On Mon Feb 2, 2026 at 1:35 PM CET, Hitendra Prajapati via lists.openembedded.org wrote: > Upstream-Status: Backport from > https://github.com/openssl/openssl/commit/41be0f216404f14457bbf3b9cc488dba60b49296
Same remark as https://lists.openembedded.org/g/openembedded-core/topic/117540534#msg231419 Can you send a V2 with an improved commit message please? Content of the patch looks good. Thanks! > > Signed-off-by: Hitendra Prajapati <[email protected]> > --- > .../openssl/openssl/CVE-2025-69419.patch | 61 +++++++++++++++++++ > .../openssl/openssl_3.2.6.bb | 1 + > 2 files changed, 62 insertions(+) > create mode 100644 > meta/recipes-connectivity/openssl/openssl/CVE-2025-69419.patch > > diff --git a/meta/recipes-connectivity/openssl/openssl/CVE-2025-69419.patch > b/meta/recipes-connectivity/openssl/openssl/CVE-2025-69419.patch > new file mode 100644 > index 0000000000..dcfdba82ac > --- /dev/null > +++ b/meta/recipes-connectivity/openssl/openssl/CVE-2025-69419.patch > @@ -0,0 +1,61 @@ > +From 41be0f216404f14457bbf3b9cc488dba60b49296 Mon Sep 17 00:00:00 2001 > +From: Norbert Pocs <[email protected]> > +Date: Thu, 11 Dec 2025 12:49:00 +0100 > +Subject: [PATCH] Check return code of UTF8_putc > + > +Signed-off-by: Norbert Pocs <[email protected]> > + > +Reviewed-by: Nikola Pajkovsky <[email protected]> > +Reviewed-by: Viktor Dukhovni <[email protected]> > +(Merged from https://github.com/openssl/openssl/pull/29376) > + > +CVE: CVE-2025-69419 > +Upstream-Status: Backport > [https://github.com/openssl/openssl/commit/41be0f216404f14457bbf3b9cc488dba60b49296] > +Signed-off-by: Hitendra Prajapati <[email protected]> > +--- > + crypto/asn1/a_strex.c | 6 ++++-- > + crypto/pkcs12/p12_utl.c | 11 +++++++++-- > + 2 files changed, 13 insertions(+), 4 deletions(-) > + > +diff --git a/crypto/asn1/a_strex.c b/crypto/asn1/a_strex.c > +index f64e352..7d76700 100644 > +--- a/crypto/asn1/a_strex.c > ++++ b/crypto/asn1/a_strex.c > +@@ -204,8 +204,10 @@ static int do_buf(unsigned char *buf, int buflen, > + orflags = CHARTYPE_LAST_ESC_2253; > + if (type & BUF_TYPE_CONVUTF8) { > + unsigned char utfbuf[6]; > +- int utflen; > +- utflen = UTF8_putc(utfbuf, sizeof(utfbuf), c); > ++ int utflen = UTF8_putc(utfbuf, sizeof(utfbuf), c); > ++ > ++ if (utflen < 0) > ++ return -1; /* error happened with UTF8 */ > + for (i = 0; i < utflen; i++) { > + /* > + * We don't need to worry about setting orflags correctly > +diff --git a/crypto/pkcs12/p12_utl.c b/crypto/pkcs12/p12_utl.c > +index a96623f..b109dab 100644 > +--- a/crypto/pkcs12/p12_utl.c > ++++ b/crypto/pkcs12/p12_utl.c > +@@ -206,8 +206,15 @@ char *OPENSSL_uni2utf8(const unsigned char *uni, int > unilen) > + /* re-run the loop emitting UTF-8 string */ > + for (asclen = 0, i = 0; i < unilen; ) { > + j = bmp_to_utf8(asctmp+asclen, uni+i, unilen-i); > +- if (j == 4) i += 4; > +- else i += 2; > ++ /* when UTF8_putc fails */ > ++ if (j < 0) { > ++ OPENSSL_free(asctmp); > ++ return NULL; > ++ } > ++ if (j == 4) > ++ i += 4; > ++ else > ++ i += 2; > + asclen += j; > + } > + > +-- > +2.50.1 > + > diff --git a/meta/recipes-connectivity/openssl/openssl_3.2.6.bb > b/meta/recipes-connectivity/openssl/openssl_3.2.6.bb > index 4fd13d52fe..88fa0285cd 100644 > --- a/meta/recipes-connectivity/openssl/openssl_3.2.6.bb > +++ b/meta/recipes-connectivity/openssl/openssl_3.2.6.bb > @@ -17,6 +17,7 @@ SRC_URI = > "https://github.com/openssl/openssl/releases/download/openssl-${PV}/op > file://CVE-2025-15467-02.patch \ > file://CVE-2025-15467-03.patch \ > file://CVE-2025-15468.patch \ > + file://CVE-2025-69419.patch \ > " > > SRC_URI:append:class-nativesdk = " \ -- Yoann Congal Smile ECS
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#231421): https://lists.openembedded.org/g/openembedded-core/message/231421 Mute This Topic: https://lists.openembedded.org/mt/117594846/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
