LibreSSL releases 4.4.1 and 4.3.5 with security and interoperability fixes

The LibreSSL project has announced the release of two maintenance updates: version 4.4.1 and version 4.3.5. These releases target existing users of the 4.4 and 4.3 series respectively, providing critical bugfixes and security patches.

Version 4.4.1 specifically addresses a security vulnerability and a reliability issue, while 4.3.5 focuses on improving connection stability. These updates are intended to be distributed via OpenBSD mirrors and will be available for deployment via the syspatch utility.

Technical changes in LibreSSL 4.4.1 and 4.3.5

• Security Fix (4.4.1): Resolves an out-of-bounds read vulnerability that could occur during the renegotiation process within the TLSv1.2 protocol.
• Interoperability Fix (4.4.1 & 4.3.5): Corrects a reliability issue where TLS connections would fail when communicating with peers that transmit more than 32 signature algorithms.
• Deployment Path: Updates are being integrated into OpenBSD mirrors and are expected to be available for syspatch and sysupgrade -s on -current snapshots.

Why it matters

These updates are vital for maintaining the security posture of systems relying on LibreSSL for encrypted communications, particularly those using TLSv1.2. The interoperability fix ensures more reliable connections in environments with complex or non-standard cryptographic configurations.