[Bug 2137464] Re: crypto/ec/asm/ecp_nistp521-ppc64.pl output regex failure

Wed Apr 8 12:18:53 UTC 2026

This bug was fixed in the package openssl - 3.5.3-1ubuntu3.3

---------------
openssl (3.5.3-1ubuntu3.3) questing-security; urgency=medium

  * SECURITY UPDATE: OpenSSL TLS 1.3 server may choose unexpected key
    agreement group
    - debian/patches/CVE-2026-2673.patch: fix group tuple handling in
      DEFAULT expansion in doc/man3/SSL_CTX_set1_curves.pod,
      ssl/t1_lib.c, test/tls13groupselection_test.c.
    - CVE-2026-2673
  * SECURITY UPDATE: NULL pointer dereference when processing an OCSP
    response
    - debian/patches/CVE-2026-28387.patch: dane_match_cert() should
      X509_free() on ->mcert instead of OPENSSL_free() in
      crypto/x509/x509_vfy.c.
    - CVE-2026-28387
  * SECURITY UPDATE: NULL Pointer Dereference When Processing a Delta CRL
    - debian/patches/CVE-2026-28388-1.patch: fix NULL Dereference When
      Delta CRL Lacks CRL Number Extension in crypto/x509/x509_vfy.c.
    - debian/patches/CVE-2026-28388-2.patch: Added test in test/*.
    - CVE-2026-28388
  * SECURITY UPDATE: Possible NULL dereference when processing CMS
    KeyAgreeRecipientInfo
    - debian/patches/CVE-2026-28389.patch: Fix NULL deref in
      [ec]dh_cms_set_shared_info in crypto/cms/cms_dh.c,
      crypto/cms/cms_ec.c.
    - CVE-2026-28389
  * SECURITY UPDATE: Possible NULL Dereference When Processing CMS
    KeyTransportRecipientInfo
    - debian/patches/CVE-2026-28390.patch: Fix NULL deref in
      rsa_cms_decrypt in crypto/cms/cms_rsa.c.
    - CVE-2026-28390
  * SECURITY UPDATE: Heap buffer overflow in hexadecimal conversion
    - debian/patches/CVE-2026-31789.patch: avoid possible buffer overflow
      in buf2hex conversion in crypto/o_str.c.
    - CVE-2026-31789
  * SECURITY UPDATE: Incorrect failure handling in RSA KEM RSASVE
    encapsulation
    - debian/patches/CVE-2026-31790-1.patch: validate RSA_public_encrypt()
      result in RSASVE in providers/implementations/kem/rsa_kem.c.
    - debian/patches/CVE-2026-31790-2.patch: test RSA_public_encrypt()
      result in RSASVE in test/evp_extra_test.c.
    - CVE-2026-31790
  * Fix ppc64 FTBFS because of incorrect regex match (LP: #2137464)
    - debian/patches/fix_ppc64_regex_match.patch: match last filename for
      output in ecp_nistp*-ppc64.pl.

 -- Marc Deslauriers <marc.deslauriers at ubuntu.com>  Tue, 07 Apr 2026
08:05:56 -0400

** Changed in: openssl (Ubuntu Questing)
       Status: New => Fix Released

** CVE added: https://cve.org/CVERecord?id=CVE-2026-2673

** CVE added: https://cve.org/CVERecord?id=CVE-2026-28387

** CVE added: https://cve.org/CVERecord?id=CVE-2026-28388

** CVE added: https://cve.org/CVERecord?id=CVE-2026-28389

** CVE added: https://cve.org/CVERecord?id=CVE-2026-28390

** CVE added: https://cve.org/CVERecord?id=CVE-2026-31789

** CVE added: https://cve.org/CVERecord?id=CVE-2026-31790

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to openssl in Ubuntu.
https://bugs.launchpad.net/bugs/2137464

Title:
  crypto/ec/asm/ecp_nistp521-ppc64.pl output regex failure

Status in openssl package in Ubuntu:
  Fix Released
Status in openssl source package in Jammy:
  New
Status in openssl source package in Noble:
  New
Status in openssl source package in Questing:
  Fix Released

Bug description:
  I have a scenario where the ecp_nistp521-ppc64.pl matches the
  incorrect param for output instead of crypto/ec/ecp_nistp521-ppc64.s

  Here is the build log on Ubuntu 24.04.

  CC="gcc" /usr/bin/perl ../crypto/ec/asm/ecp_nistp521-ppc64.pl
  "linux64le" -I. -Iinclude -Iproviders/common/include
  -Iproviders/implementations/include -I.. -I../include
  -I../providers/common/include -I../providers/implementations/include
  -fPIC -pthread -m64 -Wa,--noexecstack -Wall -fzero-call-used-
  regs=used-gpr -DOPENSSL_TLS_SECURITY_LEVEL=2 -Wa,--noexecstack -g -O3
  -ffile-prefix-map=/<<PKGBUILDDIR>>=. -fstack-protector-strong -Wformat
  -Werror=format-security -fno-stack-clash-protection -fdebug-prefix-
  map=/<<PKGBUILDDIR>>=/usr/src/openssl-3.0.13-0ubuntu3.7
  -DOPENSSL_USE_NODELETE -DL_ENDIAN -DOPENSSL_PIC
  -DOPENSSLDIR="\"/usr/lib/ssl\"" -DENGINESDIR="\"/usr/lib/powerpc64le-
  linux-gnu/engines-3\"" -DMODULESDIR="\"/usr/lib/powerpc64le-linux-
  gnu/ossl-modules\"" -DOPENSSL_BUILDING_OPENSSL -DNDEBUG -Wdate-time
  -D_FORTIFY_SOURCE=3 -DAES_ASM -DECP_NISTP521_ASM -DECP_NISTZ256_ASM
  -DKECCAK1600_ASM -DOPENSSL_BN_ASM_MONT -DOPENSSL_CPUID_OBJ
  -DPOLY1305_ASM -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DVPAES_ASM
  -DX25519_ASM  crypto/ec/ecp_nistp521-ppc64.s

  It matches -fdebug-prefix-
  map=/<<PKGBUILDDIR>>=/usr/src/openssl-3.0.13-0ubuntu3.7

  This leads to ecp_nistp521-ppc64.pl writing output to STDOUT instead
  of the file crypto/ec/ecp_nistp521-ppc64.s . The missing .s file leads
  to gcc erroring out and build failure.

  This does not happen on Questing and Resolute because the regex does
  not match the openssl version release, it will fail once we have an
  SRU.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/openssl/+bug/2137464/+subscriptions