chore(deps): update dependency openssl/openssl to v3.4.1

[renovate]

This PR contains the following updates:

Package	Update	Change
openssl/openssl	minor	3.3.2 -> 3.4.1

---

Release Notes

openssl/openssl (openssl/openssl)

v3.4.1

Compare Source

• Fixed RFC7250 handshakes with unauthenticated servers don't abort as expected.

  Clients using RFC7250 Raw Public Keys (RPKs) to authenticate a
  server may fail to notice that the server was not authenticated, because
  handshakes don't abort as expected when the SSL_VERIFY_PEER verification mode
  is set.

  ([CVE-2024-12797])

  Viktor Dukhovni

• Fixed timing side-channel in ECDSA signature computation.

  There is a timing signal of around 300 nanoseconds when the top word of
  the inverted ECDSA nonce value is zero. This can happen with significant
  probability only for some of the supported elliptic curves. In particular
  the NIST P-521 curve is affected. To be able to measure this leak, the
  attacker process must either be located in the same physical computer or
  must have a very fast network connection with low latency.

  ([CVE-2024-13176])

  Tomáš Mráz

• Reverted the behavior change of CMS_get1_certs() and CMS_get1_crls()
  that happened in the 3.4.0 release. These functions now return NULL
  again if there are no certs or crls in the CMS object.

  Tomáš Mráz

v3.4.0

Compare Source

• Fixed timing side-channel in ECDSA signature computation.

  There is a timing signal of around 300 nanoseconds when the top word of
  the inverted ECDSA nonce value is zero. This can happen with significant
  probability only for some of the supported elliptic curves. In particular
  the NIST P-521 curve is affected. To be able to measure this leak, the
  attacker process must either be located in the same physical computer or
  must have a very fast network connection with low latency.

  ([CVE-2024-13176])

  Tomáš Mráz

• Reverted the behavior change of CMS_get1_certs() and CMS_get1_crls()
  that happened in the 3.4.0 release. These functions now return NULL
  again if there are no certs or crls in the CMS object.

  Tomáš Mráz

v3.3.3

Compare Source

• Fixed possible OOB memory access with invalid low-level GF(2^m) elliptic
  curve parameters.

  Use of the low-level GF(2^m) elliptic curve APIs with untrusted
  explicit values for the field polynomial can lead to out-of-bounds memory
  reads or writes.
  Applications working with "exotic" explicit binary (GF(2^m)) curve
  parameters, that make it possible to represent invalid field polynomials
  with a zero constant term, via the above or similar APIs, may terminate
  abruptly as a result of reading or writing outside of array bounds. Remote
  code execution cannot easily be ruled out.

  ([CVE-2024-9143])

  Viktor Dukhovni

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.