Red Hat Security Advisory

RHSA-2024:7848

openssl security update

Released 2024-10-09 · Red Hat rating Low · View on Red Hat →

Fixed in

Red Hat Enterprise Linux BaseOS (v. 8) openssl-1:1.1.1k-14.el8_6, openssl-devel-1:1.1.1k-14.el8_6, openssl-libs-1:1.1.1k-14.el8_6 +1

Fixes 1 record

TI-2024-05145 CVE-2024-5535 · GHSA-4fc7-mvrr-wv2c

SSL_select_next_proto buffer overread

MEDIUM 54

Issue summary: Calling the OpenSSL API function SSL_select_next_proto with an empty supported client protocols buffer may cause a crash or memory contents to be sent to the peer.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.05582 Published 2024-06-27 Partial fix · 3.3.2, 3.2.3 +4 CWE-125