-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Mon, 29 Jun 2026 10:14:22 -0600 Source: wolfssl Architecture: source Version: 5.5.4-2+deb12u3 Distribution: bookworm-security Urgency: high Maintainer: Jacob Barthelmeh <sirkilamole@msn.com> Changed-By: Jacob Barthelmeh <sirkilamole@msn.com> Changes: wolfssl (5.5.4-2+deb12u3) bookworm-security; urgency=high . * Backport upstream security fixes. (See #1140765, #1140815) * CVE-2026-5194: enforce that a certificate signatureAlgorithm OID matches the issuer key type, preventing acceptance of forged ECDSA/EdDSA certificate signatures. * CVE-2026-55961: reject degenerate (certs-only) PKCS#7 objects with no verified signer in wolfSSL_PKCS7_verify(). * CVE-2026-55967: reject AES-GCM cumulative message sizes that would overflow the 32-bit counters in the streaming update API. * CVE-2026-55962: require a client Certificate/CertificateVerify when a TLS 1.3 post-handshake CertificateRequest is outstanding. * CVE-2026-7511: report the certificate that actually verified the signature as the PKCS#7 signer. * CVE-2026-6731: apply DNS name constraints to the Subject Common Name when no subjectAltName is present. * CVE-2026-6681: honour the caller-supplied output buffer size in the PKCS#7 decode paths. * CVE-2026-6678: fix an integer underflow in wc_PKCS7_DecryptOri when handling crafted OtherRecipientInfo. * CVE-2026-6450: reject CRLs containing unrecognized critical extensions. * CVE-2026-6329: reject PKCS#12 MAC length mismatches instead of comparing an attacker-controlled length. * CVE-2026-6325: bound the index in SetSuitesHashSigAlgo to prevent an out-of-bounds write. * CVE-2026-6094: bound the encrypted-content size in wc_PKCS7_DecodeEnvelopedData to prevent a heap over-read. * CVE-2026-6092: enforce Encrypt-then-MAC on the TLS resumption path. * CVE-2026-6331: require an exact-length HMAC tag in EVP_DigestVerifyFinal. Checksums-Sha1: 6f1d9ff0bb57665ee4ffbb965e14ebf04a7f55de 2058 wolfssl_5.5.4-2+deb12u3.dsc 4bcc579575c83669e6628a64aa7ff953ce7271e9 19288452 wolfssl_5.5.4.orig.tar.gz 7d847fd9214127ed789f108e61a45c35635ee7d3 488 wolfssl_5.5.4.orig.tar.gz.asc 2546b2d457d315c2f6f29fa55074c681fa7eb63e 40708 wolfssl_5.5.4-2+deb12u3.debian.tar.xz 15090769d9c328150cd226a89937fe0371f1e57b 5519 wolfssl_5.5.4-2+deb12u3_source.buildinfo Checksums-Sha256: 41cc3bce69a14214cc16f03f87e1292d8a2f95c03bbf94f49ca36b010989a81a 2058 wolfssl_5.5.4-2+deb12u3.dsc b7ee150e49def77c765bc02aac92ddeb0bebefd4cb12aa263d8f95e405221fb8 19288452 wolfssl_5.5.4.orig.tar.gz 6176799b4a6861c42b88e2d574f31cf11fc382e7c5c5a17706d8499368ca636b 488 wolfssl_5.5.4.orig.tar.gz.asc 79565eb855d557eb062cb88b033b6fe96e2a6e598236021b81b9840bef5ab6f4 40708 wolfssl_5.5.4-2+deb12u3.debian.tar.xz 3a87d11a788e6075a7f26ffd1798b60fb771de654f35b37b68c549cb920d51cc 5519 wolfssl_5.5.4-2+deb12u3_source.buildinfo Files: 6a2dcfa91eb8ff044cc78c028d4a1fdc 2058 libs optional wolfssl_5.5.4-2+deb12u3.dsc bc3c8c7b08d7c909bfce6bca2cb9361e 19288452 libs optional wolfssl_5.5.4.orig.tar.gz c609f88fe97b5319c59678cea641cc47 488 libs optional wolfssl_5.5.4.orig.tar.gz.asc b9ee69dbea2aa886c8b571f150782440 40708 libs optional wolfssl_5.5.4-2+deb12u3.debian.tar.xz 6500baa0e65f3c7efa24c6d39ccf0d1f 5519 libs optional wolfssl_5.5.4-2+deb12u3_source.buildinfo -----BEGIN PGP SIGNATURE----- iQHEBAEBCgAuFiEEQGIgyLhVKAI3jM5BH1x6i0VWQxQFAmpUkWgQHGJhZ2VAZGVi aWFuLm9yZwAKCRAfXHqLRVZDFDwEC/4n/lrLumVHoDPun4jvDQhShePXwRCqMVms DH3u5ZSt2iRey9K0g+W1JigEWgncU2HL9VXJdEqjBsQBIH9yngoZbXmbCIcTmgNp qdI+MJy7p4cvXrS4mfkwQxEt2VnYFE+QM7GLeeoY1cTeQ3pYazhXXCXFJByHVDtw uyVnHvOfphCo+Cps68acS+eo7AE6GOOp79BZvXHJ2Nw4mz2Gx0Y+6YsR5MY+SwfK MUICvmUcDfWEOn6iewZ8KtW+wre16/Q+06NaB9BKazxBy5+XpJZoplG+X7OxSrrI LL7QFjXNbhkjk3ZFQ7AL8fiKZNsToURTM6/Z1W6jcRqrmfL3xD5WlESJKD/2prUF 4M7/6dwqfepE1wBf2WWHOwQSYjGKFGhMnYHbBa3TjdvfStDEzMSYEidN9MwVzixy 3MSINaMlENKsWlAkrm1/CMrJpu2wrtAV9j+uSgIx68d6NkIREvxdzpLrba/Csp/e JurDYoeB0iiiCs5vcQgP7hecIAJ0sfU= =Jg1m -----END PGP SIGNATURE-----
