Commit a32ad405fc for openssl.org

commit a32ad405fc7adac2318ddae689f4f188e2d2d177
Author: Eugene Syromiatnikov <esyr@openssl.org>
Date:   Wed Sep 23 10:42:30 2026 +0200

    CHANGES.md: update for 4.1.0-beta1

    4.1.0-beta1 CHANGES.md adds the following:
     * https://github.com/openssl/openssl/pull/32702
       "cms: reject signature alg OID as digestAlgorithm"
     * https://github.com/openssl/openssl/pull/32829
       "NUL-terminate ASN1_STRING data built inside libcrypto and poison
       the NUL under ASan and MSan"
     * https://github.com/openssl/openssl/pull/32837
       "Add valgrind poisoning for ASN1_STRING terminators"

    Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
    Reviewed-by: Milan Broz <mbroz@openssl.org>
    Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
    Merge-date: Wed Sep 23 10:32:25 2026
    Merged-from: https://github.com/openssl/openssl/pull/32950

diff --git a/CHANGES.md b/CHANGES.md
index bbbc066a5b..b71f6b82b5 100644
--- a/CHANGES.md
+++ b/CHANGES.md
@@ -266,6 +266,8 @@ OpenSSL 4.1
    must be changed to honour `ASN1_STRING_get_length()`. The Valgrind
    check may be disabled by building with `-DOPENSSL_NO_VALGRIND_CHECK`.
    <!-- https://github.com/openssl/openssl/pull/31194 -->
+   <!-- https://github.com/openssl/openssl/pull/32829 -->
+   <!-- https://github.com/openssl/openssl/pull/32837 -->

    *Bob Beck*

@@ -508,6 +510,12 @@ OpenSSL 4.1

    *John Claus*

+ * Fixed `CMS_SignerInfo_verify()` to no longer accept signature algorithm
+   identifiers as valid `digestAlgorithms`, in violation of [RFC 5652].
+   <!-- https://github.com/openssl/openssl/pull/32702 -->
+
+   *Jakub Zelenka*
+
  * Fixed reading of binary data (for example, certificates in DER format)
    by `openssl` command from `stdin` on Windows.
    <!-- https://github.com/openssl/openssl/pull/30559 -->
@@ -572,10 +580,10 @@ OpenSSL 4.1

    *Norbert Pócs*

- * Deprecated `CMS_stream()` and `PKCS7_stream()` functions.  These are internal
-   plumbing that leaked into the public API, and no longer return a streaming
-   boundary.  Use `BIO_new_CMS()` or `BIO_new_PKCS7()` to stream CMS and PKCS#7
-   content.
+ * Deprecated `CMS_stream()` and `PKCS7_stream()` API functions.  These
+   are internal plumbing that was unintentionally exposed as the public API,
+   and they no longer return a streaming boundary.  Use `BIO_new_CMS()`
+   or `BIO_new_PKCS7()` to stream CMS and PKCS#7 content.
    <!-- https://github.com/openssl/openssl/pull/32242 -->

    *Bob Beck*
@@ -24188,6 +24196,7 @@ ndif
 [RFC 4492 Section 5.1.2]: https://datatracker.ietf.org/doc/html/rfc4492#section-5.1.2
 [RFC 5280]: https://datatracker.ietf.org/doc/html/rfc5280
 [RFC 5297]: https://datatracker.ietf.org/doc/html/rfc5297
+[RFC 5652]: https://datatracker.ietf.org/doc/html/rfc5652
 [RFC 7250]: https://datatracker.ietf.org/doc/html/rfc7250
 [RFC 7685]: https://datatracker.ietf.org/doc/html/rfc7685
 [RFC 7919]: https://datatracker.ietf.org/doc/html/rfc7919