Commit df40f231a4 for openssl.org

commit df40f231a4c58335868b330ccfabe124e01c1ad6
Author: Eugene Syromiatnikov <esyr@openssl.org>
Date:   Sun Oct 4 12:53:02 2026 +0200

    CHANGES.md, NEWS.md: 4.0.3 fixups

    Fix CVE-2026-54872 title wording, fix typos in CVE-2026-35191,
    CVE-2026-75804, and PR #31610[1] descriptions, mention the FIPS
    indicator change in NEWS.md.

    [1] https://github.com/openssl/openssl/pull/31610

    Co-Authored-by: Mounir IDRASSI <mounir.idrassi@idrix.fr>
    Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
    Reviewed-by: Neil Horman <nhorman@openssl.org>
    Reviewed-by: Milan Broz <mbroz@openssl.org>
    Merge-date: Wed Oct 21 16:41:20 2026
    Merged-from: https://github.com/openssl/openssl/pull/33052

diff --git a/CHANGES.md b/CHANGES.md
index dedeab8b5c..4372821d92 100644
--- a/CHANGES.md
+++ b/CHANGES.md
@@ -762,7 +762,7 @@ OpenSSL 4.0

    Severity: Low

-   Issue summary: The OpenSSL QUIC server, when configured to not preform
+   Issue summary: The OpenSSL QUIC server, when configured to not perform
    address validation, can be forced to count incoming packets multiple times
    in its unvalidated credit computation, leading to a violation
    of the [RFC 9000] unvalidated connection amplification limit of 3 times
@@ -800,7 +800,8 @@ OpenSSL 4.0

    *Alexandr Nedvědický*

- * Fixed a timing side-channel in scalar multiplication for mon-NIST EC curves.
+ * Fixed a timing side-channel leak in generic elliptic curve scalar
+   multiplication.

    Severity: Low

@@ -893,7 +894,7 @@ OpenSSL 4.0
    flow control for streams to make the QUIC stack receive ~100 MiB of memory
    instead of 768 KiB (default flow control window size).

-   Reportedby: Moltenbit, Bhabani Sankar Das, Saiyowa Security Team, mzfr.
+   Reported by: Moltenbit, Bhabani Sankar Das, Saiyowa Security Team, mzfr.

    ([CVE-2026-75804])

@@ -978,7 +979,7 @@ OpenSSL 4.0
    *Alexandr Nedvědický*

  * Fixed a bug where `EVP_DecryptFinal()` incorrectly reported a stale success
-   on AES-SIV authentication failure after a preciously successful message
+   on AES-SIV authentication failure after a previously successful message
    decryption.
    <!-- https://github.com/openssl/openssl/pull/31610 -->

diff --git a/NEWS.md b/NEWS.md
index 87c04f9614..c483f70545 100644
--- a/NEWS.md
+++ b/NEWS.md
@@ -112,7 +112,8 @@ This release incorporates the following bug fixes and mitigations:
   * Fixed potential CPU DoS via O(n^2) fragment reassembly in QUIC.
     ([CVE-2026-42772])

-  * Fixed a timing side-channel in scalar multiplication for mon-NIST EC curves.
+  * Fixed a timing side-channel leak in generic elliptic curve scalar
+    multiplication.
     ([CVE-2026-54872])

   * Fixed QUIC `STREAM` fragment metadata DoS.
@@ -147,6 +148,16 @@ This release incorporates the following bug fixes and mitigations:
     where incomplete writes down the BIO chain may result in the loss of encoded
     base64 data.

+This release incorporates the following potentially significant or incompatible
+changes:
+
+ * Changed the OpenSSL FIPS provider so that every algorithm advertised
+   with `fips=yes` property explicitly exposes a `fips-indicator` gettable
+   context parameter, that returns 1 for an approved operation.  The absence
+   of an indicator is no longer interpreted as approval.  Algorithms advertised
+   with `fips=no` property, including X448MLKEM1024, remain unapproved
+   and return 0 when they expose the indicator.
+
 ### Major changes between OpenSSL 4.0.1 and OpenSSL 4.0.2 [25 Aug 2026]

 OpenSSL 4.0.2 is a security patch release.  The most severe CVE fixed