From nobody Tue Oct 10 14:30:56 2023 X-Original-To: freebsd-stable@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4S4dcj277jz4wqlH for ; Tue, 10 Oct 2023 14:31:17 +0000 (UTC) (envelope-from hausen@punkt.de) Received: from mail.punkt.de (mail.punkt.de [IPv6:2a00:b580:8000:11:1c6b:7032:35e9:5616]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 4S4dch1Kbnz4Pwf for ; Tue, 10 Oct 2023 14:31:16 +0000 (UTC) (envelope-from hausen@punkt.de) Authentication-Results: mx1.freebsd.org; dkim=none; spf=pass (mx1.freebsd.org: domain of hausen@punkt.de designates 2a00:b580:8000:11:1c6b:7032:35e9:5616 as permitted sender) smtp.mailfrom=hausen@punkt.de; dmarc=none Received: from smtpclient.apple (unknown [IPv6:2a00:b580:a000:0:b8f2:44d3:a00d:5aed]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.punkt.de (Postfix) with ESMTPSA id 03C2159EE1 for ; Tue, 10 Oct 2023 16:31:06 +0200 (CEST) From: "Patrick M. Hausen" Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable List-Id: Production branch of FreeBSD source code List-Archive: https://lists.freebsd.org/archives/freebsd-stable List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-freebsd-stable@freebsd.org X-BeenThere: freebsd-stable@freebsd.org Mime-Version: 1.0 (Mac OS X Mail 16.0 \(3731.700.6\)) Subject: State of OpenSSL in releng/13.2? Message-Id: <7B2F19E4-BB12-47FC-BBB6-493E301BDFBB@punkt.de> Date: Tue, 10 Oct 2023 16:30:56 +0200 To: FreeBSD-STABLE Mailing List X-Mailer: Apple Mail (2.3731.700.6) X-Spamd-Bar: - X-Spamd-Result: default: False [-1.80 / 15.00]; SUBJECT_ENDS_QUESTION(1.00)[]; NEURAL_HAM_MEDIUM(-1.00)[-1.000]; NEURAL_HAM_LONG(-1.00)[-1.000]; NEURAL_HAM_SHORT(-1.00)[-0.998]; MV_CASE(0.50)[]; R_SPF_ALLOW(-0.20)[+ip6:2a00:b580::/32]; MIME_GOOD(-0.10)[text/plain]; MLMMJ_DEST(0.00)[freebsd-stable@freebsd.org]; ASN(0.00)[asn:16188, ipnet:2a00:b580::/32, country:DE]; FROM_EQ_ENVFROM(0.00)[]; R_DKIM_NA(0.00)[]; RCVD_COUNT_ONE(0.00)[1]; TO_DN_ALL(0.00)[]; RCVD_VIA_SMTP_AUTH(0.00)[]; RCPT_COUNT_ONE(0.00)[1]; MID_RHS_MATCH_FROM(0.00)[]; ARC_NA(0.00)[]; MIME_TRACE(0.00)[0:+]; FROM_HAS_DN(0.00)[]; PREVIOUSLY_DELIVERED(0.00)[freebsd-stable@freebsd.org]; TO_MATCH_ENVRCPT_ALL(0.00)[]; DMARC_NA(0.00)[punkt.de]; RCVD_TLS_ALL(0.00)[] X-Rspamd-Queue-Id: 4S4dch1Kbnz4Pwf Hi all, FreeBSD 13.2-p4 seems to have OpenSSL 1.1.1t released 2023-02. Since then 3 new minor versions have been published: 1.1.1u 2023-03 1.1.1v 2023-08 1.1.1w 2023-09 all of which fix security vulnerabilities according to: https://www.openssl.org/news/vulnerabilities.html 1.1.1w seems to be in releng/13 but not in releng/13.2. Aren't releases supposed to receive security updates? Kind regards, Patrick --=20 punkt.de GmbH Patrick M. Hausen .infrastructure Sophienstr. 187 76185 Karlsruhe Tel. +49 721 9109500 https://infrastructure.punkt.de info@punkt.de AG Mannheim 108285 Gesch=C3=A4ftsf=C3=BChrer: Daniel Lienert, Fabian Stein