Add workaround for EVP_PKEY_CTX_add1_hkdf_info with older providers
40823

Rebase to OpenSSL 3.2.2. Fixes CVE-2024-2511, CVE-2024-4603, CVE-2024-4741,
32148
36792
38514
39111

Update RNG changing for FIPS purpose
35380

Rebasing OpenSSL to 3.2.1
26271

Use certified FIPS module instead of freshly built one in Red Hat distribution
23474

Avoid implicit function declaration when building openssl
1780
In FIPS mode, prevent any other operations when rsa_keygen_pairwise_test fails
17104
Add a directory for OpenSSL providers configuration
17193
Eliminate memory leak in OpenSSL when setting elliptic curves on SSL context
19515
POLY1305 MAC implementation corrupts vector registers on PowerPC (CVE-2023-6129)
21151
Excessive time spent checking invalid RSA public keys (CVE-2023-6237)
21654
SSL ECDHE Kex fails when pkcs11 engine is set in config file
20249
Denial of service via null dereference in PKCS#12
22486
Use certified FIPS module instead of freshly built one in Red Hat distribution
23474

Provide relevant diagnostics when FIPS checksum is corrupted
5317
Don't limit using SHA1 in KDFs in non-FIPS mode.
5295
Provide empty evp_properties section in main OpenSSL configuration file
11439
Avoid implicit function declaration when building openssl
1780
Forbid explicit curves when created via EVP_PKEY_fromdata
5304
AES-SIV cipher implementation contains a bug that causes it to ignore empty
2023-2975)
5302
Excessive time spent checking DH keys and parameters (CVE-2023-3446)
5306
Excessive time spent checking DH q parameter value (CVE-2023-3817)
5308
Fix incorrect cipher key and IV length processing (CVE-2023-5363)
13251
Switch explicit FIPS indicator for RSA-OAEP to approved following
14083
Backport the check required by SP800-56Br2 6.4.1.2.1 (3.c)
14083
Add missing ECDH Public Key Check in FIPS mode
15990
Excessive time spent in DH check/generation with large Q parameter value (CVE-2023-5678)
15954

Make FIPS module configuration more crypto-policies friendly

Add a workaround for lack of EMS in FIPS mode

Remove unsupported curves from nist_curves.

Remove the listing of brainpool curves in FIPS mode.

Fix possible DoS translating ASN.1 object identifiers
2023-2650
Release the DRBG in global default libctx early

Re-enable DHX keys in FIPS mode, disable FIPS 186-4 parameter validation and generation in FIPS mode

Use OAEP padding and aes-128-cbc by default in cms command in FIPS mode

Enforce using EMS in FIPS mode - better alerts

Upload new upstream sources without manually hobbling them.
Remove the hobbling script as it is redundant. It is now allowed to ship
ec2m' Configure option. The additional forbidden
160, P-192, wap-tls curves are manually removed by updating
Remove-EC-curves.patch.
Enable Brainpool curves.
Apply the changes to ec_curve.c and ectest.c as a new patch
Add-changes-to-ectest-and-eccurve.patch instead of replacing them.
Modify 0011-Remove-EC-curves.patch to allow Brainpool curves.
Modify 0011-Remove-EC-curves.patch to allow code under macro OPENSSL_NO_EC2M.