
  - openssl-FIPS-Use-digest_sign-digest_verify-in-self-test.patch
  - openssl-FIPS-140-3-DRBG.patch
  - openssl-FIPS-140-3-zeroization.patch
  - openssl-Add-FIPS-indicator-parameter-to-HKDF.patch
  - openssl-FIPS-Remove-X9.31-padding-from-FIPS-prov.patch
  - openssl-FIPS-Add-explicit-indicator-for-key-length.patch
  - openssl-pbkdf2-Set-minimum-password-length-of-8-bytes.patch
  - openssl-FIPS-signature-Add-indicator-for-PSS-salt-length.patch
  - openssl-3-FIPS-GCM-Implement-explicit-indicator-for-IV-gen.patch
  - openssl-FIPS-enforce-EMS-support.patch
  - openssl-3-jitterentropy-3.4.0.patch
  - openssl-3-use-include-directive.patch
  * Remove not needed patches:
  - openssl-Allow-SHA1-in-seclevel-2-if-rh-allow-sha1-signatures.patch
  - openssl-3-FIPS-PCT_rsa_keygen.patch</changelog>
  <changelog author="angel.yankov@suse.com" date="1730462400">- Support MSA 12 SHA3 on s390x [jsc#PED-10280]
  * Add openssl-3-add_EVP_DigestSqueeze_api.patch
  * Add openssl-3-support-multiple-sha3_squeeze_s390x.patch
  * Add openssl-3-add-xof-state-handling-s3_absorb.patch
  * Add openssl-3-fix-state-handling-sha3_absorb_s390x.patch
  * Add openssl-3-fix-state-handling-sha3_final_s390x.patch
  * Add openssl-3-fix-state-handling-shake_final_s390x.patch
  * Add openssl-3-fix-state-handling-keccak_final_s390x.patch
  * Add openssl-3-support-EVP_DigestSqueeze-in-digest-prov-s390x.patch
  * Add openssl-3-add-defines-CPACF-funcs.patch
  * Add openssl-3-add-hw-acceleration-hmac.patch
  * Add openssl-3-support-CPACF-sha3-shake-perf-improvement.patch
  * Add openssl-3-fix-s390x_sha3_absorb.patch
  * Add openssl-3-fix-s390x_shake_squeeze.patch</changelog>
  <changelog author="angel.yankov@suse.com" date="1730808000">- Support MSA 10 XTS on s390x [jsc#PED-10273]
  * s390x: Add hardware acceleration for full AES-XTS
  * Add openssl-3-hw-acceleration-aes-xts-s390x.patch</changelog>
  <changelog author="angel.yankov@suse.com" date="1730808001">- Support MSA 11 HMAC on s390x [jsc#PED-10274]
  * Add openssl-3-disable-hmac-hw-acceleration-with-engine-digest.patch
  * Add openssl-3-fix-hmac-digest-detection-s390x.patch
  * Add openssl-3-fix-memleak-s390x_HMAC_CTX_copy.patch</changelog>
  <changelog author="angel.yankov@suse.com" date="1730980800">- Add missing fixes for SHA3_squeeze and quic_multistream_test on
  pcc64 arch. [jsc#PED-10280]
  * Added openssl-3-fix-sha3-squeeze-ppc64.patch
  * Added openssl-3-fix-quic_multistream_test.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1731412800">- Do not use HASHBANGPERL to avoid introducing a dependency on the
  perl-base package. [bsc#1233235]</changelog>
  <changelog author="pmonreal@suse.com" date="1734436800">- Fix evp_properties section in the openssl.cnf file [bsc#1234647]
  * Rebase patches:
  - openssl-3-use-include-directive.patch
  - openssl-TESTS-Disable-default-provider-crypto-policies.patch</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1734955200">- Add support for userspace livepatching on ppc64le (jsc#PED-11850).
- Use gcc-13 for ppc64le.</changelog>
  <changelog author="lucas.mulling@suse.com" date="1738238400">- Security fix: [bsc#1236136, CVE-2024-13176]
  * Fix timing side-channel in ECDSA signature computation
  * Add openssl-CVE-2024-13176.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1739361600">- Security fix: [bsc#1236599, CVE-2024-12797]
  * RFC7250 handshakes with unauthenticated servers don't abort as
    expected.
  * Add openssl-CVE-2024-12797.patch</changelog>
  <changelog author="angel.yankov@suse.com" date="1746014400">- Security fix: [bsc#1240366, CVE-2025-27587]
  * Minerva side channel vulnerability in P-384 on PPC arch
  * Add openssl-3-p384-minerva-ppc.patch
  * Add openssl-3-p384-minerva-ppc-p9.patch</changelog>
  <changelog author="mls@suse.de" date="1751371200">- Backport mdless cms signing support [jsc#PED-12895]
  * Add openssl-3-support-mdless-cms.patch</changelog>
  <changelog author="lucas.mulling@suse.com" date="1752494400">- FIPS: Fix EMS in crypto-policies FIPS:NO-ENFORCE-EMS
  * [bsc#1230959, bsc#1232326, bsc#1231748, bsc#1246428]
  * Add patch openssl-FIPS-fix-EMS-support.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1753876800">- Increase limit for CRL download [bsc#1247148, bsc#1247144]
  * Add openssl-3-large-CRLs.patch</changelog>
  <changelog author="lucas.mulling@suse.com" date="1759233600">- Security fix: [bsc#1250232 CVE-2025-9230]
  * Fix out-of-bounds read &amp; write in RFC 3211 KEK unwrap
  * Add patch openssl3-CVE-2025-9230.patch</changelog>
  <changelog author="lucas.mulling@suse.com" date="1768824000">- Security fixes:
  * Missing ASN1_TYPE validation in PKCS#12 parsing
  - openssl-CVE-2026-22795.patch [bsc#1256839, CVE-2026-22795]
  * ASN1_TYPE Type Confusion in the PKCS7_digest_from_attributes() function
  - openssl-CVE-2026-22795.patch [bsc#1256840, CVE-2026-22796]
  * Missing ASN1_TYPE validation in TS_RESP_verify_response() function
  - openssl-CVE-2025-69420.patch [bsc#1256837, CVE-2025-69420]
  * NULL Pointer Dereference in PKCS12_item_decrypt_d2i_ex function
  - openssl-CVE-2025-69421.patch [bsc#1256838, CVE-2025-69421]
  * Out of bounds write in PKCS12_get_friendlyname() UTF-8 conversion
  - openssl-CVE-2025-69419.patch [bsc#1256836, CVE-2025-69419]
  * Heap out-of-bounds write in BIO_f_linebuffer on short writes
  - openssl-CVE-2025-68160.patch [bsc#1256834, CVE-2025-68160]
  * Unauthenticated/unencrypted trailing bytes with low-level OCB function calls
  - openssl-CVE-2025-69418.patch [bsc#1256835, CVE-2025-69418]
  * Stack buffer overflow in CMS AuthEnvelopedData parsing
  - openssl-CVE-2025-15467.patch [bsc#1256830, CVE-2025-15467]
  - openssl-CVE-2025-15467-comments.patch
  - openssl-CVE-2025-15467-test.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1774526400">- Security fixes:
  * CVE-2026-28387: Potential use-after-free in DANE client code
    (bsc#1260441)
  * CVE-2026-28388: NULL Pointer Dereference When Processing a
    Delta (bsc#1260442)
  * CVE-2026-28389: Possible NULL dereference when processing CMS
    KeyAgreeRecipientInfo (bsc#1260443)
  * CVE-2026-31789: Heap buffer overflow in hexadecimal conversion
    (bsc#1260444)
  * CVE-2026-31790: Incorrect failure handling in RSA KEM RSASVE
    encapsulation (bsc#1260445)
  * NULL pointer dereference when processing an OCSP response
    (bsc#1260446)
  * Add patches: openssl-CVE-2026-28387.patch
    openssl-CVE-2026-28388.patch openssl-CVE-2026-28388-tests.patch
    openssl-CVE-2026-28389.patch openssl-CVE-2026-31789.patch
    openssl-CVE-2026-31790.patch openssl-CVE-2026-31790-tests.patch
    openssl-NULL-pointer-dereference-in-ocsp_find_signer_sk.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1775649600">- Security fix:
  * CVE-2026-28390: NULL pointer dereference during processing of a crafted
    CMS EnvelopedData message with KeyTransportRecipientInfo (bsc#1261678)
  * Add openssl-CVE-2026-28390.patch</changelog>
  <changelog author="lucas.mulling@suse.com" date="1775822400">- Enable MD2 in legacy provider (jsc#PED-15724)</changelog>
</package>
<package pkgid="fc08bb4a76242bde84a26e38fef180451776e6cc5d02ed7f56d86844c28d0371" name="libopenssl-3-fips-provider-debuginfo" arch="x86_64">
  <version epoch="0" ver="3.2.3" rel="150400.5.33.3"/>
  <changelog author="pmonreal@suse.com" date="1730116800">- Remove the hardcoded DEFAULT_SUSE cipherlist selection.
  * Remove openssl-DEFAULT_SUSE_cipher.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1730116801">- Update to 3.2.3:
  * Changes between 3.2.2 and 3.2.3:
  - Fixed possible denial of service in X.509 name checks. [CVE-2024-6119]
  - Fixed possible buffer overread in SSL_select_next_proto(). [CVE-2024-5535]
  * Changes between 3.2.1 and 3.2.2:
  - Fixed potential use after free after SSL_free_buffers() is called. [CVE-2024-4741]
  - Fixed an issue where checking excessively long DSA keys or parameters may
    be very slow. [CVE-2024-4603]
  - Improved EC/DSA nonce generation routines to avoid bias and timing
    side channel leaks.
  - Fixed an issue where some non-default TLS server configurations can cause
    unbounded memory growth when processing TLSv1.3 sessions. [CVE-2024-2511]
  - New atexit configuration switch, which controls whether the OPENSSL_cleanup
    is registered when libcrypto is unloaded. This can be used on platforms
    where using atexit() from shared libraries causes crashes on exit.
  - Fixed bug where SSL_export_keying_material() could not be used with QUIC
    connections.
  * Add openssl-skip-quic-pairwise.patch to adapt the pairwise tests.
  * Merge openssl-FIPS-release_num_in_version_string.patch into
    openssl-FIPS-services-minimize.patch
  * Rebase patches:
  - openssl-Add-changes-to-ectest-and-eccurve.patch
  - openssl-FIPS-140-3-keychecks.patch
  - openssl-FIPS-embed-hmac.patch
  - openssl-Remove-EC-curves.patch
  - openssl-skipped-tests-EC-curves.patch
  - openssl-FIPS-early-KATS.patch
  - openssl-Allow-disabling-of-SHA1-signatures.patch
  - openssl-3-FIPS-Deny-SHA-1-sigver-in-FIPS-provider.patch
  - openssl-FIPS-limit-rsa-encrypt.patch
  - openssl-FIPS-Use-OAEP-in-KATs-support-fixed-OAEP-seed.patch
  - openssl-FIPS-Use-digest_sign-digest_verify-in-self-test.patch
  - openssl-FIPS-140-3-DRBG.patch
  - openssl-FIPS-140-3-zeroization.patch
  - openssl-Add-FIPS-indicator-parameter-to-HKDF.patch
  - openssl-FIPS-Remove-X9.31-padding-from-FIPS-prov.patch
  - openssl-FIPS-Add-explicit-indicator-for-key-length.patch
  - openssl-pbkdf2-Set-minimum-password-length-of-8-bytes.patch
  - openssl-FIPS-signature-Add-indicator-for-PSS-salt-length.patch
  - openssl-3-FIPS-GCM-Implement-explicit-indicator-for-IV-gen.patch
  - openssl-FIPS-enforce-EMS-support.patch
  - openssl-3-jitterentropy-3.4.0.patch
  - openssl-3-use-include-directive.patch
  * Remove not needed patches:
  - openssl-Allow-SHA1-in-seclevel-2-if-rh-allow-sha1-signatures.patch
  - openssl-3-FIPS-PCT_rsa_keygen.patch</changelog>
  <changelog author="angel.yankov@suse.com" date="1730462400">- Support MSA 12 SHA3 on s390x [jsc#PED-10280]
  * Add openssl-3-add_EVP_DigestSqueeze_api.patch
  * Add openssl-3-support-multiple-sha3_squeeze_s390x.patch
  * Add openssl-3-add-xof-state-handling-s3_absorb.patch
  * Add openssl-3-fix-state-handling-sha3_absorb_s390x.patch
  * Add openssl-3-fix-state-handling-sha3_final_s390x.patch
  * Add openssl-3-fix-state-handling-shake_final_s390x.patch
  * Add openssl-3-fix-state-handling-keccak_final_s390x.patch
  * Add openssl-3-support-EVP_DigestSqueeze-in-digest-prov-s390x.patch
  * Add openssl-3-add-defines-CPACF-funcs.patch
  * Add openssl-3-add-hw-acceleration-hmac.patch
  * Add openssl-3-support-CPACF-sha3-shake-perf-improvement.patch
  * Add openssl-3-fix-s390x_sha3_absorb.patch
  * Add openssl-3-fix-s390x_shake_squeeze.patch</changelog>
  <changelog author="angel.yankov@suse.com" date="1730808000">- Support MSA 10 XTS on s390x [jsc#PED-10273]
  * s390x: Add hardware acceleration for full AES-XTS
  * Add openssl-3-hw-acceleration-aes-xts-s390x.patch</changelog>
  <changelog author="angel.yankov@suse.com" date="1730808001">- Support MSA 11 HMAC on s390x [jsc#PED-10274]
  * Add openssl-3-disable-hmac-hw-acceleration-with-engine-digest.patch
  * Add openssl-3-fix-hmac-digest-detection-s390x.patch
  * Add openssl-3-fix-memleak-s390x_HMAC_CTX_copy.patch</changelog>
  <changelog author="angel.yankov@suse.com" date="1730980800">- Add missing fixes for SHA3_squeeze and quic_multistream_test on
  pcc64 arch. [jsc#PED-10280]
  * Added openssl-3-fix-sha3-squeeze-ppc64.patch
  * Added openssl-3-fix-quic_multistream_test.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1731412800">- Do not use HASHBANGPERL to avoid introducing a dependency on the
  perl-base package. [bsc#1233235]</changelog>
  <changelog author="pmonreal@suse.com" date="1734436800">- Fix evp_properties section in the openssl.cnf file [bsc#1234647]
  * Rebase patches:
  - openssl-3-use-include-directive.patch
  - openssl-TESTS-Disable-default-provider-crypto-policies.patch</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1734955200">- Add support for userspace livepatching on ppc64le (jsc#PED-11850).
- Use gcc-13 for ppc64le.</changelog>
  <changelog author="lucas.mulling@suse.com" date="1738238400">- Security fix: [bsc#1236136, CVE-2024-13176]
  * Fix timing side-channel in ECDSA signature computation
  * Add openssl-CVE-2024-13176.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1739361600">- Security fix: [bsc#1236599, CVE-2024-12797]
  * RFC7250 handshakes with unauthenticated servers don't abort as
    expected.
  * Add openssl-CVE-2024-12797.patch</changelog>
  <changelog author="angel.yankov@suse.com" date="1746014400">- Security fix: [bsc#1240366, CVE-2025-27587]
  * Minerva side channel vulnerability in P-384 on PPC arch
  * Add openssl-3-p384-minerva-ppc.patch
  * Add openssl-3-p384-minerva-ppc-p9.patch</changelog>
  <changelog author="mls@suse.de" date="1751371200">- Backport mdless cms signing support [jsc#PED-12895]
  * Add openssl-3-support-mdless-cms.patch</changelog>
  <changelog author="lucas.mulling@suse.com" date="1752494400">- FIPS: Fix EMS in crypto-policies FIPS:NO-ENFORCE-EMS
  * [bsc#1230959, bsc#1232326, bsc#1231748, bsc#1246428]
  * Add patch openssl-FIPS-fix-EMS-support.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1753876800">- Increase limit for CRL download [bsc#1247148, bsc#1247144]
  * Add openssl-3-large-CRLs.patch</changelog>
  <changelog author="lucas.mulling@suse.com" date="1759233600">- Security fix: [bsc#1250232 CVE-2025-9230]
  * Fix out-of-bounds read &amp; write in RFC 3211 KEK unwrap
  * Add patch openssl3-CVE-2025-9230.patch</changelog>
  <changelog author="lucas.mulling@suse.com" date="1768824000">- Security fixes:
  * Missing ASN1_TYPE validation in PKCS#12 parsing
  - openssl-CVE-2026-22795.patch [bsc#1256839, CVE-2026-22795]
  * ASN1_TYPE Type Confusion in the PKCS7_digest_from_attributes() function
  - openssl-CVE-2026-22795.patch [bsc#1256840, CVE-2026-22796]
  * Missing ASN1_TYPE validation in TS_RESP_verify_response() function
  - openssl-CVE-2025-69420.patch [bsc#1256837, CVE-2025-69420]
  * NULL Pointer Dereference in PKCS12_item_decrypt_d2i_ex function
  - openssl-CVE-2025-69421.patch [bsc#1256838, CVE-2025-69421]
  * Out of bounds write in PKCS12_get_friendlyname() UTF-8 conversion
  - openssl-CVE-2025-69419.patch [bsc#1256836, CVE-2025-69419]
  * Heap out-of-bounds write in BIO_f_linebuffer on short writes
  - openssl-CVE-2025-68160.patch [bsc#1256834, CVE-2025-68160]
  * Unauthenticated/unencrypted trailing bytes with low-level OCB function calls
  - openssl-CVE-2025-69418.patch [bsc#1256835, CVE-2025-69418]
  * Stack buffer overflow in CMS AuthEnvelopedData parsing
  - openssl-CVE-2025-15467.patch [bsc#1256830, CVE-2025-15467]
  - openssl-CVE-2025-15467-comments.patch
  - openssl-CVE-2025-15467-test.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1774526400">- Security fixes:
  * CVE-2026-28387: Potential use-after-free in DANE client code
    (bsc#1260441)
  * CVE-2026-28388: NULL Pointer Dereference When Processing a
    Delta (bsc#1260442)
  * CVE-2026-28389: Possible NULL dereference when processing CMS
    KeyAgreeRecipientInfo (bsc#1260443)
  * CVE-2026-31789: Heap buffer overflow in hexadecimal conversion
    (bsc#1260444)
  * CVE-2026-31790: Incorrect failure handling in RSA KEM RSASVE
    encapsulation (bsc#1260445)
  * NULL pointer dereference when processing an OCSP response
    (bsc#1260446)
  * Add patches: openssl-CVE-2026-28387.patch
    openssl-CVE-2026-28388.patch openssl-CVE-2026-28388-tests.patch
    openssl-CVE-2026-28389.patch openssl-CVE-2026-31789.patch
    openssl-CVE-2026-31790.patch openssl-CVE-2026-31790-tests.patch
    openssl-NULL-pointer-dereference-in-ocsp_find_signer_sk.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1775649600">- Security fix:
  * CVE-2026-28390: NULL pointer dereference during processing of a crafted
    CMS EnvelopedData message with KeyTransportRecipientInfo (bsc#1261678)
  * Add openssl-CVE-2026-28390.patch</changelog>
  <changelog author="lucas.mulling@suse.com" date="1775822400">- Enable MD2 in legacy provider (jsc#PED-15724)</changelog>
</package>
<package pkgid="d2726cf6719a822a83a674157fb8a09ac7aca55803fba881da0295f2c3c496df" name="libopenssl3" arch="x86_64">
  <version epoch="0" ver="3.2.3" rel="150400.5.33.3"/>
  <changelog author="pmonreal@suse.com" date="1730116800">- Remove the hardcoded DEFAULT_SUSE cipherlist selection.
  * Remove openssl-DEFAULT_SUSE_cipher.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1730116801">- Update to 3.2.3:
  * Changes between 3.2.2 and 3.2.3:
  - Fixed possible denial of service in X.509 name checks. [CVE-2024-6119]
  - Fixed possible buffer overread in SSL_select_next_proto(). [CVE-2024-5535]
  * Changes between 3.2.1 and 3.2.2:
  - Fixed potential use after free after SSL_free_buffers() is called. [CVE-2024-4741]
  - Fixed an issue where checking excessively long DSA keys or parameters may
    be very slow. [CVE-2024-4603]
  - Improved EC/DSA nonce generation routines to avoid bias and timing
    side channel leaks.
  - Fixed an issue where some non-default TLS server configurations can cause
    unbounded memory growth when processing TLSv1.3 sessions. [CVE-2024-2511]
  - New atexit configuration switch, which controls whether the OPENSSL_cleanup
    is registered when libcrypto is unloaded. This can be used on platforms
    where using atexit() from shared libraries causes crashes on exit.
  - Fixed bug where SSL_export_keying_material() could not be used with QUIC
    connections.
  * Add openssl-skip-quic-pairwise.patch to adapt the pairwise tests.
  * Merge openssl-FIPS-release_num_in_version_string.patch into
    openssl-FIPS-services-minimize.patch
  * Rebase patches:
  - openssl-Add-changes-to-ectest-and-eccurve.patch
  - openssl-FIPS-140-3-keychecks.patch
  - openssl-FIPS-embed-hmac.patch
  - openssl-Remove-EC-curves.patch
  - openssl-skipped-tests-EC-curves.patch
  - openssl-FIPS-early-KATS.patch
  - openssl-Allow-disabling-of-SHA1-signatures.patch
  - openssl-3-FIPS-Deny-SHA-1-sigver-in-FIPS-provider.patch
  - openssl-FIPS-limit-rsa-encrypt.patch
  - openssl-FIPS-Use-OAEP-in-KATs-support-fixed-OAEP-seed.patch
  - openssl-FIPS-Use-digest_sign-digest_verify-in-self-test.patch
  - openssl-FIPS-140-3-DRBG.patch
  - openssl-FIPS-140-3-zeroization.patch
  - openssl-Add-FIPS-indicator-parameter-to-HKDF.patch
  - openssl-FIPS-Remove-X9.31-padding-from-FIPS-prov.patch
  - openssl-FIPS-Add-explicit-indicator-for-key-length.patch
  - openssl-pbkdf2-Set-minimum-password-length-of-8-bytes.patch
  - openssl-FIPS-signature-Add-indicator-for-PSS-salt-length.patch
  - openssl-3-FIPS-GCM-Implement-explicit-indicator-for-IV-gen.patch
  - openssl-FIPS-enforce-EMS-support.patch
  - openssl-3-jitterentropy-3.4.0.patch
  - openssl-3-use-include-directive.patch
  * Remove not needed patches:
  - openssl-Allow-SHA1-in-seclevel-2-if-rh-allow-sha1-signatures.patch
  - openssl-3-FIPS-PCT_rsa_keygen.patch</changelog>
  <changelog author="angel.yankov@suse.com" date="1730462400">- Support MSA 12 SHA3 on s390x [jsc#PED-10280]
  * Add openssl-3-add_EVP_DigestSqueeze_api.patch
  * Add openssl-3-support-multiple-sha3_squeeze_s390x.patch
  * Add openssl-3-add-xof-state-handling-s3_absorb.patch
  * Add openssl-3-fix-state-handling-sha3_absorb_s390x.patch
  * Add openssl-3-fix-state-handling-sha3_final_s390x.patch
  * Add openssl-3-fix-state-handling-shake_final_s390x.patch
  * Add openssl-3-fix-state-handling-keccak_final_s390x.patch
  * Add openssl-3-support-EVP_DigestSqueeze-in-digest-prov-s390x.patch
  * Add openssl-3-add-defines-CPACF-funcs.patch
  * Add openssl-3-add-hw-acceleration-hmac.patch
  * Add openssl-3-support-CPACF-sha3-shake-perf-improvement.patch
  * Add openssl-3-fix-s390x_sha3_absorb.patch
  * Add openssl-3-fix-s390x_shake_squeeze.patch</changelog>
  <changelog author="angel.yankov@suse.com" date="1730808000">- Support MSA 10 XTS on s390x [jsc#PED-10273]
  * s390x: Add hardware acceleration for full AES-XTS
  * Add openssl-3-hw-acceleration-aes-xts-s390x.patch</changelog>
  <changelog author="angel.yankov@suse.com" date="1730808001">- Support MSA 11 HMAC on s390x [jsc#PED-10274]
  * Add openssl-3-disable-hmac-hw-acceleration-with-engine-digest.patch
  * Add openssl-3-fix-hmac-digest-detection-s390x.patch
  * Add openssl-3-fix-memleak-s390x_HMAC_CTX_copy.patch</changelog>
  <changelog author="angel.yankov@suse.com" date="1730980800">- Add missing fixes for SHA3_squeeze and quic_multistream_test on
  pcc64 arch. [jsc#PED-10280]
  * Added openssl-3-fix-sha3-squeeze-ppc64.patch
  * Added openssl-3-fix-quic_multistream_test.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1731412800">- Do not use HASHBANGPERL to avoid introducing a dependency on the
  perl-base package. [bsc#1233235]</changelog>
  <changelog author="pmonreal@suse.com" date="1734436800">- Fix evp_properties section in the openssl.cnf file [bsc#1234647]
  * Rebase patches:
  - openssl-3-use-include-directive.patch
  - openssl-TESTS-Disable-default-provider-crypto-policies.patch</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1734955200">- Add support for userspace livepatching on ppc64le (jsc#PED-11850).
- Use gcc-13 for ppc64le.</changelog>
  <changelog author="lucas.mulling@suse.com" date="1738238400">- Security fix: [bsc#1236136, CVE-2024-13176]
  * Fix timing side-channel in ECDSA signature computation
  * Add openssl-CVE-2024-13176.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1739361600">- Security fix: [bsc#1236599, CVE-2024-12797]
  * RFC7250 handshakes with unauthenticated servers don't abort as
    expected.
  * Add openssl-CVE-2024-12797.patch</changelog>
  <changelog author="angel.yankov@suse.com" date="1746014400">- Security fix: [bsc#1240366, CVE-2025-27587]
  * Minerva side channel vulnerability in P-384 on PPC arch
  * Add openssl-3-p384-minerva-ppc.patch
  * Add openssl-3-p384-minerva-ppc-p9.patch</changelog>
  <changelog author="mls@suse.de" date="1751371200">- Backport mdless cms signing support [jsc#PED-12895]
  * Add openssl-3-support-mdless-cms.patch</changelog>
  <changelog author="lucas.mulling@suse.com" date="1752494400">- FIPS: Fix EMS in crypto-policies FIPS:NO-ENFORCE-EMS
  * [bsc#1230959, bsc#1232326, bsc#1231748, bsc#1246428]
  * Add patch openssl-FIPS-fix-EMS-support.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1753876800">- Increase limit for CRL download [bsc#1247148, bsc#1247144]
  * Add openssl-3-large-CRLs.patch</changelog>
  <changelog author="lucas.mulling@suse.com" date="1759233600">- Security fix: [bsc#1250232 CVE-2025-9230]
  * Fix out-of-bounds read &amp; write in RFC 3211 KEK unwrap
  * Add patch openssl3-CVE-2025-9230.patch</changelog>
  <changelog author="lucas.mulling@suse.com" date="1768824000">- Security fixes:
  * Missing ASN1_TYPE validation in PKCS#12 parsing
  - openssl-CVE-2026-22795.patch [bsc#1256839, CVE-2026-22795]
  * ASN1_TYPE Type Confusion in the PKCS7_digest_from_attributes() function
  - openssl-CVE-2026-22795.patch [bsc#1256840, CVE-2026-22796]
  * Missing ASN1_TYPE validation in TS_RESP_verify_response() function
  - openssl-CVE-2025-69420.patch [bsc#1256837, CVE-2025-69420]
  * NULL Pointer Dereference in PKCS12_item_decrypt_d2i_ex function
  - openssl-CVE-2025-69421.patch [bsc#1256838, CVE-2025-69421]
  * Out of bounds write in PKCS12_get_friendlyname() UTF-8 conversion
  - openssl-CVE-2025-69419.patch [bsc#1256836, CVE-2025-69419]
  * Heap out-of-bounds write in BIO_f_linebuffer on short writes
  - openssl-CVE-2025-68160.patch [bsc#1256834, CVE-2025-68160]
  * Unauthenticated/unencrypted trailing bytes with low-level OCB function calls
  - openssl-CVE-2025-69418.patch [bsc#1256835, CVE-2025-69418]
  * Stack buffer overflow in CMS AuthEnvelopedData parsing
  - openssl-CVE-2025-15467.patch [bsc#1256830, CVE-2025-15467]
  - openssl-CVE-2025-15467-comments.patch
  - openssl-CVE-2025-15467-test.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1774526400">- Security fixes:
  * CVE-2026-28387: Potential use-after-free in DANE client code
    (bsc#1260441)
  * CVE-2026-28388: NULL Pointer Dereference When Processing a
    Delta (bsc#1260442)
  * CVE-2026-28389: Possible NULL dereference when processing CMS
    KeyAgreeRecipientInfo (bsc#1260443)
  * CVE-2026-31789: Heap buffer overflow in hexadecimal conversion
    (bsc#1260444)
  * CVE-2026-31790: Incorrect failure handling in RSA KEM RSASVE
    encapsulation (bsc#1260445)
  * NULL pointer dereference when processing an OCSP response
    (bsc#1260446)
  * Add patches: openssl-CVE-2026-28387.patch
    openssl-CVE-2026-28388.patch openssl-CVE-2026-28388-tests.patch
    openssl-CVE-2026-28389.patch openssl-CVE-2026-31789.patch
    openssl-CVE-2026-31790.patch openssl-CVE-2026-31790-tests.patch
    openssl-NULL-pointer-dereference-in-ocsp_find_signer_sk.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1775649600">- Security fix:
  * CVE-2026-28390: NULL pointer dereference during processing of a crafted
    CMS EnvelopedData message with KeyTransportRecipientInfo (bsc#1261678)
  * Add openssl-CVE-2026-28390.patch</changelog>
  <changelog author="lucas.mulling@suse.com" date="1775822400">- Enable MD2 in legacy provider (jsc#PED-15724)</changelog>
</package>
<package pkgid="7abf5a15d4b9b42466bcb916a9c90d9a5ea3321c7297a74f83ec0f97fa29bb45" name="libopenssl3-debuginfo" arch="x86_64">
  <version epoch="0" ver="3.2.3" rel="150400.5.33.3"/>
  <changelog author="pmonreal@suse.com" date="1730116800">- Remove the hardcoded DEFAULT_SUSE cipherlist selection.
  * Remove openssl-DEFAULT_SUSE_cipher.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1730116801">- Update to 3.2.3:
  * Changes between 3.2.2 and 3.2.3:
  - Fixed possible denial of service in X.509 name checks. [CVE-2024-6119]
  - Fixed possible buffer overread in SSL_select_next_proto(). [CVE-2024-5535]
  * Changes between 3.2.1 and 3.2.2:
  - Fixed potential use after free after SSL_free_buffers() is called. [CVE-2024-4741]
  - Fixed an issue where checking excessively long DSA keys or parameters may
    be very slow. [CVE-2024-4603]
  - Improved EC/DSA nonce generation routines to avoid bias and timing
    side channel leaks.
  - Fixed an issue where some non-default TLS server configurations can cause
    unbounded memory growth when processing TLSv1.3 sessions. [CVE-2024-2511]
  - New atexit configuration switch, which controls whether the OPENSSL_cleanup
    is registered when libcrypto is unloaded. This can be used on platforms
    where using atexit() from shared libraries causes crashes on exit.
  - Fixed bug where SSL_export_keying_material() could not be used with QUIC
    connections.
  * Add openssl-skip-quic-pairwise.patch to adapt the pairwise tests.
  * Merge openssl-FIPS-release_num_in_version_string.patch into
    openssl-FIPS-services-minimize.patch
  * Rebase patches:
  - openssl-Add-changes-to-ectest-and-eccurve.patch
  - openssl-FIPS-140-3-keychecks.patch
  - openssl-FIPS-embed-hmac.patch
  - openssl-Remove-EC-curves.patch
  - openssl-skipped-tests-EC-curves.patch
  - openssl-FIPS-early-KATS.patch
  - openssl-Allow-disabling-of-SHA1-signatures.patch
  - openssl-3-FIPS-Deny-SHA-1-sigver-in-FIPS-provider.patch
  - openssl-FIPS-limit-rsa-encrypt.patch
  - openssl-FIPS-Use-OAEP-in-KATs-support-fixed-OAEP-seed.patch
  - openssl-FIPS-Use-digest_sign-digest_verify-in-self-test.patch
  - openssl-FIPS-140-3-DRBG.patch
  - openssl-FIPS-140-3-zeroization.patch
  - openssl-Add-FIPS-indicator-parameter-to-HKDF.patch
  - openssl-FIPS-Remove-X9.31-padding-from-FIPS-prov.patch
  - openssl-FIPS-Add-explicit-indicator-for-key-length.patch
  - openssl-pbkdf2-Set-minimum-password-length-of-8-bytes.patch
  - openssl-FIPS-signature-Add-indicator-for-PSS-salt-length.patch
  - openssl-3-FIPS-GCM-Implement-explicit-indicator-for-IV-gen.patch
  - openssl-FIPS-enforce-EMS-support.patch
  - openssl-3-jitterentropy-3.4.0.patch
  - openssl-3-use-include-directive.patch
  * Remove not needed patches:
  - openssl-Allow-SHA1-in-seclevel-2-if-rh-allow-sha1-signatures.patch
  - openssl-3-FIPS-PCT_rsa_keygen.patch</changelog>
  <changelog author="angel.yankov@suse.com" date="1730462400">- Support MSA 12 SHA3 on s390x [jsc#PED-10280]
  * Add openssl-3-add_EVP_DigestSqueeze_api.patch
  * Add openssl-3-support-multiple-sha3_squeeze_s390x.patch
  * Add openssl-3-add-xof-state-handling-s3_absorb.patch
  * Add openssl-3-fix-state-handling-sha3_absorb_s390x.patch
  * Add openssl-3-fix-state-handling-sha3_final_s390x.patch
  * Add openssl-3-fix-state-handling-shake_final_s390x.patch
  * Add openssl-3-fix-state-handling-keccak_final_s390x.patch
  * Add openssl-3-support-EVP_DigestSqueeze-in-digest-prov-s390x.patch
  * Add openssl-3-add-defines-CPACF-funcs.patch
  * Add openssl-3-add-hw-acceleration-hmac.patch
  * Add openssl-3-support-CPACF-sha3-shake-perf-improvement.patch
  * Add openssl-3-fix-s390x_sha3_absorb.patch
  * Add openssl-3-fix-s390x_shake_squeeze.patch</changelog>
  <changelog author="angel.yankov@suse.com" date="1730808000">- Support MSA 10 XTS on s390x [jsc#PED-10273]
  * s390x: Add hardware acceleration for full AES-XTS
  * Add openssl-3-hw-acceleration-aes-xts-s390x.patch</changelog>
  <changelog author="angel.yankov@suse.com" date="1730808001">- Support MSA 11 HMAC on s390x [jsc#PED-10274]
  * Add openssl-3-disable-hmac-hw-acceleration-with-engine-digest.patch
  * Add openssl-3-fix-hmac-digest-detection-s390x.patch
  * Add openssl-3-fix-memleak-s390x_HMAC_CTX_copy.patch</changelog>
  <changelog author="angel.yankov@suse.com" date="1730980800">- Add missing fixes for SHA3_squeeze and quic_multistream_test on
  pcc64 arch. [jsc#PED-10280]
  * Added openssl-3-fix-sha3-squeeze-ppc64.patch
  * Added openssl-3-fix-quic_multistream_test.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1731412800">- Do not use HASHBANGPERL to avoid introducing a dependency on the
  perl-base package. [bsc#1233235]</changelog>
  <changelog author="pmonreal@suse.com" date="1734436800">- Fix evp_properties section in the openssl.cnf file [bsc#1234647]
  * Rebase patches:
  - openssl-3-use-include-directive.patch
  - openssl-TESTS-Disable-default-provider-crypto-policies.patch</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1734955200">- Add support for userspace livepatching on ppc64le (jsc#PED-11850).
- Use gcc-13 for ppc64le.</changelog>
  <changelog author="lucas.mulling@suse.com" date="1738238400">- Security fix: [bsc#1236136, CVE-2024-13176]
  * Fix timing side-channel in ECDSA signature computation
  * Add openssl-CVE-2024-13176.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1739361600">- Security fix: [bsc#1236599, CVE-2024-12797]
  * RFC7250 handshakes with unauthenticated servers don't abort as
    expected.
  * Add openssl-CVE-2024-12797.patch</changelog>
  <changelog author="angel.yankov@suse.com" date="1746014400">- Security fix: [bsc#1240366, CVE-2025-27587]
  * Minerva side channel vulnerability in P-384 on PPC arch
  * Add openssl-3-p384-minerva-ppc.patch
  * Add openssl-3-p384-minerva-ppc-p9.patch</changelog>
  <changelog author="mls@suse.de" date="1751371200">- Backport mdless cms signing support [jsc#PED-12895]
  * Add openssl-3-support-mdless-cms.patch</changelog>
  <changelog author="lucas.mulling@suse.com" date="1752494400">- FIPS: Fix EMS in crypto-policies FIPS:NO-ENFORCE-EMS
  * [bsc#1230959, bsc#1232326, bsc#1231748, bsc#1246428]
  * Add patch openssl-FIPS-fix-EMS-support.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1753876800">- Increase limit for CRL download [bsc#1247148, bsc#1247144]
  * Add openssl-3-large-CRLs.patch</changelog>
  <changelog author="lucas.mulling@suse.com" date="1759233600">- Security fix: [bsc#1250232 CVE-2025-9230]
  * Fix out-of-bounds read &amp; write in RFC 3211 KEK unwrap
  * Add patch openssl3-CVE-2025-9230.patch</changelog>
  <changelog author="lucas.mulling@suse.com" date="1768824000">- Security fixes:
  * Missing ASN1_TYPE validation in PKCS#12 parsing
  - openssl-CVE-2026-22795.patch [bsc#1256839, CVE-2026-22795]
  * ASN1_TYPE Type Confusion in the PKCS7_digest_from_attributes() function
  - openssl-CVE-2026-22795.patch [bsc#1256840, CVE-2026-22796]
  * Missing ASN1_TYPE validation in TS_RESP_verify_response() function
  - openssl-CVE-2025-69420.patch [bsc#1256837, CVE-2025-69420]
  * NULL Pointer Dereference in PKCS12_item_decrypt_d2i_ex function
  - openssl-CVE-2025-69421.patch [bsc#1256838, CVE-2025-69421]
  * Out of bounds write in PKCS12_get_friendlyname() UTF-8 conversion
  - openssl-CVE-2025-69419.patch [bsc#1256836, CVE-2025-69419]
  * Heap out-of-bounds write in BIO_f_linebuffer on short writes
  - openssl-CVE-2025-68160.patch [bsc#1256834, CVE-2025-68160]
  * Unauthenticated/unencrypted trailing bytes with low-level OCB function calls
  - openssl-CVE-2025-69418.patch [bsc#1256835, CVE-2025-69418]
  * Stack buffer overflow in CMS AuthEnvelopedData parsing
  - openssl-CVE-2025-15467.patch [bsc#1256830, CVE-2025-15467]
  - openssl-CVE-2025-15467-comments.patch
  - openssl-CVE-2025-15467-test.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1774526400">- Security fixes:
  * CVE-2026-28387: Potential use-after-free in DANE client code
    (bsc#1260441)
  * CVE-2026-28388: NULL Pointer Dereference When Processing a
    Delta (bsc#1260442)
  * CVE-2026-28389: Possible NULL dereference when processing CMS
    KeyAgreeRecipientInfo (bsc#1260443)
  * CVE-2026-31789: Heap buffer overflow in hexadecimal conversion
    (bsc#1260444)
  * CVE-2026-31790: Incorrect failure handling in RSA KEM RSASVE
    encapsulation (bsc#1260445)
  * NULL pointer dereference when processing an OCSP response
    (bsc#1260446)
  * Add patches: openssl-CVE-2026-28387.patch
    openssl-CVE-2026-28388.patch openssl-CVE-2026-28388-tests.patch
    openssl-CVE-2026-28389.patch openssl-CVE-2026-31789.patch
    openssl-CVE-2026-31790.patch openssl-CVE-2026-31790-tests.patch
    openssl-NULL-pointer-dereference-in-ocsp_find_signer_sk.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1775649600">- Security fix:
  * CVE-2026-28390: NULL pointer dereference during processing of a crafted
    CMS EnvelopedData message with KeyTransportRecipientInfo (bsc#1261678)
  * Add openssl-CVE-2026-28390.patch</changelog>
  <changelog author="lucas.mulling@suse.com" date="1775822400">- Enable MD2 in legacy provider (jsc#PED-15724)</changelog>
</package>
<package pkgid="1d9dc0a35df86664378f2c01ebd50173df23b977057572fcc6c7026ce97123d0" name="libpulp" arch="src">
  <version epoch="0" ver="0.3.17" rel="150400.170.1"/>
  <changelog author="giuliano.belinassi@suse.com" date="1729252800">- Update package with libpulp-0.3.7
  - Fix fails due to realpath returning NULL in SLE-Micro.
  - Return insn_queue because of permission errors on /proc/self/mem.
  - Fix livepatch of malloc (bsc#1231727).</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1731585600">- Add SELinux policy for /var/livepatches (bsc#1228879).
- Update rpm-helper script for SLE Micro.</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1733313600">- Update rpm-helper script for SLE Micro (bsc#1228879).
- Update macros.userspace-livepatch for SLE Micro (bsc#1228879).
- Guard macros behind sle_version &gt;= 1600.</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1733572800">- Add timestamps on each message.</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1734004800">- Cleanup /var/livepatches on boot time.</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1734609600">- Update package with libpulp-0.3.8:
  - Fix livepatching failure in glibc 2.40.
- Force compilation with gcc-13 for SP7 and Tumbleweed (jsc#PED-10952).
- Add ppc64le as supported architecture (jsc#PED-10952).</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1736510400">- Disable build on ppc64le until gcc-13 pfe patch reaches SP7.</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1737115200">- Re-enable support for userspace livepatching in ppc64le (jsc#PED-11850).</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1738238400">- Update package with libpulp-0.3.9:
  - Fix limitation in ppc64le not being able to livepatch functions with more
    than 8 parameters (jsc#PED-11850).</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1739188800">- Update package with libpulp-0.3.10:
  - Fix livepatching on Debian systems.
  - Improve error message when ptrace_scope is active.
  - Avoid saving unecessary registers in ppc64le.
  - Fix failing tests when libpulp is loaded system-wide.
  - Correct TOC loading in ppc64le (jsc#PED-11850).</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1740484800">- Update package with libpulp-0.3.11:
  - Detect whenever the process was loaded in a custom starting address.
  - ulp_stack now allocates multiples of page size.
  - Fix livepatching of `malloc` in ppc64le (jsc#PED-11850).</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1743768000">- Update package with libpulp-0.3.12:
  - Remove TEXTRELs in ppc64le port (bsc#1239092).
  - Check for -msplit-patch-nops flag.</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1745928000">- Update package with libpulp-0.3.13:
  - Improve detection of -msplit-patch-nops flag (bsc#1240031).
  - Allow `trigger` to disable seccomp in target process while livepaching.
  - Make sure libpulp don't crash when calling libc.so.6 (bsc#1241897)</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1746014400">- Update package with libpulp-0.3.14:
  - Remove any linking to GLIBC_PRIVATE symbols.</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1750248000">- Update package with libpulp-0.3.15:
  - Fix race condition on ppc64le livepatching (bsc#1244263)
  - Fix SIGABRT when non-valid JSON is given at input (bsc#1243923)
  - Fix linking against libpthread on older versions of glibc for ppc64le.</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1756987200">- Update package with libpulp-0.3.16:
  - Improve `ulp &lt;command&gt; --help` (bsc#1243787).
  - Add support to glibc 2.42.</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1758110400">- Fix `ldconfig` constructing ld.so.cache in the new snapshot (bsc#1249417).</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1758542400">- Fix ld.so.conf being modified in SLE-16.</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1759406400">- Update package with libpulp-0.3.17:
  - Fix dlopen and dlmopen search paths (bsc#1250436).</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1769601600">- Update scripts to comply with Immutable Mode (jsc#PED-14756).</changelog>
</package>
<package pkgid="2c46b2947fc34dd18f80f82ff34ceef404086074ec5d6dfcc0476a020ffc3667" name="libpulp-debuginfo" arch="x86_64">
  <version epoch="0" ver="0.3.17" rel="150400.170.1"/>
  <changelog author="giuliano.belinassi@suse.com" date="1729252800">- Update package with libpulp-0.3.7
  - Fix fails due to realpath returning NULL in SLE-Micro.
  - Return insn_queue because of permission errors on /proc/self/mem.
  - Fix livepatch of malloc (bsc#1231727).</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1731585600">- Add SELinux policy for /var/livepatches (bsc#1228879).
- Update rpm-helper script for SLE Micro.</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1733313600">- Update rpm-helper script for SLE Micro (bsc#1228879).
- Update macros.userspace-livepatch for SLE Micro (bsc#1228879).
- Guard macros behind sle_version &gt;= 1600.</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1733572800">- Add timestamps on each message.</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1734004800">- Cleanup /var/livepatches on boot time.</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1734609600">- Update package with libpulp-0.3.8:
  - Fix livepatching failure in glibc 2.40.
- Force compilation with gcc-13 for SP7 and Tumbleweed (jsc#PED-10952).
- Add ppc64le as supported architecture (jsc#PED-10952).</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1736510400">- Disable build on ppc64le until gcc-13 pfe patch reaches SP7.</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1737115200">- Re-enable support for userspace livepatching in ppc64le (jsc#PED-11850).</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1738238400">- Update package with libpulp-0.3.9:
  - Fix limitation in ppc64le not being able to livepatch functions with more
    than 8 parameters (jsc#PED-11850).</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1739188800">- Update package with libpulp-0.3.10:
  - Fix livepatching on Debian systems.
  - Improve error message when ptrace_scope is active.
  - Avoid saving unecessary registers in ppc64le.
  - Fix failing tests when libpulp is loaded system-wide.
  - Correct TOC loading in ppc64le (jsc#PED-11850).</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1740484800">- Update package with libpulp-0.3.11:
  - Detect whenever the process was loaded in a custom starting address.
  - ulp_stack now allocates multiples of page size.
  - Fix livepatching of `malloc` in ppc64le (jsc#PED-11850).</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1743768000">- Update package with libpulp-0.3.12:
  - Remove TEXTRELs in ppc64le port (bsc#1239092).
  - Check for -msplit-patch-nops flag.</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1745928000">- Update package with libpulp-0.3.13:
  - Improve detection of -msplit-patch-nops flag (bsc#1240031).
  - Allow `trigger` to disable seccomp in target process while livepaching.
  - Make sure libpulp don't crash when calling libc.so.6 (bsc#1241897)</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1746014400">- Update package with libpulp-0.3.14:
  - Remove any linking to GLIBC_PRIVATE symbols.</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1750248000">- Update package with libpulp-0.3.15:
  - Fix race condition on ppc64le livepatching (bsc#1244263)
  - Fix SIGABRT when non-valid JSON is given at input (bsc#1243923)
  - Fix linking against libpthread on older versions of glibc for ppc64le.</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1756987200">- Update package with libpulp-0.3.16:
  - Improve `ulp &lt;command&gt; --help` (bsc#1243787).
  - Add support to glibc 2.42.</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1758110400">- Fix `ldconfig` constructing ld.so.cache in the new snapshot (bsc#1249417).</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1758542400">- Fix ld.so.conf being modified in SLE-16.</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1759406400">- Update package with libpulp-0.3.17:
  - Fix dlopen and dlmopen search paths (bsc#1250436).</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1769601600">- Update scripts to comply with Immutable Mode (jsc#PED-14756).</changelog>
</package>
<package pkgid="a0dd181e720ce46ddb4126926b48c59dfceaa1ab5dad6a3cf789a134abd25731" name="libpulp-debugsource" arch="x86_64">
  <version epoch="0" ver="0.3.17" rel="150400.170.1"/>
  <changelog author="giuliano.belinassi@suse.com" date="1729252800">- Update package with libpulp-0.3.7
  - Fix fails due to realpath returning NULL in SLE-Micro.
  - Return insn_queue because of permission errors on /proc/self/mem.
  - Fix livepatch of malloc (bsc#1231727).</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1731585600">- Add SELinux policy for /var/livepatches (bsc#1228879).
- Update rpm-helper script for SLE Micro.</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1733313600">- Update rpm-helper script for SLE Micro (bsc#1228879).
- Update macros.userspace-livepatch for SLE Micro (bsc#1228879).
- Guard macros behind sle_version &gt;= 1600.</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1733572800">- Add timestamps on each message.</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1734004800">- Cleanup /var/livepatches on boot time.</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1734609600">- Update package with libpulp-0.3.8:
  - Fix livepatching failure in glibc 2.40.
- Force compilation with gcc-13 for SP7 and Tumbleweed (jsc#PED-10952).
- Add ppc64le as supported architecture (jsc#PED-10952).</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1736510400">- Disable build on ppc64le until gcc-13 pfe patch reaches SP7.</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1737115200">- Re-enable support for userspace livepatching in ppc64le (jsc#PED-11850).</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1738238400">- Update package with libpulp-0.3.9:
  - Fix limitation in ppc64le not being able to livepatch functions with more
    than 8 parameters (jsc#PED-11850).</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1739188800">- Update package with libpulp-0.3.10:
  - Fix livepatching on Debian systems.
  - Improve error message when ptrace_scope is active.
  - Avoid saving unecessary registers in ppc64le.
  - Fix failing tests when libpulp is loaded system-wide.
  - Correct TOC loading in ppc64le (jsc#PED-11850).</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1740484800">- Update package with libpulp-0.3.11:
  - Detect whenever the process was loaded in a custom starting address.
  - ulp_stack now allocates multiples of page size.
  - Fix livepatching of `malloc` in ppc64le (jsc#PED-11850).</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1743768000">- Update package with libpulp-0.3.12:
  - Remove TEXTRELs in ppc64le port (bsc#1239092).
  - Check for -msplit-patch-nops flag.</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1745928000">- Update package with libpulp-0.3.13:
  - Improve detection of -msplit-patch-nops flag (bsc#1240031).
  - Allow `trigger` to disable seccomp in target process while livepaching.
  - Make sure libpulp don't crash when calling libc.so.6 (bsc#1241897)</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1746014400">- Update package with libpulp-0.3.14:
  - Remove any linking to GLIBC_PRIVATE symbols.</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1750248000">- Update package with libpulp-0.3.15:
  - Fix race condition on ppc64le livepatching (bsc#1244263)
  - Fix SIGABRT when non-valid JSON is given at input (bsc#1243923)
  - Fix linking against libpthread on older versions of glibc for ppc64le.</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1756987200">- Update package with libpulp-0.3.16:
  - Improve `ulp &lt;command&gt; --help` (bsc#1243787).
  - Add support to glibc 2.42.</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1758110400">- Fix `ldconfig` constructing ld.so.cache in the new snapshot (bsc#1249417).</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1758542400">- Fix ld.so.conf being modified in SLE-16.</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1759406400">- Update package with libpulp-0.3.17:
  - Fix dlopen and dlmopen search paths (bsc#1250436).</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1769601600">- Update scripts to comply with Immutable Mode (jsc#PED-14756).</changelog>
</package>
<package pkgid="9f3344ebe64b410b55ca9a4a7a38821b95cb2ef5d6587c33694f6bf87482390d" name="libpulp-load-default" arch="noarch">
  <version epoch="0" ver="0.1" rel="150400.2.1"/>
  <changelog author="giuliano.belinassi@suse.com" date="1680264000">- Initial package.
- Enable libpulp on all processes (jsc#PED-3867).</changelog>
</package>
<package pkgid="d644bb3fd9191767c81b12173b52d8a7f459cc1fcece221ef557b368aadf1366" name="libpulp-load-default" arch="src">
  <version epoch="0" ver="0.1" rel="150400.2.1"/>
  <changelog author="giuliano.belinassi@suse.com" date="1680264000">- Initial package.
- Enable libpulp on all processes (jsc#PED-3867).</changelog>
</package>
<package pkgid="9581db48d951fef258aa62a52aa43a5b6263864e5ae7841b68ddafe7ec4bad63" name="libpulp-tools" arch="x86_64">
  <version epoch="0" ver="0.3.17" rel="150400.170.1"/>
  <changelog author="giuliano.belinassi@suse.com" date="1729252800">- Update package with libpulp-0.3.7
  - Fix fails due to realpath returning NULL in SLE-Micro.
  - Return insn_queue because of permission errors on /proc/self/mem.
  - Fix livepatch of malloc (bsc#1231727).</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1731585600">- Add SELinux policy for /var/livepatches (bsc#1228879).
- Update rpm-helper script for SLE Micro.</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1733313600">- Update rpm-helper script for SLE Micro (bsc#1228879).
- Update macros.userspace-livepatch for SLE Micro (bsc#1228879).
- Guard macros behind sle_version &gt;= 1600.</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1733572800">- Add timestamps on each message.</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1734004800">- Cleanup /var/livepatches on boot time.</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1734609600">- Update package with libpulp-0.3.8:
  - Fix livepatching failure in glibc 2.40.
- Force compilation with gcc-13 for SP7 and Tumbleweed (jsc#PED-10952).
- Add ppc64le as supported architecture (jsc#PED-10952).</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1736510400">- Disable build on ppc64le until gcc-13 pfe patch reaches SP7.</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1737115200">- Re-enable support for userspace livepatching in ppc64le (jsc#PED-11850).</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1738238400">- Update package with libpulp-0.3.9:
  - Fix limitation in ppc64le not being able to livepatch functions with more
    than 8 parameters (jsc#PED-11850).</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1739188800">- Update package with libpulp-0.3.10:
  - Fix livepatching on Debian systems.
  - Improve error message when ptrace_scope is active.
  - Avoid saving unecessary registers in ppc64le.
  - Fix failing tests when libpulp is loaded system-wide.
  - Correct TOC loading in ppc64le (jsc#PED-11850).</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1740484800">- Update package with libpulp-0.3.11:
  - Detect whenever the process was loaded in a custom starting address.
  - ulp_stack now allocates multiples of page size.
  - Fix livepatching of `malloc` in ppc64le (jsc#PED-11850).</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1743768000">- Update package with libpulp-0.3.12:
  - Remove TEXTRELs in ppc64le port (bsc#1239092).
  - Check for -msplit-patch-nops flag.</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1745928000">- Update package with libpulp-0.3.13:
  - Improve detection of -msplit-patch-nops flag (bsc#1240031).
  - Allow `trigger` to disable seccomp in target process while livepaching.
  - Make sure libpulp don't crash when calling libc.so.6 (bsc#1241897)</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1746014400">- Update package with libpulp-0.3.14:
  - Remove any linking to GLIBC_PRIVATE symbols.</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1750248000">- Update package with libpulp-0.3.15:
  - Fix race condition on ppc64le livepatching (bsc#1244263)
  - Fix SIGABRT when non-valid JSON is given at input (bsc#1243923)
  - Fix linking against libpthread on older versions of glibc for ppc64le.</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1756987200">- Update package with libpulp-0.3.16:
  - Improve `ulp &lt;command&gt; --help` (bsc#1243787).
  - Add support to glibc 2.42.</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1758110400">- Fix `ldconfig` constructing ld.so.cache in the new snapshot (bsc#1249417).</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1758542400">- Fix ld.so.conf being modified in SLE-16.</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1759406400">- Update package with libpulp-0.3.17:
  - Fix dlopen and dlmopen search paths (bsc#1250436).</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1769601600">- Update scripts to comply with Immutable Mode (jsc#PED-14756).</changelog>
</package>
<package pkgid="4ad34d7d0b28ab50eb7760c616d07cc8453017da6fa20bf68a8cbc89340b1c3d" name="libpulp-tools-debuginfo" arch="x86_64">
  <version epoch="0" ver="0.3.17" rel="150400.170.1"/>
  <changelog author="giuliano.belinassi@suse.com" date="1729252800">- Update package with libpulp-0.3.7
  - Fix fails due to realpath returning NULL in SLE-Micro.
  - Return insn_queue because of permission errors on /proc/self/mem.
  - Fix livepatch of malloc (bsc#1231727).</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1731585600">- Add SELinux policy for /var/livepatches (bsc#1228879).
- Update rpm-helper script for SLE Micro.</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1733313600">- Update rpm-helper script for SLE Micro (bsc#1228879).
- Update macros.userspace-livepatch for SLE Micro (bsc#1228879).
- Guard macros behind sle_version &gt;= 1600.</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1733572800">- Add timestamps on each message.</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1734004800">- Cleanup /var/livepatches on boot time.</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1734609600">- Update package with libpulp-0.3.8:
  - Fix livepatching failure in glibc 2.40.
- Force compilation with gcc-13 for SP7 and Tumbleweed (jsc#PED-10952).
- Add ppc64le as supported architecture (jsc#PED-10952).</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1736510400">- Disable build on ppc64le until gcc-13 pfe patch reaches SP7.</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1737115200">- Re-enable support for userspace livepatching in ppc64le (jsc#PED-11850).</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1738238400">- Update package with libpulp-0.3.9:
  - Fix limitation in ppc64le not being able to livepatch functions with more
    than 8 parameters (jsc#PED-11850).</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1739188800">- Update package with libpulp-0.3.10:
  - Fix livepatching on Debian systems.
  - Improve error message when ptrace_scope is active.
  - Avoid saving unecessary registers in ppc64le.
  - Fix failing tests when libpulp is loaded system-wide.
  - Correct TOC loading in ppc64le (jsc#PED-11850).</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1740484800">- Update package with libpulp-0.3.11:
  - Detect whenever the process was loaded in a custom starting address.
  - ulp_stack now allocates multiples of page size.
  - Fix livepatching of `malloc` in ppc64le (jsc#PED-11850).</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1743768000">- Update package with libpulp-0.3.12:
  - Remove TEXTRELs in ppc64le port (bsc#1239092).
  - Check for -msplit-patch-nops flag.</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1745928000">- Update package with libpulp-0.3.13:
  - Improve detection of -msplit-patch-nops flag (bsc#1240031).
  - Allow `trigger` to disable seccomp in target process while livepaching.
  - Make sure libpulp don't crash when calling libc.so.6 (bsc#1241897)</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1746014400">- Update package with libpulp-0.3.14:
  - Remove any linking to GLIBC_PRIVATE symbols.</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1750248000">- Update package with libpulp-0.3.15:
  - Fix race condition on ppc64le livepatching (bsc#1244263)
  - Fix SIGABRT when non-valid JSON is given at input (bsc#1243923)
  - Fix linking against libpthread on older versions of glibc for ppc64le.</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1756987200">- Update package with libpulp-0.3.16:
  - Improve `ulp &lt;command&gt; --help` (bsc#1243787).
  - Add support to glibc 2.42.</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1758110400">- Fix `ldconfig` constructing ld.so.cache in the new snapshot (bsc#1249417).</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1758542400">- Fix ld.so.conf being modified in SLE-16.</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1759406400">- Update package with libpulp-0.3.17:
  - Fix dlopen and dlmopen search paths (bsc#1250436).</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1769601600">- Update scripts to comply with Immutable Mode (jsc#PED-14756).</changelog>
</package>
<package pkgid="bd973b0fa7a19331de368bd8af9788826fa5e563f2a8025aeec1bc348a42d335" name="libpulp0" arch="x86_64">
  <version epoch="0" ver="0.3.17" rel="150400.170.1"/>
  <changelog author="giuliano.belinassi@suse.com" date="1729252800">- Update package with libpulp-0.3.7
  - Fix fails due to realpath returning NULL in SLE-Micro.
  - Return insn_queue because of permission errors on /proc/self/mem.
  - Fix livepatch of malloc (bsc#1231727).</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1731585600">- Add SELinux policy for /var/livepatches (bsc#1228879).
- Update rpm-helper script for SLE Micro.</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1733313600">- Update rpm-helper script for SLE Micro (bsc#1228879).
- Update macros.userspace-livepatch for SLE Micro (bsc#1228879).
- Guard macros behind sle_version &gt;= 1600.</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1733572800">- Add timestamps on each message.</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1734004800">- Cleanup /var/livepatches on boot time.</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1734609600">- Update package with libpulp-0.3.8:
  - Fix livepatching failure in glibc 2.40.
- Force compilation with gcc-13 for SP7 and Tumbleweed (jsc#PED-10952).
- Add ppc64le as supported architecture (jsc#PED-10952).</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1736510400">- Disable build on ppc64le until gcc-13 pfe patch reaches SP7.</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1737115200">- Re-enable support for userspace livepatching in ppc64le (jsc#PED-11850).</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1738238400">- Update package with libpulp-0.3.9:
  - Fix limitation in ppc64le not being able to livepatch functions with more
    than 8 parameters (jsc#PED-11850).</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1739188800">- Update package with libpulp-0.3.10:
  - Fix livepatching on Debian systems.
  - Improve error message when ptrace_scope is active.
  - Avoid saving unecessary registers in ppc64le.
  - Fix failing tests when libpulp is loaded system-wide.
  - Correct TOC loading in ppc64le (jsc#PED-11850).</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1740484800">- Update package with libpulp-0.3.11:
  - Detect whenever the process was loaded in a custom starting address.
  - ulp_stack now allocates multiples of page size.
  - Fix livepatching of `malloc` in ppc64le (jsc#PED-11850).</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1743768000">- Update package with libpulp-0.3.12:
  - Remove TEXTRELs in ppc64le port (bsc#1239092).
  - Check for -msplit-patch-nops flag.</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1745928000">- Update package with libpulp-0.3.13:
  - Improve detection of -msplit-patch-nops flag (bsc#1240031).
  - Allow `trigger` to disable seccomp in target process while livepaching.
  - Make sure libpulp don't crash when calling libc.so.6 (bsc#1241897)</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1746014400">- Update package with libpulp-0.3.14:
  - Remove any linking to GLIBC_PRIVATE symbols.</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1750248000">- Update package with libpulp-0.3.15:
  - Fix race condition on ppc64le livepatching (bsc#1244263)
  - Fix SIGABRT when non-valid JSON is given at input (bsc#1243923)
  - Fix linking against libpthread on older versions of glibc for ppc64le.</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1756987200">- Update package with libpulp-0.3.16:
  - Improve `ulp &lt;command&gt; --help` (bsc#1243787).
  - Add support to glibc 2.42.</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1758110400">- Fix `ldconfig` constructing ld.so.cache in the new snapshot (bsc#1249417).</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1758542400">- Fix ld.so.conf being modified in SLE-16.</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1759406400">- Update package with libpulp-0.3.17:
  - Fix dlopen and dlmopen search paths (bsc#1250436).</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1769601600">- Update scripts to comply with Immutable Mode (jsc#PED-14756).</changelog>
</package>
<package pkgid="6a1dc0c1710e160c8f6d39c0184da59f7d1ba40fa60b8704bb28bc90bcd9caaf" name="libpulp0-debuginfo" arch="x86_64">
  <version epoch="0" ver="0.3.17" rel="150400.170.1"/>
  <changelog author="giuliano.belinassi@suse.com" date="1729252800">- Update package with libpulp-0.3.7
  - Fix fails due to realpath returning NULL in SLE-Micro.
  - Return insn_queue because of permission errors on /proc/self/mem.
  - Fix livepatch of malloc (bsc#1231727).</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1731585600">- Add SELinux policy for /var/livepatches (bsc#1228879).
- Update rpm-helper script for SLE Micro.</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1733313600">- Update rpm-helper script for SLE Micro (bsc#1228879).
- Update macros.userspace-livepatch for SLE Micro (bsc#1228879).
- Guard macros behind sle_version &gt;= 1600.</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1733572800">- Add timestamps on each message.</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1734004800">- Cleanup /var/livepatches on boot time.</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1734609600">- Update package with libpulp-0.3.8:
  - Fix livepatching failure in glibc 2.40.
- Force compilation with gcc-13 for SP7 and Tumbleweed (jsc#PED-10952).
- Add ppc64le as supported architecture (jsc#PED-10952).</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1736510400">- Disable build on ppc64le until gcc-13 pfe patch reaches SP7.</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1737115200">- Re-enable support for userspace livepatching in ppc64le (jsc#PED-11850).</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1738238400">- Update package with libpulp-0.3.9:
  - Fix limitation in ppc64le not being able to livepatch functions with more
    than 8 parameters (jsc#PED-11850).</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1739188800">- Update package with libpulp-0.3.10:
  - Fix livepatching on Debian systems.
  - Improve error message when ptrace_scope is active.
  - Avoid saving unecessary registers in ppc64le.
  - Fix failing tests when libpulp is loaded system-wide.
  - Correct TOC loading in ppc64le (jsc#PED-11850).</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1740484800">- Update package with libpulp-0.3.11:
  - Detect whenever the process was loaded in a custom starting address.
  - ulp_stack now allocates multiples of page size.
  - Fix livepatching of `malloc` in ppc64le (jsc#PED-11850).</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1743768000">- Update package with libpulp-0.3.12:
  - Remove TEXTRELs in ppc64le port (bsc#1239092).
  - Check for -msplit-patch-nops flag.</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1745928000">- Update package with libpulp-0.3.13:
  - Improve detection of -msplit-patch-nops flag (bsc#1240031).
  - Allow `trigger` to disable seccomp in target process while livepaching.
  - Make sure libpulp don't crash when calling libc.so.6 (bsc#1241897)</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1746014400">- Update package with libpulp-0.3.14:
  - Remove any linking to GLIBC_PRIVATE symbols.</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1750248000">- Update package with libpulp-0.3.15:
  - Fix race condition on ppc64le livepatching (bsc#1244263)
  - Fix SIGABRT when non-valid JSON is given at input (bsc#1243923)
  - Fix linking against libpthread on older versions of glibc for ppc64le.</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1756987200">- Update package with libpulp-0.3.16:
  - Improve `ulp &lt;command&gt; --help` (bsc#1243787).
  - Add support to glibc 2.42.</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1758110400">- Fix `ldconfig` constructing ld.so.cache in the new snapshot (bsc#1249417).</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1758542400">- Fix ld.so.conf being modified in SLE-16.</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1759406400">- Update package with libpulp-0.3.17:
  - Fix dlopen and dlmopen search paths (bsc#1250436).</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1769601600">- Update scripts to comply with Immutable Mode (jsc#PED-14756).</changelog>
</package>
<package pkgid="6bb884f7e6da98ac85983d94990b6210429cdeb5c720a91921b5b72f4562c2e7" name="openssl-1_1-livepatches" arch="src">
  <version epoch="0" ver="0" rel="150400.7.8"/>
  <changelog author="gagomes@suse.de" date="1598616000">- Initial package</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1633089600">- Get package to patch a process.</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1633348800">- Fix minor bugs in ulp_apply</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1635249600">- Remove non-livepatchable libraries which were included for testing</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1643112000">- Integrate first livepatch example into the packaging system.</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1648641600">- Update package to comply with libpulp 0.2.0</changelog>
</package>
<package pkgid="bd18f64a9ff3769ce67791cf328b444ba85f475baccc00173560073442225e01" name="openssl-1_1-livepatches" arch="x86_64">
  <version epoch="0" ver="0" rel="150400.7.8"/>
  <changelog author="gagomes@suse.de" date="1598616000">- Initial package</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1633089600">- Get package to patch a process.</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1633348800">- Fix minor bugs in ulp_apply</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1635249600">- Remove non-livepatchable libraries which were included for testing</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1643112000">- Integrate first livepatch example into the packaging system.</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1648641600">- Update package to comply with libpulp 0.2.0</changelog>
</package>
<package pkgid="dbb375d73e506cbe208a1db032d2f18338ca900263bc97bcb09810479e743f2f" name="openssl-1_1-livepatches" arch="src">
  <version epoch="0" ver="0.4" rel="150400.5.5"/>
  <changelog author="giuliano.belinassi@suse.com" date="1635508800">- Create empty openssl-livepatch package</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1674734400">- Create livepatch for CVE-2023-0286 (SLE-15-SP4).</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1700136000">- Fix CVE-2023-5678 (bsc#1217151).
- Report livepatch number on OpenSSL_version (jsc#7092).</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1700136001">- Ensure that livepatches are only installed when fixed version of
  library is available (bsc#1208755).</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1716120000">- Fix building process to include functions of older livepatches
  correctly (bsc#1224458)'.</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1717848000">- Add livepatch for CVE-2024-4741 (bsc#1225552).
- Drop trigger rules for very old libpulp-tools package.</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1719489600">- Use strong externalization for ossl_statem_fatal.</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1719489601">- Use strong externalization for ssl3_setup_read_buffer and
  ssl3_release_read_buffer</changelog>
</package>
<package pkgid="993380b15b841c7aacbadc4e221ea9d3653fb11442f4c23431fa9e50431ca3d8" name="openssl-1_1-livepatches" arch="x86_64">
  <version epoch="0" ver="0.4" rel="150400.5.5"/>
  <changelog author="giuliano.belinassi@suse.com" date="1635508800">- Create empty openssl-livepatch package</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1674734400">- Create livepatch for CVE-2023-0286 (SLE-15-SP4).</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1700136000">- Fix CVE-2023-5678 (bsc#1217151).
- Report livepatch number on OpenSSL_version (jsc#7092).</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1700136001">- Ensure that livepatches are only installed when fixed version of
  library is available (bsc#1208755).</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1716120000">- Fix building process to include functions of older livepatches
  correctly (bsc#1224458)'.</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1717848000">- Add livepatch for CVE-2024-4741 (bsc#1225552).
- Drop trigger rules for very old libpulp-tools package.</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1719489600">- Use strong externalization for ossl_statem_fatal.</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1719489601">- Use strong externalization for ssl3_setup_read_buffer and
  ssl3_release_read_buffer</changelog>
</package>
<package pkgid="7a0f7fd840da1b178e5f4626501f47884c13f217236b8b741c1f09ba5dd7eea6" name="openssl-1_1-livepatches-debuginfo" arch="x86_64">
  <version epoch="0" ver="0" rel="150400.7.8"/>
  <changelog author="gagomes@suse.de" date="1598616000">- Initial package</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1633089600">- Get package to patch a process.</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1633348800">- Fix minor bugs in ulp_apply</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1635249600">- Remove non-livepatchable libraries which were included for testing</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1643112000">- Integrate first livepatch example into the packaging system.</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1648641600">- Update package to comply with libpulp 0.2.0</changelog>
</package>
<package pkgid="2cc84fc7b23512a35e44aa9b11953d598c25cd939fe3c80a900151c7f33d6ac3" name="openssl-1_1-livepatches-debuginfo" arch="x86_64">
  <version epoch="0" ver="0.4" rel="150400.5.5"/>
  <changelog author="giuliano.belinassi@suse.com" date="1635508800">- Create empty openssl-livepatch package</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1674734400">- Create livepatch for CVE-2023-0286 (SLE-15-SP4).</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1700136000">- Fix CVE-2023-5678 (bsc#1217151).
- Report livepatch number on OpenSSL_version (jsc#7092).</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1700136001">- Ensure that livepatches are only installed when fixed version of
  library is available (bsc#1208755).</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1716120000">- Fix building process to include functions of older livepatches
  correctly (bsc#1224458)'.</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1717848000">- Add livepatch for CVE-2024-4741 (bsc#1225552).
- Drop trigger rules for very old libpulp-tools package.</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1719489600">- Use strong externalization for ossl_statem_fatal.</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1719489601">- Use strong externalization for ssl3_setup_read_buffer and
  ssl3_release_read_buffer</changelog>
</package>
<package pkgid="28908626762664f5c87c4b7b49e9f1cfba67d848c6948d1f3d9cea79ba67a10a" name="openssl-1_1-livepatches-debugsource" arch="x86_64">
  <version epoch="0" ver="0.4" rel="150400.5.5"/>
  <changelog author="giuliano.belinassi@suse.com" date="1635508800">- Create empty openssl-livepatch package</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1674734400">- Create livepatch for CVE-2023-0286 (SLE-15-SP4).</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1700136000">- Fix CVE-2023-5678 (bsc#1217151).
- Report livepatch number on OpenSSL_version (jsc#7092).</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1700136001">- Ensure that livepatches are only installed when fixed version of
  library is available (bsc#1208755).</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1716120000">- Fix building process to include functions of older livepatches
  correctly (bsc#1224458)'.</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1717848000">- Add livepatch for CVE-2024-4741 (bsc#1225552).
- Drop trigger rules for very old libpulp-tools package.</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1719489600">- Use strong externalization for ossl_statem_fatal.</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1719489601">- Use strong externalization for ssl3_setup_read_buffer and
  ssl3_release_read_buffer</changelog>
</package>
<package pkgid="319f444e98e266f1a5966b8349fc1e2ca2274fa8e35208c375d18c8b380f275c" name="openssl-3" arch="src">
  <version epoch="0" ver="3.2.3" rel="150400.5.33.3"/>
  <changelog author="pmonreal@suse.com" date="1730116800">- Remove the hardcoded DEFAULT_SUSE cipherlist selection.
  * Remove openssl-DEFAULT_SUSE_cipher.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1730116801">- Update to 3.2.3:
  * Changes between 3.2.2 and 3.2.3:
  - Fixed possible denial of service in X.509 name checks. [CVE-2024-6119]
  - Fixed possible buffer overread in SSL_select_next_proto(). [CVE-2024-5535]
  * Changes between 3.2.1 and 3.2.2:
  - Fixed potential use after free after SSL_free_buffers() is called. [CVE-2024-4741]
  - Fixed an issue where checking excessively long DSA keys or parameters may
    be very slow. [CVE-2024-4603]
  - Improved EC/DSA nonce generation routines to avoid bias and timing
    side channel leaks.
  - Fixed an issue where some non-default TLS server configurations can cause
    unbounded memory growth when processing TLSv1.3 sessions. [CVE-2024-2511]
  - New atexit configuration switch, which controls whether the OPENSSL_cleanup
    is registered when libcrypto is unloaded. This can be used on platforms
    where using atexit() from shared libraries causes crashes on exit.
  - Fixed bug where SSL_export_keying_material() could not be used with QUIC
    connections.
  * Add openssl-skip-quic-pairwise.patch to adapt the pairwise tests.
  * Merge openssl-FIPS-release_num_in_version_string.patch into
    openssl-FIPS-services-minimize.patch
  * Rebase patches:
  - openssl-Add-changes-to-ectest-and-eccurve.patch
  - openssl-FIPS-140-3-keychecks.patch
  - openssl-FIPS-embed-hmac.patch
  - openssl-Remove-EC-curves.patch
  - openssl-skipped-tests-EC-curves.patch
  - openssl-FIPS-early-KATS.patch
  - openssl-Allow-disabling-of-SHA1-signatures.patch
  - openssl-3-FIPS-Deny-SHA-1-sigver-in-FIPS-provider.patch
  - openssl-FIPS-limit-rsa-encrypt.patch
  - openssl-FIPS-Use-OAEP-in-KATs-support-fixed-OAEP-seed.patch
  - openssl-FIPS-Use-digest_sign-digest_verify-in-self-test.patch
  - openssl-FIPS-140-3-DRBG.patch
  - openssl-FIPS-140-3-zeroization.patch
  - openssl-Add-FIPS-indicator-parameter-to-HKDF.patch
  - openssl-FIPS-Remove-X9.31-padding-from-FIPS-prov.patch
  - openssl-FIPS-Add-explicit-indicator-for-key-length.patch
  - openssl-pbkdf2-Set-minimum-password-length-of-8-bytes.patch
  - openssl-FIPS-signature-Add-indicator-for-PSS-salt-length.patch
  - openssl-3-FIPS-GCM-Implement-explicit-indicator-for-IV-gen.patch
  - openssl-FIPS-enforce-EMS-support.patch
  - openssl-3-jitterentropy-3.4.0.patch
  - openssl-3-use-include-directive.patch
  * Remove not needed patches:
  - openssl-Allow-SHA1-in-seclevel-2-if-rh-allow-sha1-signatures.patch
  - openssl-3-FIPS-PCT_rsa_keygen.patch</changelog>
  <changelog author="angel.yankov@suse.com" date="1730462400">- Support MSA 12 SHA3 on s390x [jsc#PED-10280]
  * Add openssl-3-add_EVP_DigestSqueeze_api.patch
  * Add openssl-3-support-multiple-sha3_squeeze_s390x.patch
  * Add openssl-3-add-xof-state-handling-s3_absorb.patch
  * Add openssl-3-fix-state-handling-sha3_absorb_s390x.patch
  * Add openssl-3-fix-state-handling-sha3_final_s390x.patch
  * Add openssl-3-fix-state-handling-shake_final_s390x.patch
  * Add openssl-3-fix-state-handling-keccak_final_s390x.patch
  * Add openssl-3-support-EVP_DigestSqueeze-in-digest-prov-s390x.patch
  * Add openssl-3-add-defines-CPACF-funcs.patch
  * Add openssl-3-add-hw-acceleration-hmac.patch
  * Add openssl-3-support-CPACF-sha3-shake-perf-improvement.patch
  * Add openssl-3-fix-s390x_sha3_absorb.patch
  * Add openssl-3-fix-s390x_shake_squeeze.patch</changelog>
  <changelog author="angel.yankov@suse.com" date="1730808000">- Support MSA 10 XTS on s390x [jsc#PED-10273]
  * s390x: Add hardware acceleration for full AES-XTS
  * Add openssl-3-hw-acceleration-aes-xts-s390x.patch</changelog>
  <changelog author="angel.yankov@suse.com" date="1730808001">- Support MSA 11 HMAC on s390x [jsc#PED-10274]
  * Add openssl-3-disable-hmac-hw-acceleration-with-engine-digest.patch
  * Add openssl-3-fix-hmac-digest-detection-s390x.patch
  * Add openssl-3-fix-memleak-s390x_HMAC_CTX_copy.patch</changelog>
  <changelog author="angel.yankov@suse.com" date="1730980800">- Add missing fixes for SHA3_squeeze and quic_multistream_test on
  pcc64 arch. [jsc#PED-10280]
  * Added openssl-3-fix-sha3-squeeze-ppc64.patch
  * Added openssl-3-fix-quic_multistream_test.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1731412800">- Do not use HASHBANGPERL to avoid introducing a dependency on the
  perl-base package. [bsc#1233235]</changelog>
  <changelog author="pmonreal@suse.com" date="1734436800">- Fix evp_properties section in the openssl.cnf file [bsc#1234647]
  * Rebase patches:
  - openssl-3-use-include-directive.patch
  - openssl-TESTS-Disable-default-provider-crypto-policies.patch</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1734955200">- Add support for userspace livepatching on ppc64le (jsc#PED-11850).
- Use gcc-13 for ppc64le.</changelog>
  <changelog author="lucas.mulling@suse.com" date="1738238400">- Security fix: [bsc#1236136, CVE-2024-13176]
  * Fix timing side-channel in ECDSA signature computation
  * Add openssl-CVE-2024-13176.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1739361600">- Security fix: [bsc#1236599, CVE-2024-12797]
  * RFC7250 handshakes with unauthenticated servers don't abort as
    expected.
  * Add openssl-CVE-2024-12797.patch</changelog>
  <changelog author="angel.yankov@suse.com" date="1746014400">- Security fix: [bsc#1240366, CVE-2025-27587]
  * Minerva side channel vulnerability in P-384 on PPC arch
  * Add openssl-3-p384-minerva-ppc.patch
  * Add openssl-3-p384-minerva-ppc-p9.patch</changelog>
  <changelog author="mls@suse.de" date="1751371200">- Backport mdless cms signing support [jsc#PED-12895]
  * Add openssl-3-support-mdless-cms.patch</changelog>
  <changelog author="lucas.mulling@suse.com" date="1752494400">- FIPS: Fix EMS in crypto-policies FIPS:NO-ENFORCE-EMS
  * [bsc#1230959, bsc#1232326, bsc#1231748, bsc#1246428]
  * Add patch openssl-FIPS-fix-EMS-support.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1753876800">- Increase limit for CRL download [bsc#1247148, bsc#1247144]
  * Add openssl-3-large-CRLs.patch</changelog>
  <changelog author="lucas.mulling@suse.com" date="1759233600">- Security fix: [bsc#1250232 CVE-2025-9230]
  * Fix out-of-bounds read &amp; write in RFC 3211 KEK unwrap
  * Add patch openssl3-CVE-2025-9230.patch</changelog>
  <changelog author="lucas.mulling@suse.com" date="1768824000">- Security fixes:
  * Missing ASN1_TYPE validation in PKCS#12 parsing
  - openssl-CVE-2026-22795.patch [bsc#1256839, CVE-2026-22795]
  * ASN1_TYPE Type Confusion in the PKCS7_digest_from_attributes() function
  - openssl-CVE-2026-22795.patch [bsc#1256840, CVE-2026-22796]
  * Missing ASN1_TYPE validation in TS_RESP_verify_response() function
  - openssl-CVE-2025-69420.patch [bsc#1256837, CVE-2025-69420]
  * NULL Pointer Dereference in PKCS12_item_decrypt_d2i_ex function
  - openssl-CVE-2025-69421.patch [bsc#1256838, CVE-2025-69421]
  * Out of bounds write in PKCS12_get_friendlyname() UTF-8 conversion
  - openssl-CVE-2025-69419.patch [bsc#1256836, CVE-2025-69419]
  * Heap out-of-bounds write in BIO_f_linebuffer on short writes
  - openssl-CVE-2025-68160.patch [bsc#1256834, CVE-2025-68160]
  * Unauthenticated/unencrypted trailing bytes with low-level OCB function calls
  - openssl-CVE-2025-69418.patch [bsc#1256835, CVE-2025-69418]
  * Stack buffer overflow in CMS AuthEnvelopedData parsing
  - openssl-CVE-2025-15467.patch [bsc#1256830, CVE-2025-15467]
  - openssl-CVE-2025-15467-comments.patch
  - openssl-CVE-2025-15467-test.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1774526400">- Security fixes:
  * CVE-2026-28387: Potential use-after-free in DANE client code
    (bsc#1260441)
  * CVE-2026-28388: NULL Pointer Dereference When Processing a
    Delta (bsc#1260442)
  * CVE-2026-28389: Possible NULL dereference when processing CMS
    KeyAgreeRecipientInfo (bsc#1260443)
  * CVE-2026-31789: Heap buffer overflow in hexadecimal conversion
    (bsc#1260444)
  * CVE-2026-31790: Incorrect failure handling in RSA KEM RSASVE
    encapsulation (bsc#1260445)
  * NULL pointer dereference when processing an OCSP response
    (bsc#1260446)
  * Add patches: openssl-CVE-2026-28387.patch
    openssl-CVE-2026-28388.patch openssl-CVE-2026-28388-tests.patch
    openssl-CVE-2026-28389.patch openssl-CVE-2026-31789.patch
    openssl-CVE-2026-31790.patch openssl-CVE-2026-31790-tests.patch
    openssl-NULL-pointer-dereference-in-ocsp_find_signer_sk.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1775649600">- Security fix:
  * CVE-2026-28390: NULL pointer dereference during processing of a crafted
    CMS EnvelopedData message with KeyTransportRecipientInfo (bsc#1261678)
  * Add openssl-CVE-2026-28390.patch</changelog>
  <changelog author="lucas.mulling@suse.com" date="1775822400">- Enable MD2 in legacy provider (jsc#PED-15724)</changelog>
</package>
<package pkgid="4a4413c3fa6d226db03c662a9697afffdf541b585caf6b47b22ef4e5bb1c01ee" name="openssl-3" arch="x86_64">
  <version epoch="0" ver="3.2.3" rel="150400.5.33.3"/>
  <changelog author="pmonreal@suse.com" date="1730116800">- Remove the hardcoded DEFAULT_SUSE cipherlist selection.
  * Remove openssl-DEFAULT_SUSE_cipher.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1730116801">- Update to 3.2.3:
  * Changes between 3.2.2 and 3.2.3:
  - Fixed possible denial of service in X.509 name checks. [CVE-2024-6119]
  - Fixed possible buffer overread in SSL_select_next_proto(). [CVE-2024-5535]
  * Changes between 3.2.1 and 3.2.2:
  - Fixed potential use after free after SSL_free_buffers() is called. [CVE-2024-4741]
  - Fixed an issue where checking excessively long DSA keys or parameters may
    be very slow. [CVE-2024-4603]
  - Improved EC/DSA nonce generation routines to avoid bias and timing
    side channel leaks.
  - Fixed an issue where some non-default TLS server configurations can cause
    unbounded memory growth when processing TLSv1.3 sessions. [CVE-2024-2511]
  - New atexit configuration switch, which controls whether the OPENSSL_cleanup
    is registered when libcrypto is unloaded. This can be used on platforms
    where using atexit() from shared libraries causes crashes on exit.
  - Fixed bug where SSL_export_keying_material() could not be used with QUIC
    connections.
  * Add openssl-skip-quic-pairwise.patch to adapt the pairwise tests.
  * Merge openssl-FIPS-release_num_in_version_string.patch into
    openssl-FIPS-services-minimize.patch
  * Rebase patches:
  - openssl-Add-changes-to-ectest-and-eccurve.patch
  - openssl-FIPS-140-3-keychecks.patch
  - openssl-FIPS-embed-hmac.patch
  - openssl-Remove-EC-curves.patch
  - openssl-skipped-tests-EC-curves.patch
  - openssl-FIPS-early-KATS.patch
  - openssl-Allow-disabling-of-SHA1-signatures.patch
  - openssl-3-FIPS-Deny-SHA-1-sigver-in-FIPS-provider.patch
  - openssl-FIPS-limit-rsa-encrypt.patch
  - openssl-FIPS-Use-OAEP-in-KATs-support-fixed-OAEP-seed.patch
  - openssl-FIPS-Use-digest_sign-digest_verify-in-self-test.patch
  - openssl-FIPS-140-3-DRBG.patch
  - openssl-FIPS-140-3-zeroization.patch
  - openssl-Add-FIPS-indicator-parameter-to-HKDF.patch
  - openssl-FIPS-Remove-X9.31-padding-from-FIPS-prov.patch
  - openssl-FIPS-Add-explicit-indicator-for-key-length.patch
  - openssl-pbkdf2-Set-minimum-password-length-of-8-bytes.patch
  - openssl-FIPS-signature-Add-indicator-for-PSS-salt-length.patch
  - openssl-3-FIPS-GCM-Implement-explicit-indicator-for-IV-gen.patch
  - openssl-FIPS-enforce-EMS-support.patch
  - openssl-3-jitterentropy-3.4.0.patch
  - openssl-3-use-include-directive.patch
  * Remove not needed patches:
  - openssl-Allow-SHA1-in-seclevel-2-if-rh-allow-sha1-signatures.patch
  - openssl-3-FIPS-PCT_rsa_keygen.patch</changelog>
  <changelog author="angel.yankov@suse.com" date="1730462400">- Support MSA 12 SHA3 on s390x [jsc#PED-10280]
  * Add openssl-3-add_EVP_DigestSqueeze_api.patch
  * Add openssl-3-support-multiple-sha3_squeeze_s390x.patch
  * Add openssl-3-add-xof-state-handling-s3_absorb.patch
  * Add openssl-3-fix-state-handling-sha3_absorb_s390x.patch
  * Add openssl-3-fix-state-handling-sha3_final_s390x.patch
  * Add openssl-3-fix-state-handling-shake_final_s390x.patch
  * Add openssl-3-fix-state-handling-keccak_final_s390x.patch
  * Add openssl-3-support-EVP_DigestSqueeze-in-digest-prov-s390x.patch
  * Add openssl-3-add-defines-CPACF-funcs.patch
  * Add openssl-3-add-hw-acceleration-hmac.patch
  * Add openssl-3-support-CPACF-sha3-shake-perf-improvement.patch
  * Add openssl-3-fix-s390x_sha3_absorb.patch
  * Add openssl-3-fix-s390x_shake_squeeze.patch</changelog>
  <changelog author="angel.yankov@suse.com" date="1730808000">- Support MSA 10 XTS on s390x [jsc#PED-10273]
  * s390x: Add hardware acceleration for full AES-XTS
  * Add openssl-3-hw-acceleration-aes-xts-s390x.patch</changelog>
  <changelog author="angel.yankov@suse.com" date="1730808001">- Support MSA 11 HMAC on s390x [jsc#PED-10274]
  * Add openssl-3-disable-hmac-hw-acceleration-with-engine-digest.patch
  * Add openssl-3-fix-hmac-digest-detection-s390x.patch
  * Add openssl-3-fix-memleak-s390x_HMAC_CTX_copy.patch</changelog>
  <changelog author="angel.yankov@suse.com" date="1730980800">- Add missing fixes for SHA3_squeeze and quic_multistream_test on
  pcc64 arch. [jsc#PED-10280]
  * Added openssl-3-fix-sha3-squeeze-ppc64.patch
  * Added openssl-3-fix-quic_multistream_test.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1731412800">- Do not use HASHBANGPERL to avoid introducing a dependency on the
  perl-base package. [bsc#1233235]</changelog>
  <changelog author="pmonreal@suse.com" date="1734436800">- Fix evp_properties section in the openssl.cnf file [bsc#1234647]
  * Rebase patches:
  - openssl-3-use-include-directive.patch
  - openssl-TESTS-Disable-default-provider-crypto-policies.patch</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1734955200">- Add support for userspace livepatching on ppc64le (jsc#PED-11850).
- Use gcc-13 for ppc64le.</changelog>
  <changelog author="lucas.mulling@suse.com" date="1738238400">- Security fix: [bsc#1236136, CVE-2024-13176]
  * Fix timing side-channel in ECDSA signature computation
  * Add openssl-CVE-2024-13176.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1739361600">- Security fix: [bsc#1236599, CVE-2024-12797]
  * RFC7250 handshakes with unauthenticated servers don't abort as
    expected.
  * Add openssl-CVE-2024-12797.patch</changelog>
  <changelog author="angel.yankov@suse.com" date="1746014400">- Security fix: [bsc#1240366, CVE-2025-27587]
  * Minerva side channel vulnerability in P-384 on PPC arch
  * Add openssl-3-p384-minerva-ppc.patch
  * Add openssl-3-p384-minerva-ppc-p9.patch</changelog>
  <changelog author="mls@suse.de" date="1751371200">- Backport mdless cms signing support [jsc#PED-12895]
  * Add openssl-3-support-mdless-cms.patch</changelog>
  <changelog author="lucas.mulling@suse.com" date="1752494400">- FIPS: Fix EMS in crypto-policies FIPS:NO-ENFORCE-EMS
  * [bsc#1230959, bsc#1232326, bsc#1231748, bsc#1246428]
  * Add patch openssl-FIPS-fix-EMS-support.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1753876800">- Increase limit for CRL download [bsc#1247148, bsc#1247144]
  * Add openssl-3-large-CRLs.patch</changelog>
  <changelog author="lucas.mulling@suse.com" date="1759233600">- Security fix: [bsc#1250232 CVE-2025-9230]
  * Fix out-of-bounds read &amp; write in RFC 3211 KEK unwrap
  * Add patch openssl3-CVE-2025-9230.patch</changelog>
  <changelog author="lucas.mulling@suse.com" date="1768824000">- Security fixes:
  * Missing ASN1_TYPE validation in PKCS#12 parsing
  - openssl-CVE-2026-22795.patch [bsc#1256839, CVE-2026-22795]
  * ASN1_TYPE Type Confusion in the PKCS7_digest_from_attributes() function
  - openssl-CVE-2026-22795.patch [bsc#1256840, CVE-2026-22796]
  * Missing ASN1_TYPE validation in TS_RESP_verify_response() function
  - openssl-CVE-2025-69420.patch [bsc#1256837, CVE-2025-69420]
  * NULL Pointer Dereference in PKCS12_item_decrypt_d2i_ex function
  - openssl-CVE-2025-69421.patch [bsc#1256838, CVE-2025-69421]
  * Out of bounds write in PKCS12_get_friendlyname() UTF-8 conversion
  - openssl-CVE-2025-69419.patch [bsc#1256836, CVE-2025-69419]
  * Heap out-of-bounds write in BIO_f_linebuffer on short writes
  - openssl-CVE-2025-68160.patch [bsc#1256834, CVE-2025-68160]
  * Unauthenticated/unencrypted trailing bytes with low-level OCB function calls
  - openssl-CVE-2025-69418.patch [bsc#1256835, CVE-2025-69418]
  * Stack buffer overflow in CMS AuthEnvelopedData parsing
  - openssl-CVE-2025-15467.patch [bsc#1256830, CVE-2025-15467]
  - openssl-CVE-2025-15467-comments.patch
  - openssl-CVE-2025-15467-test.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1774526400">- Security fixes:
  * CVE-2026-28387: Potential use-after-free in DANE client code
    (bsc#1260441)
  * CVE-2026-28388: NULL Pointer Dereference When Processing a
    Delta (bsc#1260442)
  * CVE-2026-28389: Possible NULL dereference when processing CMS
    KeyAgreeRecipientInfo (bsc#1260443)
  * CVE-2026-31789: Heap buffer overflow in hexadecimal conversion
    (bsc#1260444)
  * CVE-2026-31790: Incorrect failure handling in RSA KEM RSASVE
    encapsulation (bsc#1260445)
  * NULL pointer dereference when processing an OCSP response
    (bsc#1260446)
  * Add patches: openssl-CVE-2026-28387.patch
    openssl-CVE-2026-28388.patch openssl-CVE-2026-28388-tests.patch
    openssl-CVE-2026-28389.patch openssl-CVE-2026-31789.patch
    openssl-CVE-2026-31790.patch openssl-CVE-2026-31790-tests.patch
    openssl-NULL-pointer-dereference-in-ocsp_find_signer_sk.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1775649600">- Security fix:
  * CVE-2026-28390: NULL pointer dereference during processing of a crafted
    CMS EnvelopedData message with KeyTransportRecipientInfo (bsc#1261678)
  * Add openssl-CVE-2026-28390.patch</changelog>
  <changelog author="lucas.mulling@suse.com" date="1775822400">- Enable MD2 in legacy provider (jsc#PED-15724)</changelog>
</package>
<package pkgid="39d7e6c17e75e8e6891e25dc85ad839ce759a77f3123164135b6700b594b95fe" name="openssl-3-debuginfo" arch="x86_64">
  <version epoch="0" ver="3.2.3" rel="150400.5.33.3"/>
  <changelog author="pmonreal@suse.com" date="1730116800">- Remove the hardcoded DEFAULT_SUSE cipherlist selection.
  * Remove openssl-DEFAULT_SUSE_cipher.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1730116801">- Update to 3.2.3:
  * Changes between 3.2.2 and 3.2.3:
  - Fixed possible denial of service in X.509 name checks. [CVE-2024-6119]
  - Fixed possible buffer overread in SSL_select_next_proto(). [CVE-2024-5535]
  * Changes between 3.2.1 and 3.2.2:
  - Fixed potential use after free after SSL_free_buffers() is called. [CVE-2024-4741]
  - Fixed an issue where checking excessively long DSA keys or parameters may
    be very slow. [CVE-2024-4603]
  - Improved EC/DSA nonce generation routines to avoid bias and timing
    side channel leaks.
  - Fixed an issue where some non-default TLS server configurations can cause
    unbounded memory growth when processing TLSv1.3 sessions. [CVE-2024-2511]
  - New atexit configuration switch, which controls whether the OPENSSL_cleanup
    is registered when libcrypto is unloaded. This can be used on platforms
    where using atexit() from shared libraries causes crashes on exit.
  - Fixed bug where SSL_export_keying_material() could not be used with QUIC
    connections.
  * Add openssl-skip-quic-pairwise.patch to adapt the pairwise tests.
  * Merge openssl-FIPS-release_num_in_version_string.patch into
    openssl-FIPS-services-minimize.patch
  * Rebase patches:
  - openssl-Add-changes-to-ectest-and-eccurve.patch
  - openssl-FIPS-140-3-keychecks.patch
  - openssl-FIPS-embed-hmac.patch
  - openssl-Remove-EC-curves.patch
  - openssl-skipped-tests-EC-curves.patch
  - openssl-FIPS-early-KATS.patch
  - openssl-Allow-disabling-of-SHA1-signatures.patch
  - openssl-3-FIPS-Deny-SHA-1-sigver-in-FIPS-provider.patch
  - openssl-FIPS-limit-rsa-encrypt.patch
  - openssl-FIPS-Use-OAEP-in-KATs-support-fixed-OAEP-seed.patch
  - openssl-FIPS-Use-digest_sign-digest_verify-in-self-test.patch
  - openssl-FIPS-140-3-DRBG.patch
  - openssl-FIPS-140-3-zeroization.patch
  - openssl-Add-FIPS-indicator-parameter-to-HKDF.patch
  - openssl-FIPS-Remove-X9.31-padding-from-FIPS-prov.patch
  - openssl-FIPS-Add-explicit-indicator-for-key-length.patch
  - openssl-pbkdf2-Set-minimum-password-length-of-8-bytes.patch
  - openssl-FIPS-signature-Add-indicator-for-PSS-salt-length.patch
  - openssl-3-FIPS-GCM-Implement-explicit-indicator-for-IV-gen.patch
  - openssl-FIPS-enforce-EMS-support.patch
  - openssl-3-jitterentropy-3.4.0.patch
  - openssl-3-use-include-directive.patch
  * Remove not needed patches:
  - openssl-Allow-SHA1-in-seclevel-2-if-rh-allow-sha1-signatures.patch
  - openssl-3-FIPS-PCT_rsa_keygen.patch</changelog>
  <changelog author="angel.yankov@suse.com" date="1730462400">- Support MSA 12 SHA3 on s390x [jsc#PED-10280]
  * Add openssl-3-add_EVP_DigestSqueeze_api.patch
  * Add openssl-3-support-multiple-sha3_squeeze_s390x.patch
  * Add openssl-3-add-xof-state-handling-s3_absorb.patch
  * Add openssl-3-fix-state-handling-sha3_absorb_s390x.patch
  * Add openssl-3-fix-state-handling-sha3_final_s390x.patch
  * Add openssl-3-fix-state-handling-shake_final_s390x.patch
  * Add openssl-3-fix-state-handling-keccak_final_s390x.patch
  * Add openssl-3-support-EVP_DigestSqueeze-in-digest-prov-s390x.patch
  * Add openssl-3-add-defines-CPACF-funcs.patch
  * Add openssl-3-add-hw-acceleration-hmac.patch
  * Add openssl-3-support-CPACF-sha3-shake-perf-improvement.patch
  * Add openssl-3-fix-s390x_sha3_absorb.patch
  * Add openssl-3-fix-s390x_shake_squeeze.patch</changelog>
  <changelog author="angel.yankov@suse.com" date="1730808000">- Support MSA 10 XTS on s390x [jsc#PED-10273]
  * s390x: Add hardware acceleration for full AES-XTS
  * Add openssl-3-hw-acceleration-aes-xts-s390x.patch</changelog>
  <changelog author="angel.yankov@suse.com" date="1730808001">- Support MSA 11 HMAC on s390x [jsc#PED-10274]
  * Add openssl-3-disable-hmac-hw-acceleration-with-engine-digest.patch
  * Add openssl-3-fix-hmac-digest-detection-s390x.patch
  * Add openssl-3-fix-memleak-s390x_HMAC_CTX_copy.patch</changelog>
  <changelog author="angel.yankov@suse.com" date="1730980800">- Add missing fixes for SHA3_squeeze and quic_multistream_test on
  pcc64 arch. [jsc#PED-10280]
  * Added openssl-3-fix-sha3-squeeze-ppc64.patch
  * Added openssl-3-fix-quic_multistream_test.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1731412800">- Do not use HASHBANGPERL to avoid introducing a dependency on the
  perl-base package. [bsc#1233235]</changelog>
  <changelog author="pmonreal@suse.com" date="1734436800">- Fix evp_properties section in the openssl.cnf file [bsc#1234647]
  * Rebase patches:
  - openssl-3-use-include-directive.patch
  - openssl-TESTS-Disable-default-provider-crypto-policies.patch</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1734955200">- Add support for userspace livepatching on ppc64le (jsc#PED-11850).
- Use gcc-13 for ppc64le.</changelog>
  <changelog author="lucas.mulling@suse.com" date="1738238400">- Security fix: [bsc#1236136, CVE-2024-13176]
  * Fix timing side-channel in ECDSA signature computation
  * Add openssl-CVE-2024-13176.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1739361600">- Security fix: [bsc#1236599, CVE-2024-12797]
  * RFC7250 handshakes with unauthenticated servers don't abort as
    expected.
  * Add openssl-CVE-2024-12797.patch</changelog>
  <changelog author="angel.yankov@suse.com" date="1746014400">- Security fix: [bsc#1240366, CVE-2025-27587]
  * Minerva side channel vulnerability in P-384 on PPC arch
  * Add openssl-3-p384-minerva-ppc.patch
  * Add openssl-3-p384-minerva-ppc-p9.patch</changelog>
  <changelog author="mls@suse.de" date="1751371200">- Backport mdless cms signing support [jsc#PED-12895]
  * Add openssl-3-support-mdless-cms.patch</changelog>
  <changelog author="lucas.mulling@suse.com" date="1752494400">- FIPS: Fix EMS in crypto-policies FIPS:NO-ENFORCE-EMS
  * [bsc#1230959, bsc#1232326, bsc#1231748, bsc#1246428]
  * Add patch openssl-FIPS-fix-EMS-support.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1753876800">- Increase limit for CRL download [bsc#1247148, bsc#1247144]
  * Add openssl-3-large-CRLs.patch</changelog>
  <changelog author="lucas.mulling@suse.com" date="1759233600">- Security fix: [bsc#1250232 CVE-2025-9230]
  * Fix out-of-bounds read &amp; write in RFC 3211 KEK unwrap
  * Add patch openssl3-CVE-2025-9230.patch</changelog>
  <changelog author="lucas.mulling@suse.com" date="1768824000">- Security fixes:
  * Missing ASN1_TYPE validation in PKCS#12 parsing
  - openssl-CVE-2026-22795.patch [bsc#1256839, CVE-2026-22795]
  * ASN1_TYPE Type Confusion in the PKCS7_digest_from_attributes() function
  - openssl-CVE-2026-22795.patch [bsc#1256840, CVE-2026-22796]
  * Missing ASN1_TYPE validation in TS_RESP_verify_response() function
  - openssl-CVE-2025-69420.patch [bsc#1256837, CVE-2025-69420]
  * NULL Pointer Dereference in PKCS12_item_decrypt_d2i_ex function
  - openssl-CVE-2025-69421.patch [bsc#1256838, CVE-2025-69421]
  * Out of bounds write in PKCS12_get_friendlyname() UTF-8 conversion
  - openssl-CVE-2025-69419.patch [bsc#1256836, CVE-2025-69419]
  * Heap out-of-bounds write in BIO_f_linebuffer on short writes
  - openssl-CVE-2025-68160.patch [bsc#1256834, CVE-2025-68160]
  * Unauthenticated/unencrypted trailing bytes with low-level OCB function calls
  - openssl-CVE-2025-69418.patch [bsc#1256835, CVE-2025-69418]
  * Stack buffer overflow in CMS AuthEnvelopedData parsing
  - openssl-CVE-2025-15467.patch [bsc#1256830, CVE-2025-15467]
  - openssl-CVE-2025-15467-comments.patch
  - openssl-CVE-2025-15467-test.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1774526400">- Security fixes:
  * CVE-2026-28387: Potential use-after-free in DANE client code
    (bsc#1260441)
  * CVE-2026-28388: NULL Pointer Dereference When Processing a
    Delta (bsc#1260442)
  * CVE-2026-28389: Possible NULL dereference when processing CMS
    KeyAgreeRecipientInfo (bsc#1260443)
  * CVE-2026-31789: Heap buffer overflow in hexadecimal conversion
    (bsc#1260444)
  * CVE-2026-31790: Incorrect failure handling in RSA KEM RSASVE
    encapsulation (bsc#1260445)
  * NULL pointer dereference when processing an OCSP response
    (bsc#1260446)
  * Add patches: openssl-CVE-2026-28387.patch
    openssl-CVE-2026-28388.patch openssl-CVE-2026-28388-tests.patch
    openssl-CVE-2026-28389.patch openssl-CVE-2026-31789.patch
    openssl-CVE-2026-31790.patch openssl-CVE-2026-31790-tests.patch
    openssl-NULL-pointer-dereference-in-ocsp_find_signer_sk.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1775649600">- Security fix:
  * CVE-2026-28390: NULL pointer dereference during processing of a crafted
    CMS EnvelopedData message with KeyTransportRecipientInfo (bsc#1261678)
  * Add openssl-CVE-2026-28390.patch</changelog>
  <changelog author="lucas.mulling@suse.com" date="1775822400">- Enable MD2 in legacy provider (jsc#PED-15724)</changelog>
</package>
<package pkgid="68a0c8709db8af373a02421a3541b77e670de3bec4239e7ea2c085c456a6454a" name="openssl-3-debugsource" arch="x86_64">
  <version epoch="0" ver="3.2.3" rel="150400.5.33.3"/>
  <changelog author="pmonreal@suse.com" date="1730116800">- Remove the hardcoded DEFAULT_SUSE cipherlist selection.
  * Remove openssl-DEFAULT_SUSE_cipher.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1730116801">- Update to 3.2.3:
  * Changes between 3.2.2 and 3.2.3:
  - Fixed possible denial of service in X.509 name checks. [CVE-2024-6119]
  - Fixed possible buffer overread in SSL_select_next_proto(). [CVE-2024-5535]
  * Changes between 3.2.1 and 3.2.2:
  - Fixed potential use after free after SSL_free_buffers() is called. [CVE-2024-4741]
  - Fixed an issue where checking excessively long DSA keys or parameters may
    be very slow. [CVE-2024-4603]
  - Improved EC/DSA nonce generation routines to avoid bias and timing
    side channel leaks.
  - Fixed an issue where some non-default TLS server configurations can cause
    unbounded memory growth when processing TLSv1.3 sessions. [CVE-2024-2511]
  - New atexit configuration switch, which controls whether the OPENSSL_cleanup
    is registered when libcrypto is unloaded. This can be used on platforms
    where using atexit() from shared libraries causes crashes on exit.
  - Fixed bug where SSL_export_keying_material() could not be used with QUIC
    connections.
  * Add openssl-skip-quic-pairwise.patch to adapt the pairwise tests.
  * Merge openssl-FIPS-release_num_in_version_string.patch into
    openssl-FIPS-services-minimize.patch
  * Rebase patches:
  - openssl-Add-changes-to-ectest-and-eccurve.patch
  - openssl-FIPS-140-3-keychecks.patch
  - openssl-FIPS-embed-hmac.patch
  - openssl-Remove-EC-curves.patch
  - openssl-skipped-tests-EC-curves.patch
  - openssl-FIPS-early-KATS.patch
  - openssl-Allow-disabling-of-SHA1-signatures.patch
  - openssl-3-FIPS-Deny-SHA-1-sigver-in-FIPS-provider.patch
  - openssl-FIPS-limit-rsa-encrypt.patch
  - openssl-FIPS-Use-OAEP-in-KATs-support-fixed-OAEP-seed.patch
  - openssl-FIPS-Use-digest_sign-digest_verify-in-self-test.patch
  - openssl-FIPS-140-3-DRBG.patch
  - openssl-FIPS-140-3-zeroization.patch
  - openssl-Add-FIPS-indicator-parameter-to-HKDF.patch
  - openssl-FIPS-Remove-X9.31-padding-from-FIPS-prov.patch
  - openssl-FIPS-Add-explicit-indicator-for-key-length.patch
  - openssl-pbkdf2-Set-minimum-password-length-of-8-bytes.patch
  - openssl-FIPS-signature-Add-indicator-for-PSS-salt-length.patch
  - openssl-3-FIPS-GCM-Implement-explicit-indicator-for-IV-gen.patch
  - openssl-FIPS-enforce-EMS-support.patch
  - openssl-3-jitterentropy-3.4.0.patch
  - openssl-3-use-include-directive.patch
  * Remove not needed patches:
  - openssl-Allow-SHA1-in-seclevel-2-if-rh-allow-sha1-signatures.patch
  - openssl-3-FIPS-PCT_rsa_keygen.patch</changelog>
  <changelog author="angel.yankov@suse.com" date="1730462400">- Support MSA 12 SHA3 on s390x [jsc#PED-10280]
  * Add openssl-3-add_EVP_DigestSqueeze_api.patch
  * Add openssl-3-support-multiple-sha3_squeeze_s390x.patch
  * Add openssl-3-add-xof-state-handling-s3_absorb.patch
  * Add openssl-3-fix-state-handling-sha3_absorb_s390x.patch
  * Add openssl-3-fix-state-handling-sha3_final_s390x.patch
  * Add openssl-3-fix-state-handling-shake_final_s390x.patch
  * Add openssl-3-fix-state-handling-keccak_final_s390x.patch
  * Add openssl-3-support-EVP_DigestSqueeze-in-digest-prov-s390x.patch
  * Add openssl-3-add-defines-CPACF-funcs.patch
  * Add openssl-3-add-hw-acceleration-hmac.patch
  * Add openssl-3-support-CPACF-sha3-shake-perf-improvement.patch
  * Add openssl-3-fix-s390x_sha3_absorb.patch
  * Add openssl-3-fix-s390x_shake_squeeze.patch</changelog>
  <changelog author="angel.yankov@suse.com" date="1730808000">- Support MSA 10 XTS on s390x [jsc#PED-10273]
  * s390x: Add hardware acceleration for full AES-XTS
  * Add openssl-3-hw-acceleration-aes-xts-s390x.patch</changelog>
  <changelog author="angel.yankov@suse.com" date="1730808001">- Support MSA 11 HMAC on s390x [jsc#PED-10274]
  * Add openssl-3-disable-hmac-hw-acceleration-with-engine-digest.patch
  * Add openssl-3-fix-hmac-digest-detection-s390x.patch
  * Add openssl-3-fix-memleak-s390x_HMAC_CTX_copy.patch</changelog>
  <changelog author="angel.yankov@suse.com" date="1730980800">- Add missing fixes for SHA3_squeeze and quic_multistream_test on
  pcc64 arch. [jsc#PED-10280]
  * Added openssl-3-fix-sha3-squeeze-ppc64.patch
  * Added openssl-3-fix-quic_multistream_test.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1731412800">- Do not use HASHBANGPERL to avoid introducing a dependency on the
  perl-base package. [bsc#1233235]</changelog>
  <changelog author="pmonreal@suse.com" date="1734436800">- Fix evp_properties section in the openssl.cnf file [bsc#1234647]
  * Rebase patches:
  - openssl-3-use-include-directive.patch
  - openssl-TESTS-Disable-default-provider-crypto-policies.patch</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1734955200">- Add support for userspace livepatching on ppc64le (jsc#PED-11850).
- Use gcc-13 for ppc64le.</changelog>
  <changelog author="lucas.mulling@suse.com" date="1738238400">- Security fix: [bsc#1236136, CVE-2024-13176]
  * Fix timing side-channel in ECDSA signature computation
  * Add openssl-CVE-2024-13176.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1739361600">- Security fix: [bsc#1236599, CVE-2024-12797]
  * RFC7250 handshakes with unauthenticated servers don't abort as
    expected.
  * Add openssl-CVE-2024-12797.patch</changelog>
  <changelog author="angel.yankov@suse.com" date="1746014400">- Security fix: [bsc#1240366, CVE-2025-27587]
  * Minerva side channel vulnerability in P-384 on PPC arch
  * Add openssl-3-p384-minerva-ppc.patch
  * Add openssl-3-p384-minerva-ppc-p9.patch</changelog>
  <changelog author="mls@suse.de" date="1751371200">- Backport mdless cms signing support [jsc#PED-12895]
  * Add openssl-3-support-mdless-cms.patch</changelog>
  <changelog author="lucas.mulling@suse.com" date="1752494400">- FIPS: Fix EMS in crypto-policies FIPS:NO-ENFORCE-EMS
  * [bsc#1230959, bsc#1232326, bsc#1231748, bsc#1246428]
  * Add patch openssl-FIPS-fix-EMS-support.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1753876800">- Increase limit for CRL download [bsc#1247148, bsc#1247144]
  * Add openssl-3-large-CRLs.patch</changelog>
  <changelog author="lucas.mulling@suse.com" date="1759233600">- Security fix: [bsc#1250232 CVE-2025-9230]
  * Fix out-of-bounds read &amp; write in RFC 3211 KEK unwrap
  * Add patch openssl3-CVE-2025-9230.patch</changelog>
  <changelog author="lucas.mulling@suse.com" date="1768824000">- Security fixes:
  * Missing ASN1_TYPE validation in PKCS#12 parsing
  - openssl-CVE-2026-22795.patch [bsc#1256839, CVE-2026-22795]
  * ASN1_TYPE Type Confusion in the PKCS7_digest_from_attributes() function
  - openssl-CVE-2026-22795.patch [bsc#1256840, CVE-2026-22796]
  * Missing ASN1_TYPE validation in TS_RESP_verify_response() function
  - openssl-CVE-2025-69420.patch [bsc#1256837, CVE-2025-69420]
  * NULL Pointer Dereference in PKCS12_item_decrypt_d2i_ex function
  - openssl-CVE-2025-69421.patch [bsc#1256838, CVE-2025-69421]
  * Out of bounds write in PKCS12_get_friendlyname() UTF-8 conversion
  - openssl-CVE-2025-69419.patch [bsc#1256836, CVE-2025-69419]
  * Heap out-of-bounds write in BIO_f_linebuffer on short writes
  - openssl-CVE-2025-68160.patch [bsc#1256834, CVE-2025-68160]
  * Unauthenticated/unencrypted trailing bytes with low-level OCB function calls
  - openssl-CVE-2025-69418.patch [bsc#1256835, CVE-2025-69418]
  * Stack buffer overflow in CMS AuthEnvelopedData parsing
  - openssl-CVE-2025-15467.patch [bsc#1256830, CVE-2025-15467]
  - openssl-CVE-2025-15467-comments.patch
  - openssl-CVE-2025-15467-test.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1774526400">- Security fixes:
  * CVE-2026-28387: Potential use-after-free in DANE client code
    (bsc#1260441)
  * CVE-2026-28388: NULL Pointer Dereference When Processing a
    Delta (bsc#1260442)
  * CVE-2026-28389: Possible NULL dereference when processing CMS
    KeyAgreeRecipientInfo (bsc#1260443)
  * CVE-2026-31789: Heap buffer overflow in hexadecimal conversion
    (bsc#1260444)
  * CVE-2026-31790: Incorrect failure handling in RSA KEM RSASVE
    encapsulation (bsc#1260445)
  * NULL pointer dereference when processing an OCSP response
    (bsc#1260446)
  * Add patches: openssl-CVE-2026-28387.patch
    openssl-CVE-2026-28388.patch openssl-CVE-2026-28388-tests.patch
    openssl-CVE-2026-28389.patch openssl-CVE-2026-31789.patch
    openssl-CVE-2026-31790.patch openssl-CVE-2026-31790-tests.patch
    openssl-NULL-pointer-dereference-in-ocsp_find_signer_sk.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1775649600">- Security fix:
  * CVE-2026-28390: NULL pointer dereference during processing of a crafted
    CMS EnvelopedData message with KeyTransportRecipientInfo (bsc#1261678)
  * Add openssl-CVE-2026-28390.patch</changelog>
  <changelog author="lucas.mulling@suse.com" date="1775822400">- Enable MD2 in legacy provider (jsc#PED-15724)</changelog>
</package>
<package pkgid="6a30bc74a0078d8c1e47d5399db334b1a0d84afc621752eb0279dbbdc18b649f" name="openssl-3-doc" arch="noarch">
  <version epoch="0" ver="3.2.3" rel="150400.5.33.3"/>
  <changelog author="pmonreal@suse.com" date="1730116800">- Remove the hardcoded DEFAULT_SUSE cipherlist selection.
  * Remove openssl-DEFAULT_SUSE_cipher.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1730116801">- Update to 3.2.3:
  * Changes between 3.2.2 and 3.2.3:
  - Fixed possible denial of service in X.509 name checks. [CVE-2024-6119]
  - Fixed possible buffer overread in SSL_select_next_proto(). [CVE-2024-5535]
  * Changes between 3.2.1 and 3.2.2:
  - Fixed potential use after free after SSL_free_buffers() is called. [CVE-2024-4741]
  - Fixed an issue where checking excessively long DSA keys or parameters may
    be very slow. [CVE-2024-4603]
  - Improved EC/DSA nonce generation routines to avoid bias and timing
    side channel leaks.
  - Fixed an issue where some non-default TLS server configurations can cause
    unbounded memory growth when processing TLSv1.3 sessions. [CVE-2024-2511]
  - New atexit configuration switch, which controls whether the OPENSSL_cleanup
    is registered when libcrypto is unloaded. This can be used on platforms
    where using atexit() from shared libraries causes crashes on exit.
  - Fixed bug where SSL_export_keying_material() could not be used with QUIC
    connections.
  * Add openssl-skip-quic-pairwise.patch to adapt the pairwise tests.
  * Merge openssl-FIPS-release_num_in_version_string.patch into
    openssl-FIPS-services-minimize.patch
  * Rebase patches:
  - openssl-Add-changes-to-ectest-and-eccurve.patch
  - openssl-FIPS-140-3-keychecks.patch
  - openssl-FIPS-embed-hmac.patch
  - openssl-Remove-EC-curves.patch
  - openssl-skipped-tests-EC-curves.patch
  - openssl-FIPS-early-KATS.patch
  - openssl-Allow-disabling-of-SHA1-signatures.patch
  - openssl-3-FIPS-Deny-SHA-1-sigver-in-FIPS-provider.patch
  - openssl-FIPS-limit-rsa-encrypt.patch
  - openssl-FIPS-Use-OAEP-in-KATs-support-fixed-OAEP-seed.patch
  - openssl-FIPS-Use-digest_sign-digest_verify-in-self-test.patch
  - openssl-FIPS-140-3-DRBG.patch
  - openssl-FIPS-140-3-zeroization.patch
  - openssl-Add-FIPS-indicator-parameter-to-HKDF.patch
  - openssl-FIPS-Remove-X9.31-padding-from-FIPS-prov.patch
  - openssl-FIPS-Add-explicit-indicator-for-key-length.patch
  - openssl-pbkdf2-Set-minimum-password-length-of-8-bytes.patch
  - openssl-FIPS-signature-Add-indicator-for-PSS-salt-length.patch
  - openssl-3-FIPS-GCM-Implement-explicit-indicator-for-IV-gen.patch
  - openssl-FIPS-enforce-EMS-support.patch
  - openssl-3-jitterentropy-3.4.0.patch
  - openssl-3-use-include-directive.patch
  * Remove not needed patches:
  - openssl-Allow-SHA1-in-seclevel-2-if-rh-allow-sha1-signatures.patch
  - openssl-3-FIPS-PCT_rsa_keygen.patch</changelog>
  <changelog author="angel.yankov@suse.com" date="1730462400">- Support MSA 12 SHA3 on s390x [jsc#PED-10280]
  * Add openssl-3-add_EVP_DigestSqueeze_api.patch
  * Add openssl-3-support-multiple-sha3_squeeze_s390x.patch
  * Add openssl-3-add-xof-state-handling-s3_absorb.patch
  * Add openssl-3-fix-state-handling-sha3_absorb_s390x.patch
  * Add openssl-3-fix-state-handling-sha3_final_s390x.patch
  * Add openssl-3-fix-state-handling-shake_final_s390x.patch
  * Add openssl-3-fix-state-handling-keccak_final_s390x.patch
  * Add openssl-3-support-EVP_DigestSqueeze-in-digest-prov-s390x.patch
  * Add openssl-3-add-defines-CPACF-funcs.patch
  * Add openssl-3-add-hw-acceleration-hmac.patch
  * Add openssl-3-support-CPACF-sha3-shake-perf-improvement.patch
  * Add openssl-3-fix-s390x_sha3_absorb.patch
  * Add openssl-3-fix-s390x_shake_squeeze.patch</changelog>
  <changelog author="angel.yankov@suse.com" date="1730808000">- Support MSA 10 XTS on s390x [jsc#PED-10273]
  * s390x: Add hardware acceleration for full AES-XTS
  * Add openssl-3-hw-acceleration-aes-xts-s390x.patch</changelog>
  <changelog author="angel.yankov@suse.com" date="1730808001">- Support MSA 11 HMAC on s390x [jsc#PED-10274]
  * Add openssl-3-disable-hmac-hw-acceleration-with-engine-digest.patch
  * Add openssl-3-fix-hmac-digest-detection-s390x.patch
  * Add openssl-3-fix-memleak-s390x_HMAC_CTX_copy.patch</changelog>
  <changelog author="angel.yankov@suse.com" date="1730980800">- Add missing fixes for SHA3_squeeze and quic_multistream_test on
  pcc64 arch. [jsc#PED-10280]
  * Added openssl-3-fix-sha3-squeeze-ppc64.patch
  * Added openssl-3-fix-quic_multistream_test.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1731412800">- Do not use HASHBANGPERL to avoid introducing a dependency on the
  perl-base package. [bsc#1233235]</changelog>
  <changelog author="pmonreal@suse.com" date="1734436800">- Fix evp_properties section in the openssl.cnf file [bsc#1234647]
  * Rebase patches:
  - openssl-3-use-include-directive.patch
  - openssl-TESTS-Disable-default-provider-crypto-policies.patch</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1734955200">- Add support for userspace livepatching on ppc64le (jsc#PED-11850).
- Use gcc-13 for ppc64le.</changelog>
  <changelog author="lucas.mulling@suse.com" date="1738238400">- Security fix: [bsc#1236136, CVE-2024-13176]
  * Fix timing side-channel in ECDSA signature computation
  * Add openssl-CVE-2024-13176.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1739361600">- Security fix: [bsc#1236599, CVE-2024-12797]
  * RFC7250 handshakes with unauthenticated servers don't abort as
    expected.
  * Add openssl-CVE-2024-12797.patch</changelog>
  <changelog author="angel.yankov@suse.com" date="1746014400">- Security fix: [bsc#1240366, CVE-2025-27587]
  * Minerva side channel vulnerability in P-384 on PPC arch
  * Add openssl-3-p384-minerva-ppc.patch
  * Add openssl-3-p384-minerva-ppc-p9.patch</changelog>
  <changelog author="mls@suse.de" date="1751371200">- Backport mdless cms signing support [jsc#PED-12895]
  * Add openssl-3-support-mdless-cms.patch</changelog>
  <changelog author="lucas.mulling@suse.com" date="1752494400">- FIPS: Fix EMS in crypto-policies FIPS:NO-ENFORCE-EMS
  * [bsc#1230959, bsc#1232326, bsc#1231748, bsc#1246428]
  * Add patch openssl-FIPS-fix-EMS-support.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1753876800">- Increase limit for CRL download [bsc#1247148, bsc#1247144]
  * Add openssl-3-large-CRLs.patch</changelog>
  <changelog author="lucas.mulling@suse.com" date="1759233600">- Security fix: [bsc#1250232 CVE-2025-9230]
  * Fix out-of-bounds read &amp; write in RFC 3211 KEK unwrap
  * Add patch openssl3-CVE-2025-9230.patch</changelog>
  <changelog author="lucas.mulling@suse.com" date="1768824000">- Security fixes:
  * Missing ASN1_TYPE validation in PKCS#12 parsing
  - openssl-CVE-2026-22795.patch [bsc#1256839, CVE-2026-22795]
  * ASN1_TYPE Type Confusion in the PKCS7_digest_from_attributes() function
  - openssl-CVE-2026-22795.patch [bsc#1256840, CVE-2026-22796]
  * Missing ASN1_TYPE validation in TS_RESP_verify_response() function
  - openssl-CVE-2025-69420.patch [bsc#1256837, CVE-2025-69420]
  * NULL Pointer Dereference in PKCS12_item_decrypt_d2i_ex function
  - openssl-CVE-2025-69421.patch [bsc#1256838, CVE-2025-69421]
  * Out of bounds write in PKCS12_get_friendlyname() UTF-8 conversion
  - openssl-CVE-2025-69419.patch [bsc#1256836, CVE-2025-69419]
  * Heap out-of-bounds write in BIO_f_linebuffer on short writes
  - openssl-CVE-2025-68160.patch [bsc#1256834, CVE-2025-68160]
  * Unauthenticated/unencrypted trailing bytes with low-level OCB function calls
  - openssl-CVE-2025-69418.patch [bsc#1256835, CVE-2025-69418]
  * Stack buffer overflow in CMS AuthEnvelopedData parsing
  - openssl-CVE-2025-15467.patch [bsc#1256830, CVE-2025-15467]
  - openssl-CVE-2025-15467-comments.patch
  - openssl-CVE-2025-15467-test.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1774526400">- Security fixes:
  * CVE-2026-28387: Potential use-after-free in DANE client code
    (bsc#1260441)
  * CVE-2026-28388: NULL Pointer Dereference When Processing a
    Delta (bsc#1260442)
  * CVE-2026-28389: Possible NULL dereference when processing CMS
    KeyAgreeRecipientInfo (bsc#1260443)
  * CVE-2026-31789: Heap buffer overflow in hexadecimal conversion
    (bsc#1260444)
  * CVE-2026-31790: Incorrect failure handling in RSA KEM RSASVE
    encapsulation (bsc#1260445)
  * NULL pointer dereference when processing an OCSP response
    (bsc#1260446)
  * Add patches: openssl-CVE-2026-28387.patch
    openssl-CVE-2026-28388.patch openssl-CVE-2026-28388-tests.patch
    openssl-CVE-2026-28389.patch openssl-CVE-2026-31789.patch
    openssl-CVE-2026-31790.patch openssl-CVE-2026-31790-tests.patch
    openssl-NULL-pointer-dereference-in-ocsp_find_signer_sk.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1775649600">- Security fix:
  * CVE-2026-28390: NULL pointer dereference during processing of a crafted
    CMS EnvelopedData message with KeyTransportRecipientInfo (bsc#1261678)
  * Add openssl-CVE-2026-28390.patch</changelog>
  <changelog author="lucas.mulling@suse.com" date="1775822400">- Enable MD2 in legacy provider (jsc#PED-15724)</changelog>
</package>
<package pkgid="a939ba9277d0d078c768e354bb98ce80917c3477c658423da8d126b0749065f1" name="openssl-3-livepatches" arch="src">
  <version epoch="0" ver="0.1" rel="150400.7.4"/>
  <changelog author="giuliano.belinassi@suse.com" date="1719576000">- Livepatch for CVE-2024-5535 (bsc#1227147).</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1722945600">- Remove livepatch for 3.1.4-150600.3.6 as it doesn't support ULP.</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1733313600">- Update package to support SLFO (bsc#1228406)</changelog>
</package>
<package pkgid="0eb7dc824c3744125591c5f90ee9627f8797aac02c8dc6e6425cd0be16b4f2bd" name="openssl-3-livepatches" arch="x86_64">
  <version epoch="0" ver="0.1" rel="150400.7.4"/>
  <changelog author="giuliano.belinassi@suse.com" date="1719576000">- Livepatch for CVE-2024-5535 (bsc#1227147).</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1722945600">- Remove livepatch for 3.1.4-150600.3.6 as it doesn't support ULP.</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1733313600">- Update package to support SLFO (bsc#1228406)</changelog>
</package>
<package pkgid="3e71a635e3f098bfb70e682cce7b24e123a046e3bf472121d817ffa6e908d8b6" name="openssl-3-livepatches-debuginfo" arch="x86_64">
  <version epoch="0" ver="0.1" rel="150400.7.4"/>
  <changelog author="giuliano.belinassi@suse.com" date="1719576000">- Livepatch for CVE-2024-5535 (bsc#1227147).</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1722945600">- Remove livepatch for 3.1.4-150600.3.6 as it doesn't support ULP.</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1733313600">- Update package to support SLFO (bsc#1228406)</changelog>
</package>
<package pkgid="c2ede0262c226b18666246d1d1e617fa3d19974d4c54dce5b4933584f035a393" name="openssl-3-livepatches-debugsource" arch="x86_64">
  <version epoch="0" ver="0.1" rel="150400.7.4"/>
  <changelog author="giuliano.belinassi@suse.com" date="1719576000">- Livepatch for CVE-2024-5535 (bsc#1227147).</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1722945600">- Remove livepatch for 3.1.4-150600.3.6 as it doesn't support ULP.</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1733313600">- Update package to support SLFO (bsc#1228406)</changelog>
</package>
<package pkgid="07567a3eaf9c7816e0be3e4592181a878873d075ac548a8b419e03caf6c7d286" name="simple-livepatch-package" arch="src">
  <version epoch="0" ver="0" rel="150400.3.7"/>
  <changelog author="giuliano.belinassi@suse.com" date="1650542400">- Create a simple-livepatch-package for SUSECON</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1659441600">- Clean up remaining openssl files that were used as a basis
- Change `Supplements` to `Requires`.</changelog>
</package>
<package pkgid="db4c32d62ab102d722d1a21fe088399406e19b411e371dcbf268c58b836dadca" name="simple-livepatch-package" arch="x86_64">
  <version epoch="0" ver="0" rel="150400.3.7"/>
  <changelog author="giuliano.belinassi@suse.com" date="1650542400">- Create a simple-livepatch-package for SUSECON</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1659441600">- Clean up remaining openssl files that were used as a basis
- Change `Supplements` to `Requires`.</changelog>
</package>
<package pkgid="af5254fc89bfc85132972eaca1b047cc1310be94748fd508556cb42404ef27ae" name="simple-livepatch-package-debuginfo" arch="x86_64">
  <version epoch="0" ver="0" rel="150400.3.7"/>
  <changelog author="giuliano.belinassi@suse.com" date="1650542400">- Create a simple-livepatch-package for SUSECON</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1659441600">- Clean up remaining openssl files that were used as a basis
- Change `Supplements` to `Requires`.</changelog>
</package>
<package pkgid="787b6895cc0752e8550fb106ff13dd3ec70c7c502142f2f4c9221a5833f34a25" name="simple-livepatch-package-debugsource" arch="x86_64">
  <version epoch="0" ver="0" rel="150400.3.7"/>
  <changelog author="giuliano.belinassi@suse.com" date="1650542400">- Create a simple-livepatch-package for SUSECON</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1659441600">- Clean up remaining openssl files that were used as a basis
- Change `Supplements` to `Requires`.</changelog>
</package>
<package pkgid="4e0d2e24c052995c2e1cee9dd57a85b47787779cb927134fdd4a8a14cccc55e3" name="ulp-macros" arch="noarch">
  <version epoch="0" ver="1.0" rel="150400.14.1"/>
  <changelog author="giuliano.belinassi@suse.com" date="1686744000">- First release.</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1721649600">- Fix FIXME and warnings.</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1734523200">- Add macros for ppc64le.</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1734696000">- Add license file.</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1736337600">- Disable livepatching support on ppc64le while correct gcc-13 patches does not hit SP7.</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1737115200">- Re-enable support for userspace livepatching in ppc64le (jsc#PED-11850).</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1738584000">- Reduce prologue size on ppc64le (bsc#1236776).</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1743595200">- Update to comply with gcc-15.</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1758801600">- Add macro that checks if a certain package is the most recent one.</changelog>
</package>
<package pkgid="0f02ffcbc2e4093e09611b1ceddd1ef52a213e641f6ff4652c19ebcafeeed9f9" name="ulp-macros" arch="src">
  <version epoch="0" ver="1.0" rel="150400.14.1"/>
  <changelog author="giuliano.belinassi@suse.com" date="1686744000">- First release.</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1721649600">- Fix FIXME and warnings.</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1734523200">- Add macros for ppc64le.</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1734696000">- Add license file.</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1736337600">- Disable livepatching support on ppc64le while correct gcc-13 patches does not hit SP7.</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1737115200">- Re-enable support for userspace livepatching in ppc64le (jsc#PED-11850).</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1738584000">- Reduce prologue size on ppc64le (bsc#1236776).</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1743595200">- Update to comply with gcc-15.</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1758801600">- Add macro that checks if a certain package is the most recent one.</changelog>
</package>
<package pkgid="ee9d7908d1ce19a9dfc9d07b0585e3595db267443c773d3a081609578919d946" name="yama-disable-ptrace-scope" arch="noarch">
  <version epoch="0" ver="0.1" rel="150400.10.1"/>
  <changelog author="giuliano.belinassi@suse.com" date="1713960000">- First version.</changelog>
</package>
<package pkgid="82ca8a4fbcd63df095edff2a97ea5d4c181ea630fe38755d8425e6e498bb51a9" name="yama-disable-ptrace-scope" arch="src">
  <version epoch="0" ver="0.1" rel="150400.10.1"/>
  <changelog author="giuliano.belinassi@suse.com" date="1713960000">- First version.</changelog>
</package>
</otherdata>