Red Hat Security AdvisoryRHSA-2024:7846
openssl security update
Released 2024-10-09 · Red Hat rating Low · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux BaseOS AUS (v.8.6) openssl-1:1.1.1k-14.el8_6, openssl-devel-1:1.1.1k-14.el8_6, openssl-libs-1:1.1.1k-14.el8_6 +1
- Red Hat Enterprise Linux BaseOS E4S (v.8.6) openssl-1:1.1.1k-14.el8_6, openssl-devel-1:1.1.1k-14.el8_6, openssl-libs-1:1.1.1k-14.el8_6 +1
- Red Hat Enterprise Linux BaseOS TUS (v.8.6) openssl-1:1.1.1k-14.el8_6, openssl-devel-1:1.1.1k-14.el8_6, openssl-libs-1:1.1.1k-14.el8_6 +1
Fixes 1 record
Priority MEDIUM 54
Issue summary: Calling the OpenSSL API function SSL_select_next_proto with an empty supported client protocols buffer may cause a crash or memory contents to be sent to the peer.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.05582 · Published 2024-06-27 · Partial fix · 3.3.2, 3.2.3 +4 CWE-125
