From 3046144e8ed713f652ff91e64ffb54289597d9c8 Mon Sep 17 00:00:00 2001 From: Dmitry Belyavskiy Date: Thu, 13 Aug 2026 11:36:03 +0200 Subject: [PATCH] In FIPS mode when neither FIPS provider nor FIPS provider configuration is present, OpenSSL silently falls back to the default provider. Resolves: RHEL-239862 --- 0019-FIPS-Force-fips-provider-on.patch | 4 ++-- openssl.spec | 7 ++++++- 2 files changed, 8 insertions(+), 3 deletions(-) diff --git a/0019-FIPS-Force-fips-provider-on.patch b/0019-FIPS-Force-fips-provider-on.patch index f8b7415..afb8550 100644 --- a/0019-FIPS-Force-fips-provider-on.patch +++ b/0019-FIPS-Force-fips-provider-on.patch @@ -51,6 +51,8 @@ index f2e76ac402..a2a8a9942c 100644 + OSSL_LIB_CTX *libctx = NCONF_get0_libctx((CONF *)cnf); +# define FIPS_LOCAL_CONF OPENSSLDIR "/fips_local.cnf" + ++ if (EVP_default_properties_enable_fips(libctx, 1) != 1) ++ return 0; + if (access(FIPS_LOCAL_CONF, R_OK) == 0) { + CONF *fips_conf = NCONF_new_ex(libctx, NCONF_default()); + if (NCONF_load(fips_conf, FIPS_LOCAL_CONF, NULL) <= 0) @@ -67,8 +69,6 @@ index f2e76ac402..a2a8a9942c 100644 + } + if (provider_conf_activate(libctx, "base", NULL, NULL, 0, NULL) != 1) + return 0; -+ if (EVP_default_properties_enable_fips(libctx, 1) != 1) -+ return 0; + } + return 1; diff --git a/openssl.spec b/openssl.spec index e0b52e8..f9a33de 100644 --- a/openssl.spec +++ b/openssl.spec @@ -29,7 +29,7 @@ print(string.sub(hash, 0, 16)) Summary: Utilities from the general purpose cryptography library with TLS implementation Name: openssl Version: 3.5.7 -Release: 2%{?dist} +Release: 3%{?dist} Epoch: 1 Source0: openssl-%{version}.tar.gz Source1: fips-hmacify.sh @@ -457,6 +457,11 @@ ln -s /etc/crypto-policies/back-ends/openssl_fips.config $RPM_BUILD_ROOT%{_sysco %ldconfig_scriptlets libs %changelog +* Thu Aug 13 2026 Dmitry Belyavskiy - 1:3.5.7-3 +- In FIPS mode when neither FIPS provider nor FIPS provider configuration is + present, OpenSSL silently falls back to the default provider. + Resolves: RHEL-239862 + * Tue Jul 07 2026 Pavol Žáčik - 1:3.5.7-2 - Backport https://github.com/openssl/openssl/pull/31818 Resolves: RHEL-192424