openssl: Reject EC keys with explicitly encoded parameters

EC_KEY_decoded_from_explicit_params() was added with 1.1.1h but has been
deprecated with 3.0.

src/libstrongswan/plugins/openssl/openssl_ec_private_key.c

@@ -62,6 +62,7 @@ struct private_openssl_ec_private_key_t {
 
 /* from openssl_ec_public_key */
 bool openssl_check_ec_key_curve(EVP_PKEY *key, int nid_curve);
+bool openssl_check_explicit_params(EVP_PKEY *key);
 
 /**
  * Build a DER encoded signature as in RFC 3279
@@ -474,8 +475,9 @@ openssl_ec_private_key_t *openssl_ec_private_key_load(key_type_t type,
 							 blob.len);
 	}
 
-	if (!key)
+	if (!key || openssl_check_explicit_params(key))
 	{
+		EVP_PKEY_free(key);
 		return NULL;
 	}
 	this = create_internal(key);