chore(deps): update dependency openssl/openssl to v3.6.4 - #47
Merged
Conversation
renovate
Bot
added
dependencies
There was a problem hiding this comment.
Pull request overview
Updates the pinned OpenSSL source version used by the legacy Alpine-based Docker build images (Python and Python+NodeJS FIPS) to incorporate the OpenSSL 3.6.4 security patch release.
Changes:
- Bump
OPENSSL_VERSIONfrom3.6.3to3.6.4in the legacy Python image Dockerfile. - Bump
OPENSSL_VERSIONfrom3.6.3to3.6.4in the legacy Python+NodeJS image Dockerfile.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
| legacy/Dockerfile_python_nodejs | Updates the OpenSSL version argument to build against OpenSSL 3.6.4. |
| legacy/Dockerfile_python | Updates the OpenSSL version argument to build against OpenSSL 3.6.4. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
3.6.3→3.6.4Release Notes
openssl/openssl (openssl/openssl)
v3.6.4: OpenSSL 3.6.4Compare Source
OpenSSL 3.6.4 is a security patch release. The most severe CVE fixed
in this release is Moderate.
This release incorporates the following bug fixes and mitigations:
Fixed QUIC server being able to trigger double free when processing
INITIALpacket.(CVE-2026-18798)
Fixed heap buffer overflow in CMS key unwrapping.
(CVE-2026-63072)
Fixed invalid pointer dereference in CMP server via crafted
protectionAlg.(CVE-2026-63076)
Fixed unbounded memory growth in QUIC server incoming channel queue.
(CVE-2026-14456)
Fixed RPK server signature algorithm selection being able to dereference
a missing certificate.
(CVE-2026-14457)
Fixed excessive memory use buffering DTLS records for a future epoch.
(CVE-2026-54874)
Fixed client-side memory leak in OCSP response checking.
(CVE-2026-54876)
Fixed untrusted Sender DN being used as a format string in CMP response
validation.
(CVE-2026-63073)
Fixed CMP indefinite cache growth of
extraCerts.(CVE-2026-63074)
Fixed QUIC ACK-only packet retention being able to cause memory exhaustion.
(CVE-2026-63075)
Fixed possibility of AEAD forgeries with empty ciphertext when using
EVP_Cipher().(CVE-2026-75803)
Fixed checking of authentication tags for empty ciphertexts for AEAD ciphers
in CCM cipher mode.
Configuration
📅 Schedule: (in timezone Europe/Paris)
* 0-4,22-23 * * 1-5)* * * * 0,6)🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.