Backport implicit rejection mechanism for RSA PKCS#1 v1.5 to RHEL-8 series
2020-25659)
17696

Fix CVE-2023-5678: Generating excessively long X9.42 DH keys or checking
16538

Fix CVE-2023-3446: Excessive time spent checking DH keys and parameters
14245
Fix CVE-2023-3817: Excessive time spent checking DH q parameter value
14239

Fixed Timing Oracle in RSA Decryption
2022-4304
Fixed Double free after calling PEM_read_bio_ex
2022-4450
Fixed Use-after-free following BIO_new_NDEF
2023-0215
Fixed X.400 address type confusion in X.509 GeneralName
2023-0286

Fix no-ec build

Fix CVE-2022-2097: AES OCB fails to encrypt some bytes on 32-bit x86
2022-2097
Update expired certificates used in the testsuite
Fix CVE-2022-1292: openssl: c_rehash script allows command injection
Fix CVE-2022-2068: the c_rehash script allows command injection

Fixes CVE-2022-0778 openssl: Infinite loop in BN_mod_sqrt() reachable when parsing certificates
Resolves: rhbz#2067146

Fixes CVE-2021-3712 openssl: Read buffer overruns processing ASN.1 strings
Resolves: rhbz#2005402

Fixes bugs in s390x AES code.
Uses the first detected address family if IPv6 is not available
Reverts the changes in https://github.com/openssl/openssl/pull/13305
https://trac.nginx.org/nginx/ticket/2071#comment:1
879939938, nginx
Resolves: rhbz#1978214
Related: rhbz#1934534

Cleansup the peer point formats on renegotiation
Resolves rhbz#1965362

Fixes FIPS_selftest to work in FIPS mode. Resolves: rhbz#1940085
Using safe primes for FIPS DH self-test

Update to version 1.1.1k

Use AI_ADDRCONFIG only when explicit host name is given
Allow only curves defined in RFC 8446 in TLS 1.3

Remove 2-key 3DES test from FIPS_selftest

Fix CVE-2021-3450 openssl: CA certificate check bypass with
Fix CVE-2021-3449 NULL pointer deref in signature_algorithms processing

Fix CVE-2020-1971 ediparty null pointer dereference