What's Changed
- Clear buffered cipher state per record in aead_tls_open by @WillChilds-Klein in #3587
- Deduplicate digest algorithms in PKCS7_dataInit by @spwalgren in #3579
- Reset cached extension state when reusing an X509 or X509_CRL by @WillChilds-Klein in #3584
- Honor restricted PSS min saltlen for AUTO verify by @justsmth in #3470
- Check
EVP_PKEY_assign_EC_KEYreturn by @prasden in #3620 - Add SHA2-224 and establish the SHA-2 variant pattern by @geedo0 in #3449
- Grow BIO_read_asn1's buffer incrementally, not from the claimed length by @WillChilds-Klein in #3583
- Adding RC2 EVP key length signed truncation guard by @spwalgren in #3589
- Implement remaining SHA2 digests by @geedo0 in #3485
- Salt len truncation fix by @spwalgren in #3570
- Reject repeated AES-XTS data unit operations by @nebeid in #3621
- Verify provider-wide algorithm reachability by @geedo0 in #3486
- Fix -Wunused-but-set-global in fork_ube_detect.c by @samuel40791765 in #3645
- Reject failed signature controls (CWE-393) by @justsmth in #3643
- Reserve alignment slack in SSLBuffer max capacity by @samuel40791765 in #3642
- fix(ci): scope id-token permission to report-failures job in integration omnibus by @dougch in #3640
- Fix -Wunused-but-set-global in rand_isolated_test.cc by @justsmth in #3648
- Validate OCSP HTTP request inputs by @prasden in #3639
- Ensure UBE is caught between thread-local state init and uniqueness test by @torben-hansen in #3654
- Bump the github-actions group across 1 directory with 3 updates by @dependabot[bot] in #3627
- Bump urllib3 from 2.7.0 to 2.8.0 in /tests/ci by @dependabot[bot] in #3606
- Bump rustls from 0.23.40 to 0.23.45 in /tests/ci/lambda by @dependabot[bot] in #3649
- Add FIPS support to the aws-lc-provider by @geedo0 in #3487
- Bump the cargo-ci-lambda group across 1 directory with 3 updates by @dependabot[bot] in #3658
- Bump the pip-ci group across 1 directory with 3 updates by @dependabot[bot] in #3657
- Scope OCSP noCheck exemption to the responder certificate by @WillChilds-Klein in #3576
- fix(ci): running ci in dedicated msys shell by @spwalgren in #3669
- Reject ECH configuration on DTLS connections by @WillChilds-Klein in #3578
- Import s2n-bignum 2026-09-29 by @justsmth in #3661
- fix(ssl): Reject non-ECDHE cipher in handback by @spwalgren in #3653
- Implement aws-lc-provider error queue handling by @geedo0 in #3488
- Use CMake find_package for OpenSSL by @geedo0 in #3662
- Move AArch64 Keccak round constants out of .text by @justsmth in #3674
- tool-openssl: support cipher name as command (e.g. openssl aes-256-cbc) by @PlasmaIntec in #3666
- Make the SSL_SHA256 constant non-overlapping with the rest by @aydinmercan in #3659
- Fix PKCS12 password prompt test isolation on OpenBSD by @justsmth in #3680
- tool-openssl: add openssl rand subcommand by @PlasmaIntec in #3664
- tool-openssl: add password-based key derivation to openssl enc by @PlasmaIntec in #3665
- feat(tool-openssl): add x509 -serial/-addtrust/-trustout by @spwalgren in #3636
- Hold HPKE key and context buffers out of line by @WillChilds-Klein in #3637
- Explicitly block a small set of intermediates by @torben-hansen in #3688
- feat(tool-openssl): support CA signing, revocation, and CRLs in ca by @spwalgren in #3634
- feat(tool-openssl): add ocsp command by @spwalgren in #3635
- Prepare v5.12.0 by @justsmth in #3689
New Contributors
- @PlasmaIntec made their first contribution in #3666
- @aydinmercan made their first contribution in #3659
Full Changelog: v5.11.0...v5.12.0