Some of the backstory, in case anyone is interested: We found this through invariant fuzzing @ronomon/crypto-async (https://github.com/ronomon/crypto-async htt

Some of the backstory, in case anyone is interested: We found this through invariant fuzzing @ronomon/crypto-async (https://github.com/ronomon/crypto-async https://github.com/ronomon/crypto-async), which depends on OpenSSL. The invariant fuzzing simply does a few thousand random roundtrips (encrypt, decrypt) through all the OpenSSL AEAD ciphers we want to support, corrupting any of {key, iv, ciphertext, aad, tag} and asserting that the authentication guarantee is maintained by the AEAD cipher. In addition to the CVE, this quickly found a few small unrelated issues: EVP_CTRL_AEAD_SET_TAG fails for OCB [1] AEAD: EVP_CIPHER_CTX_iv_length is oblivious to EVP_CTRL_AEAD_SET_IVLEN [2] EVP_CipherUpdate() setting AAD for AES-256-OCB returns incorrect `outlen` [3] [1] https://github.com/openssl/openssl/issues/8331 https://github.com/openssl/openssl/issues/8331 [2] https://github.com/openssl/openssl/issues/8330 https://github.com/openssl/openssl/issues/8330 [3] https://github.com/openssl/openssl/issues/8310 https://github.com/openssl/openssl/issues/8310