Update dependency openssl/openssl to v3.5.4

[renovate]

Coming soon: The Renovate bot (GitHub App) will be renamed to Mend. PRs from Renovate will soon appear from 'Mend'. Learn more here.

This PR contains the following updates:

Package	Update	Change
openssl/openssl	patch	3.5.3 -> 3.5.4

---

Release Notes

openssl/openssl (openssl/openssl)

v3.5.4

Compare Source

• Fix Out-of-bounds read & write in RFC 3211 KEK Unwrap

  Issue summary: An application trying to decrypt CMS messages encrypted using
  password based encryption can trigger an out-of-bounds read and write.

  Impact summary: This out-of-bounds read may trigger a crash which leads to
  Denial of Service for an application. The out-of-bounds write can cause
  a memory corruption which can have various consequences including
  a Denial of Service or Execution of attacker-supplied code.

  The issue was reported by Stanislav Fort (Aisle Research).

  ([CVE-2025-9230])

  Viktor Dukhovni

• Fix Timing side-channel in SM2 algorithm on 64 bit ARM

  Issue summary: A timing side-channel which could potentially allow remote
  recovery of the private key exists in the SM2 algorithm implementation on
  64 bit ARM platforms.

  Impact summary: A timing side-channel in SM2 signature computations on
  64 bit ARM platforms could allow recovering the private key by an attacker.

  The issue was reported by Stanislav Fort (Aisle Research).

  ([CVE-2025-9231])

  Stanislav Fort and Tomáš Mráz

• Fix Out-of-bounds read in HTTP client no_proxy handling

  Issue summary: An application using the OpenSSL HTTP client API functions
  may trigger an out-of-bounds read if the "no_proxy" environment variable is
  set and the host portion of the authority component of the HTTP URL is an
  IPv6 address.

  Impact summary: An out-of-bounds read can trigger a crash which leads to
  Denial of Service for an application.

  The issue was reported by Stanislav Fort (Aisle Research).

  ([CVE-2025-9232])

  Stanislav Fort

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - "before 2am" (UTC).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.