[OpenSSL] Update to 3.0.7. #27594
[OpenSSL] Update to 3.0.7. #27594
Conversation
Fixes critical security vulnerability https://twitter.com/iamamoose/status/1584908434855628800 flags.patch part already applied by upstream removed. Download location changed to openssl.org while a github tag is still missing.
BillyONeal
added
info:internal
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
This is a new experimental fast check for PR issues. Please let us know if this bot is helpful!
PRs must add only one version and must not modify any published versions
When making any changes to a library, the version or port-version in vcpkg.json or CONTROL must be modified.
error: checked-in files for boringssl have changed but the version was not updated
version: 2021-06-23#3
old SHA: cb83700b7bf53177773421dfb803fb8478e6a72d
new SHA: d9944d73201e7ee9baffa0ee1d063e0f0f2ceccd
Did you remember to update the version or port version?
Use --overwrite-version to bypass this check
***No files were updated***
|
The removed part of the patch was applied in 3.0.6: openssl/openssl@openssl-3.0.5...openssl-3.0.6#diff-7b3a1a18da057a0a2350acd511dc2ab2f6f154b12af1233297e073169cc4db38R1312
|
|
This change is time sensitive and it is very likely to be OK given that all platforms are back green except x64-windows-static-md and x64-osx, so I'm merging this out of band. |
|
Out of band* |
|
Was OPENSSL_VERSION_FIX in vcpkg-cmake-wrapper.cmake.in supposed to be set to 7 in this PR as well? |
Yes, see #27618 |
Fixes 2 high security vulnerabilities https://www.openssl.org/news/secadv/20221101.txt (formerly known as https://twitter.com/iamamoose/status/1584908434855628800 )
flags.patch part already applied by upstream in 3.0.6 removed.