What's Changed
- Make NEON SHA3 assembler probe robust to -march overrides in CFLAGS by @justsmth in #3655
- [ci] fix: Make s_client TLS 1.1 integration tests self-contained by @justsmth in #3687
- fix(ssl): check handshake state in ClientHello getters by @prasden in #3602
- Check for int overflow in ASN1_STRING_print_ex and X509_NAME_print_ex output lengths by @justsmth in #3629
- Pin MySQL CI to 26.10.0 and sort release tags by version by @samuel40791765 in #3714
- Harden ChaCha20-Poly1305 EVP_CIPHER state handling by @justsmth in #3644
- Apply the name-constraints CN fallback to the end-entity certificate only by @abelianbee in #3603
- Fix wrapper escape in tool-openssl rand by @PlasmaIntec in #3690
- feat(tool-openssl): Add dgst -r coreutils output flag by @spwalgren in #3703
- Publish a failure metric from the nightly BSD CI run by @justsmth in #3692
- CI: stop giving containers the Docker socket and PR-run credentials by @jakemas in #3572
- Validate SHAKE MCT length inputs by @manastasova in #3719
- Normalize trailing dot in email name constraints by @nhatnghiho in #3650
- test(tool-openssl): Cover dgst -r -binary precedence and clean up temp dir by @spwalgren in #3729
- Don't crash on deep copy error in EC_GROUP_new and fix wrong time zone offset calculation by @torben-hansen in #3731
- For distrusted SPKIs, change error code to rejected by @torben-hansen in #3733
- Update security.md by @torben-hansen in #3734
- Return the default section from NCONF_get_section(conf, NULL) by @lopopolo in #3732
- feat(tool-openssl): Accept x509 -CAcreateserial for OpenSSL compatiility by @spwalgren in #3709
- Fix use-after-free in copied AES key-wrap contexts by @justsmth in #3711
- Preserve the TLS 1.3 cipher policy when a cipher setter fails by @justsmth in #3638
- Reject critical CRL distribution points when CRL checking is disabled by @nhatnghiho in #3652
- aws-lc-provider Refactors by @geedo0 in #3694
- Zeroise on Windows for all build mode types by @torben-hansen in #3684
- Clear unreported bytes written on early data reject by @stanleys12 in #3581
- Validate SHAKE output lengths in ACVP tooling by @manastasova in #3718
- feat(tool-openssl): Add digest selection to x509 signing by @spwalgren in #3710
- Retry BSD CI package installs to tolerate transient mirror errors by @justsmth in #3736
- Reject repeated AES-CCM encryption updates by @manastasova in #3721
- Add raw ChaCha20 EVP_CIPHER (EVP_chacha20) by @spwalgren in #3704
- Validate Ed25519 inputs in ACVP modulewrapper by @nebeid in #3626
- Harden ACVP large-data hash handling by @nebeid in #3628
- Pin RFC 6125 CN-fallback behavior for duplicate SANs by @sgmenda in #3668
- Prepare v5.13.0 by @justsmth in #3749
New Contributors
- @abelianbee made their first contribution in #3603
- @lopopolo made their first contribution in #3732
- @stanleys12 made their first contribution in #3581
Full Changelog: v5.12.0...v5.13.0