Red Hat Security Advisory

RHSA-2024:9333

openssl and openssl-fips-provider security update

Released 2024-11-12 · Red Hat rating Low · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream (v. 9) openssl-devel-1:3.2.2-6.el9_5, openssl-perl-1:3.2.2-6.el9_5
Red Hat Enterprise Linux BaseOS (v. 9) openssl-1:3.2.2-6.el9_5, openssl-libs-1:3.2.2-6.el9_5

Fixes 4 records

TI-2024-02335 CVE-2024-2511 · GHSA-299c-jvhc-gxj8

Unbounded memory growth with session handling in TLSv1.3

MEDIUM 61

Issue summary: Some non-default TLS server configurations can cause unbounded memory growth when processing TLSv1.3 sessions Impact summary: An attacker may exploit certain server configurations to trigger unbounded memo…

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.59302 Published 2024-04-08 Partial fix · 3.2.2, 3.1.6 +2 CWE-1325

TI-2024-05145 CVE-2024-5535 · GHSA-4fc7-mvrr-wv2c

SSL_select_next_proto buffer overread

MEDIUM 54

Issue summary: Calling the OpenSSL API function SSL_select_next_proto with an empty supported client protocols buffer may cause a crash or memory contents to be sent to the peer.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.05582 Published 2024-06-27 Partial fix · 3.3.2, 3.2.3 +4 CWE-125

TI-2024-04414 CVE-2024-4741 · GHSA-6vgq-8qjq-h578

Use After Free with SSL_free_buffers

MEDIUM 54

Issue summary: Calling the OpenSSL API function SSL_free_buffers may cause memory to be accessed that was previously freed in some situations Impact summary: A use after free can have a range of potential consequences su…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02926 Published 2024-11-13 Partial fix · 3.3.1, 3.2.2 +3 CWE-416

TI-2024-04285 CVE-2024-4603 · GHSA-85xr-ghj6-6m46

Excessive time spent checking DSA keys and parameters

LOW 32

Issue summary: Checking excessively long DSA keys or parameters may be very slow.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.01131 Published 2024-05-16 Partial fix · 3.0.14, 3.1.6 +2 CWE-606