Changes between 3.5.3 and 3.5.4 [30 Sep 2025]$$$Fix Out-of-bounds read & write in RFC 3211 KEK Unwrap$$$$$$Issue summary: An application trying to decrypt CMS messages encrypted using password based encryption can trigger an out-of-bounds read and write.$$$$$$Impact summary: This out-of-bounds read may trigger a crash which leads to Denial of Service for an application. The out-of-bounds write can cause a memory corruption which can have various consequences including a Denial of Service or Execution of attacker-supplied code.$$$$$$The issue was reported by Stanislav Fort (Aisle Research).$$$$$$(CVE-2025-9230)$$$$$$Viktor Dukhovni$$$$$$Fix Timing side-channel in SM2 algorithm on 64 bit ARM$$$$$$Issue summary: A timing side-channel which could potentially allow remote recovery of the private key exists in the SM2 algorithm implementation on 64 bit ARM platforms.$$$$$$Impact summary: A timing side-channel in SM2 signature computations on 64 bit ARM platforms could allow recovering the private key by an attacker.

Changes between 3.5.1 and 3.5.2 [5 Aug 2025]$$$The FIPS provider now performs a PCT on key import for RSA; EC and ECX. This is mandated by FIPS 140-3 IG 10.3.A additional comment 1.$$$Dr Paul Dale

Changes between 3.5.1 and 3.5.2 [5 Aug 2025]$$$The FIPS provider now performs a PCT on key import for RSA; EC and ECX. This is mandated by FIPS 140-3 IG 10.3.A additional comment 1.$$$Dr Paul Dale

Release notes are not updated by $$$https://openssl-library.org/news/newslog/index.html

Release notes are not updated by $$$https://openssl-library.org/news/newslog/index.html

Release notes are not updated by $$$https://openssl-library.org/news/newslog/index.html

Release notes are not updated by $$$https://openssl-library.org/news/newslog/index.html

Release notes are not updated by $$$https://openssl-library.org/news/newslog/index.html

Major changes between OpenSSL 3.0.14 and OpenSSL 3.0.15 [3 Sep 2024]$$$OpenSSL 3.0.15 is a security patch release. The most severe CVE fixed in this release is Moderate.$$$$$$This release incorporates the following bug fixes and mitigations:$$$$$$Fixed possible denial of service in X.509 name checks ([CVE-2024-6119])$$$Fixed possible buffer overread in SSL_select_next_proto() ([CVE-2024-5535])

Major changes between OpenSSL 3.0.14 and OpenSSL 3.0.15 [3 Sep 2024]$$$OpenSSL 3.0.15 is a security patch release. The most severe CVE fixed in this release is Moderate.$$$$$$This release incorporates the following bug fixes and mitigations:$$$$$$Fixed possible denial of service in X.509 name checks ([CVE-2024-6119])$$$Fixed possible buffer overread in SSL_select_next_proto() ([CVE-2024-5535])