Subject: Re: bug#64991: [PATCH 0/1] OpenSSL 1.1: Fix 8 CVEs (max score: 7.5 high, 6850 dependent packages)
From: Ludovic Courtès <[email-masked]>
To: Denis 'GNUtoo' Carikli <[email-masked]>
Cc: Tobias Geerinckx-Rice <[email-masked]>, Simon Tournier <[email-masked]>, [email-masked], Christopher Baines <[email-masked]>, Ricardo Wurmus <[email-masked]>, Raghav Gururajan <[email-masked]>, jgart <[email-masked]>, Mathieu Othacehe <[email-masked]>, [email-masked]
Date: Thu, 28 Sep 2023 12:08:23 +0200
List-Id: <debbugs-submit.debbugs.gnu.org>

Hi,

Denis 'GNUtoo' Carikli <[email-masked]> skribis:

> Includes fixes for CVE-2023-0215, CVE-2023-0286, CVE-2023-0464, CVE-2023-0465,
> CVE-2023-0466, CVE-2023-2650, CVE-2022-4304, CVE-2022-4450.
>
> * gnu/packages/tls.scm (openssl-1.1): Update to 1.1.1u.

[...]

>  (define-public openssl-1.1
>    (package
>      (name "openssl")
> -    (version "1.1.1q")
> +    (version "1.1.1u")

Finally applied but as a graft, in commit
51e1df07b1d21840551eb8dc15b4bfe5612e1bf9.

Thanks,
Ludo’.