wolfssl: update to 5.9.2

Release notes:
https://github.com/wolfSSL/wolfssl/releases/tag/v5.9.2-stable

This is a security release fixing 32 CVEs (6 High, 15 Med, 11 Low).
Many of them apply to the configuration built here: --enable-opensslall
and --enable-opensslextra are unconditional, and TLS 1.3, session
tickets and OCSP stapling default to y.

Fixes CVEs:
- CVE-2026-11310 (High)
- CVE-2026-11999 (High)
- CVE-2026-6679 (High)
- CVE-2026-55958 (High)
- CVE-2026-55960 (High)
- CVE-2026-55961 (High)
- CVE-2026-6731 (Med)
- CVE-2026-6091 (Med)
- CVE-2026-6094 (Med)
- CVE-2026-6329 (Med)
- CVE-2026-6330 (Med)
- CVE-2026-8720 (Med)
- CVE-2026-10097 (Med)
- CVE-2026-10098 (Med)
- CVE-2026-10592 (Med)
- CVE-2026-7532 (Med)
- CVE-2026-6291 (Med)
- CVE-2026-7511 (Med)
- CVE-2026-11703 (Med)
- CVE-2026-55962 (Med)
- CVE-2026-55964 (Med)
- CVE-2026-6092 (Low)
- CVE-2026-6331 (Low)
- CVE-2026-6681 (Low)
- CVE-2026-10512 (Low)
- CVE-2026-6678 (Low)
- CVE-2026-7531 (Low)
- CVE-2026-6325 (Low)
- CVE-2026-6412 (Low)
- CVE-2026-6450 (Low)
- CVE-2026-12340 (Low)
- CVE-2026-55967 (Low)

OCSP responder authorization is now strictly enforced per RFC 6960
4.2.2.2. The CheckOcspResponderChain() fallback, which accepted any
responder certificate issued by an ancestor of the target's issuer,
was removed. Setups relying on an indirectly issued OCSP responder
will start to fail validation.

Refreshed patches.

Signed-off-by: Sander van Deijck <sander@vandeijck.com>
Link: https://github.com/openwrt/openwrt/pull/24700
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>

diff --git a/package/libs/wolfssl/Makefile b/package/libs/wolfssl/Makefile
index 958a569a4e305ec3a69724a255e33610cfae282e..37725d6d524bf26cd6f55f0dadc4031e877572fd 100644 (file)
--- a/package/libs/wolfssl/Makefile
+++ b/package/libs/wolfssl/Makefile
@@ -8,13 +8,13 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=wolfssl
-PKG_VERSION:=5.9.1
+PKG_VERSION:=5.9.2
 PKG_REAL_VERSION:=$(PKG_VERSION)-stable
 PKG_RELEASE:=1
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_REAL_VERSION).tar.gz
 PKG_SOURCE_URL:=https://github.com/wolfSSL/wolfssl/archive/v$(PKG_REAL_VERSION)
-PKG_HASH:=d5ca7af48cd2d9a91d539e9baedeba55a0605a28d7ac8b01dc3d5254a13ca341
+PKG_HASH:=2f4ef3d4fd387a9b3191d36a6316d69116c46ff69bb9583b6c82b36d7b8ca114
 
 PKG_BUILD_DIR:=$(BUILD_DIR)/$(PKG_NAME)-$(BUILD_VARIANT)/$(PKG_NAME)-$(PKG_REAL_VERSION)
 

diff --git a/package/libs/wolfssl/patches/100-disable-hardening-check.patch b/package/libs/wolfssl/patches/100-disable-hardening-check.patch
index a31905ad892732ab691796781f9fd9e748bcde0c..e7cd333c77dca16aa62a235aa5e6fb1198bfe9fd 100644 (file)
--- a/package/libs/wolfssl/patches/100-disable-hardening-check.patch
+++ b/package/libs/wolfssl/patches/100-disable-hardening-check.patch
@@ -1,6 +1,6 @@
 --- a/wolfssl/wolfcrypt/settings.h
 +++ b/wolfssl/wolfcrypt/settings.h
-@@ -4154,7 +4154,7 @@ extern void uITRON4_free(void *p) ;
+@@ -4281,7 +4281,7 @@
  
  /* warning for not using harden build options (default with ./configure) */
  /* do not warn if big integer support is disabled */