-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

=============================================================================
FreeBSD-EN-26:21.openssl                                        Errata Notice
                                                          The FreeBSD Project

Topic:          OpenSSL pkg-config files contain incorrect versions

Category:       contrib
Module:         openssl
Announced:      2026-08-25
Affects:        FreeBSD 14.4
Corrected:      2026-08-07 19:37:45 UTC (stable/14, 14.4-STABLE)
                2026-08-25 16:00:23 UTC (releng/14.4, 14.4-RELEASE-p9)

For general information regarding FreeBSD Errata Notices and Security
Advisories, including descriptions of the fields above, security
branches, and the following sections, please visit
<URL:https://security.FreeBSD.org/>.

I.   Background

FreeBSD includes software from the OpenSSL Project.  The OpenSSL Project is a
collaborative effort to develop a robust, commercial-grade, full-featured
Open Source toolkit for the Transport Layer Security (TLS) protocol.  It is
also a general-purpose cryptography library.

Alongside the libraries, the base system installs the pkg-config metadata
files libcrypto.pc, libssl.pc, and openssl.pc in /usr/libdata/pkgconfig.
These record the compiler and linker flags needed to build against OpenSSL,
along with the version installed.

II.  Problem Description

The pkg-config files are no longer generated at build time and are instead
maintained in the source tree.  The copies checked in on FreeBSD 14 were
taken from the OpenSSL 3.5 branch and reported version 3.5.1, while the
OpenSSL release actually installed on that branch is 3.0.x.

III. Impact

Software that queries pkg-config to determine the installed OpenSSL version
is told 3.5.1, and may assume interfaces that OpenSSL 3.0 does not provide.
A build gated on the reported version can fail to compile or link, or select
a code path unsuited to the installed library.  The OpenSSL libraries
themselves are correct and unaffected.

IV.  Workaround

The version can be corrected in place by editing the Version: line in
/usr/libdata/pkgconfig/libcrypto.pc, libssl.pc, and openssl.pc to match the
version reported by openssl(1).  Systems that do not build software against
the base system OpenSSL are not affected.

V.   Solution

Upgrade your system to a supported FreeBSD stable or release / security
branch (releng) dated after the correction date.  No reboot is required.

Perform one of the following:

1) To update your system installed from binary distribution sets:

Systems running a RELEASE version of FreeBSD on the amd64 or arm64 platforms
which were not installed using base system packages can be updated via the
freebsd-update(8) utility:

# freebsd-update fetch
# freebsd-update install

2) To update your system via a source code patch:

The following patches have been verified to apply to the applicable
FreeBSD release branches.

a) Download the relevant patch from the location below, and verify the
detached PGP signature using your PGP utility.

[FreeBSD 14.4]
# fetch https://security.FreeBSD.org/patches/EN-26:21/openssl.patch
# fetch https://security.FreeBSD.org/patches/EN-26:21/openssl.patch.asc
# gpg --verify openssl.patch.asc

b) Apply the patch.  Execute the following commands as root:

# cd /usr/src
# patch -E -p0 < /path/to/patch

c) Recompile the operating system using buildworld and installworld as
described in <URL:https://www.FreeBSD.org/handbook/makeworld.html>.

VI.  Correction details

This issue is corrected as of the corresponding Git commit hash in the
following stable and release branches:

Branch/path                             Hash                     Revision
- -------------------------------------------------------------------------
stable/14/                              2e04d9868823    stable/14-n274843
releng/14.4/                            357aa8af5304  releng/14.4-n273757
- -------------------------------------------------------------------------

Run the following command to see which files were modified by a
particular commit:

# git show --stat <commit hash>

Or visit the following URL, replacing NNNNNN with the hash:

<URL:https://cgit.freebsd.org/src/commit/?id=NNNNNN>

To determine the commit count in a working tree (for comparison against
nNNNNNN in the table above), run:

# git rev-list --count --first-parent HEAD

VII. References

<URL:https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=297144>

The latest revision of this advisory is available at
<URL:https://security.FreeBSD.org/advisories/FreeBSD-EN-26:21.openssl.asc>
-----BEGIN PGP SIGNATURE-----

iQJPBAEBCgA5FiEEthUnfoEIffdcgYM7bljekB8AGu8FAmqN3XcbFIAAAAAABAAO
bWFudTIsMi41KzEuMTIsMCwzAAoJEG5Y3pAfABrvveEQANAsU2LZOxLqjTPrYqlX
3/I8qWIaPJtl4zSFsgdHu2OwXUqxlY9+O24OO/0CrjC+0aC5cHtKao7/+59n0HAF
Do8EAKduRTWlt+/+VkIc+BuDi/iUnYseYleBZ5lyb16NhwMUYuAgST7M39NgoSmY
b521yI7H/d7NxKZ+qKG10/f1xGXIkAms+RrEbRwoxoFWHj8rpsOMwYl7zPRBenBi
RmcEILQzjtqSunuy7BEPBpjlx6u8vbaLcer38mqPMA4EjUTw9HdTlwj4ND+rmCT6
fahABXBm1eugESTuowmb2fNpuyLWi8YEr8VFknN72NB+AoPHkdeAvjWghvLVvtc0
mU0wEqs7Mz04TGHwKJ3Tx+dyE/UlhDK8oZm19aWVZfB66h81orISfUFlB7F343yf
t0/6z/Z/C4M3srB4z4woX5fJaIrs10yubt2HH/Jvrq4XslfCgD9U3NdXkhzHJBam
r8HmKpsnQcmVI3ebhjfoHLLbPc73pXND/jLpc8VvqVNNNh5vwMFFnb6rq46GxfZI
GfClFjF6u2/Hgf6WkJCd65iNb/fiFHUuxjwSkFTMWvbpP580NtOG5p2Lq5ksyxfz
Jr76q3Fx+zJItwMmywwt0m6oJiJgDDNG8WT7goTpDn3/VMJs6mpyP8XUmIWGQN0F
PO/wgtwmKw2HwVKwCfskM4tk
=hF2I
-----END PGP SIGNATURE-----