LibreSSL 4.3.3 has been released as a maintenance update to the OpenBSD-developed TLS and cryptography library, bringing several security and reliability fixes alongside portability improvements for macOS and Windows.
The most notable fix in LibreSSL 4.3.3 addresses an Online Certificate Status Protocol responder authorization bypass affecting both libtls and the ocspcheck utility.
OCSP is used to determine whether a TLS certificate has been revoked. LibreSSL’s fix tightens validation around which responders are authorized to provide that information.
DTLS, which provides TLS-style encryption for datagram-based protocols such as UDP, also receives several corrections. The developers fixed an incorrect size check in dtls1_preprocess_fragment(). They introduced a limit on buffered DTLS handshake data and addressed a potential overread that could occur when retransmission was interrupted.
Certificate verification receives attention as well. LibreSSL 4.3.3 ensures that verification callbacks configured to always return success can still detect a hostname mismatch. In addition, support for RelativeDistinguishedName in CRL distribution points has been removed.
On the portability side, the release adds support for building LibreSSL on macOS Golden Gate 27.0.
Windows users also get a couple of fixes. The developers worked around incorrect code generation produced by the MSVC ARM64 optimizer in constant-time big-number code, while LibreSSL’s Windows socketpair() emulation now correctly sets close-on-exec on the appropriate handle.
Lastly, projects building LibreSSL through CMake can now override TLS_DEFAULT_CA_FILE, providing more flexibility over the default location used for trusted certificate authorities.
For additional detail, see the release notes.
LibreSSL is a fork of OpenSSL created by the OpenBSD project in 2014, focusing on simplifying the codebase, removing legacy components, and improving security and maintainability. Besides being used by OpenBSD, a portable version is available for Linux, macOS, Windows, and other Unix-like systems.
