You are viewing a plain text version of this content. The canonical link for it is here.
Posted to c-commits@axis.apache.org by ro...@apache.org on 2026/07/01 18:23:46 UTC
(axis-axis2-c-core) 04/08: Bump OpenSSL minimum to 3.0.21 (June 2026 advisory)
This is an automated email from the ASF dual-hosted git repository.
robertlazarski pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/axis-axis2-c-core.git
commit f8a66a1d11b7197ec3bf218a18fd4a848aa6fd2c
Author: Robert Lazarski <ro...@gmail.com>
AuthorDate: Wed Jul 1 05:25:04 2026 -1000
Bump OpenSSL minimum to 3.0.21 (June 2026 advisory)
Surfaced immediately by the reworked CVE checker: OpenSSL 3.0.16 falls
inside the affected range of six HIGH/CRITICAL CVEs published 2026-06-09
(CVE-2026-34180/34182/45445/45447/7383/9076), fixed in 3.0.21 on the 3.0
branch and 3.5.7 on the 3.5 LTS line. Update the minimum and keep the
workflow MIN map in sync.
Co-Authored-By: Claude Opus 4.8 (1M context) <no...@anthropic.com>
---
docs/SECURITY.md | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/docs/SECURITY.md b/docs/SECURITY.md
index 1e064156e..8f3de1b7d 100644
--- a/docs/SECURITY.md
+++ b/docs/SECURITY.md
@@ -625,7 +625,7 @@ message contents. **This flag must never be used in production builds.**
| Dependency | Minimum Version | Critical CVEs Addressed |
|------------|-----------------|------------------------|
-| OpenSSL | 3.0.16+ (prefer 3.5 LTS) | CVE-2022-0778 (BN_mod_sqrt DoS), CVE-2021-3449/3450. **1.1.1 reached EOL 2023-09-11 and receives no public fixes; 3.0 LTS reaches EOL 2026-09-07, so new deployments should target 3.5 LTS.** |
+| OpenSSL | 3.0.21+ (prefer 3.5.7+ LTS) | June 2026 batch (CVE-2026-34180/34182/45445/45447/7383/9076, fixed 3.0.21 / 3.5.7), CVE-2022-0778 (BN_mod_sqrt DoS), CVE-2021-3449/3450. **1.1.1 reached EOL 2023-09-11 and receives no public fixes; 3.0 LTS reaches EOL 2026-09-07, so new deployments should target 3.5 LTS.** |
| libxml2 | 2.13.9+ | CVE-2024-25062 (use-after-free, fixed 2.11.7/2.12.5/2.13.4), CVE-2020-24977, CVE-2019-20388 |
| json-c | 0.18+ | CVE-2020-12762 (integer overflow); 0.19 is current (2026-06-27) |
| nghttp2 | 1.61.0+ | CVE-2024-28182 (unbounded CONTINUATION-frame DoS, fixed 1.61.0), CVE-2023-44487 (rapid reset) |