From d545ba4451dd0ecc32135bfbf176b683dd842105 Mon Sep 17 00:00:00 2001
From: yangwu <yangwu29@h-partners.com>
Date: Mon, 6 Jul 2026 15:31:46 +0800
Subject: [PATCH 3/4] Enforce implicit rejection for CMS/PKCS#7 decryption Drop
 the disablement of the implicit rejection for RSA PKCS#1 v1.5 decryption.

Fixes CVE-2026-42768

origin:https://github.com/openssl/openssl/commit/a2ca7b2d73e0ffc1eae183fe6e1741dac767cb4f#diff-6e7f828f9dd78f88a18219fc9831dd20c7ef09c41244880680c25f343213a451

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Milan Broz <mbroz@openssl.org>
Reviewed-by: Alicja Kario <hkario@redhat.com>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Mon Jun  8 19:49:19 2026
(cherry picked from commit 33def545a0c173aec43891f24c3df4f7d2e4fd87)
---
 .../OpensslLib/openssl/doc/man3/CMS_decrypt.pod        |  4 ++--
 .../OpensslLib/openssl/doc/man3/PKCS7_decrypt.pod      | 10 +++++++++-
 2 files changed, 11 insertions(+), 3 deletions(-)

diff --git a/CryptoPkg/Library/OpensslLib/openssl/doc/man3/CMS_decrypt.pod b/CryptoPkg/Library/OpensslLib/openssl/doc/man3/CMS_decrypt.pod
index 75c33a91..b2693292 100644
--- a/CryptoPkg/Library/OpensslLib/openssl/doc/man3/CMS_decrypt.pod
+++ b/CryptoPkg/Library/OpensslLib/openssl/doc/man3/CMS_decrypt.pod
@@ -69,7 +69,7 @@ then the above behaviour is modified and an error B<is> returned if no
 recipient encrypted key can be decrypted B<without> generating a random
 content encryption key. Applications should use this flag with
 B<extreme caution> especially in automated gateways as it can leave them
-open to attack.
+open to attack. See L<EVP_PKEY_decrypt(3)> for more details.
 
 It is possible to determine the correct recipient key by other means (for
 example looking them up in a database) and setting them in the CMS structure
@@ -104,7 +104,7 @@ mentioned in CMS_verify() also applies to CMS_decrypt().
 
 =head1 SEE ALSO
 
-L<ERR_get_error(3)>, L<CMS_encrypt(3)>
+L<ERR_get_error(3)>, L<CMS_encrypt(3)>, L<EVP_PKEY_decrypt(3)>
 
 =head1 HISTORY
 
diff --git a/CryptoPkg/Library/OpensslLib/openssl/doc/man3/PKCS7_decrypt.pod b/CryptoPkg/Library/OpensslLib/openssl/doc/man3/PKCS7_decrypt.pod
index aea15937..cfb5b3f8 100644
--- a/CryptoPkg/Library/OpensslLib/openssl/doc/man3/PKCS7_decrypt.pod
+++ b/CryptoPkg/Library/OpensslLib/openssl/doc/man3/PKCS7_decrypt.pod
@@ -22,6 +22,14 @@ B<flags> is an optional set of flags.
 Although the recipients certificate is not needed to decrypt the data it is needed
 to locate the appropriate (of possible several) recipients in the PKCS#7 structure.
 
+When RSA PKCS#1 v1.5 Key Transport is in use, the invoked EVP_PKEY_decrypt()
+will use implicit rejection mechanism. It always returns the result of RSA
+decryption of the symmetric key to avoid Marvin attack. This result is
+deterministic and can happen to match the symmetric cipher used for the content
+encryption. In case when the certificate is not provided, the last
+RecipientInfo producing the key looking valid will be used. It may cause
+getting garbage content on decryption.
+
 The following flags can be passed in the B<flags> parameter.
 
 If the B<PKCS7_TEXT> flag is set MIME headers for type B<text/plain> are deleted
@@ -43,7 +51,7 @@ mentioned in PKCS7_sign() also applies to PKCS7_verify().
 
 =head1 SEE ALSO
 
-L<ERR_get_error(3)>, L<PKCS7_encrypt(3)>
+L<ERR_get_error(3)>, L<PKCS7_encrypt(3)>, L<EVP_PKEY_decrypt(3)>
 
 =head1 COPYRIGHT
 
-- 
2.43.0