-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-EN-26:21.openssl Errata Notice The FreeBSD Project Topic: OpenSSL pkg-config files contain incorrect versions Category: contrib Module: openssl Announced: 2026-08-25 Affects: FreeBSD 14.4 Corrected: 2026-08-07 19:37:45 UTC (stable/14, 14.4-STABLE) 2026-08-25 16:00:23 UTC (releng/14.4, 14.4-RELEASE-p9) For general information regarding FreeBSD Errata Notices and Security Advisories, including descriptions of the fields above, security branches, and the following sections, please visit <URL:https://security.FreeBSD.org/>. I. Background FreeBSD includes software from the OpenSSL Project. The OpenSSL Project is a collaborative effort to develop a robust, commercial-grade, full-featured Open Source toolkit for the Transport Layer Security (TLS) protocol. It is also a general-purpose cryptography library. Alongside the libraries, the base system installs the pkg-config metadata files libcrypto.pc, libssl.pc, and openssl.pc in /usr/libdata/pkgconfig. These record the compiler and linker flags needed to build against OpenSSL, along with the version installed. II. Problem Description The pkg-config files are no longer generated at build time and are instead maintained in the source tree. The copies checked in on FreeBSD 14 were taken from the OpenSSL 3.5 branch and reported version 3.5.1, while the OpenSSL release actually installed on that branch is 3.0.x. III. Impact Software that queries pkg-config to determine the installed OpenSSL version is told 3.5.1, and may assume interfaces that OpenSSL 3.0 does not provide. A build gated on the reported version can fail to compile or link, or select a code path unsuited to the installed library. The OpenSSL libraries themselves are correct and unaffected. IV. Workaround The version can be corrected in place by editing the Version: line in /usr/libdata/pkgconfig/libcrypto.pc, libssl.pc, and openssl.pc to match the version reported by openssl(1). Systems that do not build software against the base system OpenSSL are not affected. V. Solution Upgrade your system to a supported FreeBSD stable or release / security branch (releng) dated after the correction date. No reboot is required. Perform one of the following: 1) To update your system installed from binary distribution sets: Systems running a RELEASE version of FreeBSD on the amd64 or arm64 platforms which were not installed using base system packages can be updated via the freebsd-update(8) utility: # freebsd-update fetch # freebsd-update install 2) To update your system via a source code patch: The following patches have been verified to apply to the applicable FreeBSD release branches. a) Download the relevant patch from the location below, and verify the detached PGP signature using your PGP utility. [FreeBSD 14.4] # fetch https://security.FreeBSD.org/patches/EN-26:21/openssl.patch # fetch https://security.FreeBSD.org/patches/EN-26:21/openssl.patch.asc # gpg --verify openssl.patch.asc b) Apply the patch. Execute the following commands as root: # cd /usr/src # patch -E -p0 < /path/to/patch c) Recompile the operating system using buildworld and installworld as described in <URL:https://www.FreeBSD.org/handbook/makeworld.html>. VI. Correction details This issue is corrected as of the corresponding Git commit hash in the following stable and release branches: Branch/path Hash Revision - ------------------------------------------------------------------------- stable/14/ 2e04d9868823 stable/14-n274843 releng/14.4/ 357aa8af5304 releng/14.4-n273757 - ------------------------------------------------------------------------- Run the following command to see which files were modified by a particular commit: # git show --stat <commit hash> Or visit the following URL, replacing NNNNNN with the hash: <URL:https://cgit.freebsd.org/src/commit/?id=NNNNNN> To determine the commit count in a working tree (for comparison against nNNNNNN in the table above), run: # git rev-list --count --first-parent HEAD VII. References <URL:https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=297144> The latest revision of this advisory is available at <URL:https://security.FreeBSD.org/advisories/FreeBSD-EN-26:21.openssl.asc> -----BEGIN PGP SIGNATURE----- iQJPBAEBCgA5FiEEthUnfoEIffdcgYM7bljekB8AGu8FAmqN3XcbFIAAAAAABAAO bWFudTIsMi41KzEuMTIsMCwzAAoJEG5Y3pAfABrvveEQANAsU2LZOxLqjTPrYqlX 3/I8qWIaPJtl4zSFsgdHu2OwXUqxlY9+O24OO/0CrjC+0aC5cHtKao7/+59n0HAF Do8EAKduRTWlt+/+VkIc+BuDi/iUnYseYleBZ5lyb16NhwMUYuAgST7M39NgoSmY b521yI7H/d7NxKZ+qKG10/f1xGXIkAms+RrEbRwoxoFWHj8rpsOMwYl7zPRBenBi RmcEILQzjtqSunuy7BEPBpjlx6u8vbaLcer38mqPMA4EjUTw9HdTlwj4ND+rmCT6 fahABXBm1eugESTuowmb2fNpuyLWi8YEr8VFknN72NB+AoPHkdeAvjWghvLVvtc0 mU0wEqs7Mz04TGHwKJ3Tx+dyE/UlhDK8oZm19aWVZfB66h81orISfUFlB7F343yf t0/6z/Z/C4M3srB4z4woX5fJaIrs10yubt2HH/Jvrq4XslfCgD9U3NdXkhzHJBam r8HmKpsnQcmVI3ebhjfoHLLbPc73pXND/jLpc8VvqVNNNh5vwMFFnb6rq46GxfZI GfClFjF6u2/Hgf6WkJCd65iNb/fiFHUuxjwSkFTMWvbpP580NtOG5p2Lq5ksyxfz Jr76q3Fx+zJItwMmywwt0m6oJiJgDDNG8WT7goTpDn3/VMJs6mpyP8XUmIWGQN0F PO/wgtwmKw2HwVKwCfskM4tk =hF2I -----END PGP SIGNATURE-----
No comments:
Post a Comment