Red Hat Security Advisory

RHSA-2026:1594

openssl security update

Released 2026-01-29 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream E4S (v.9.2) openssl-devel-1:3.0.7-18.el9_2.3, openssl-perl-1:3.0.7-18.el9_2.3
Red Hat Enterprise Linux BaseOS E4S (v.9.2) openssl-1:3.0.7-18.el9_2.3, openssl-libs-1:3.0.7-18.el9_2.3

Fixes 2 records

TI-2025-14107 CVE-2025-15467 · GHSA-wvhq-3h88-rf6g

Stack buffer overflow in CMS (Auth)EnvelopedData parsing

CRITICAL 85

Issue summary: Parsing CMS AuthEnvelopedData or EnvelopedData message with maliciously crafted AEAD parameters can trigger a stack buffer overflow.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.74793 Published 2026-01-27 Partial fix · 3.6.1, 3.5.5 +3 CWE-787

TI-2025-42862 CVE-2025-69419 · GHSA-x77r-97gw-wh89

Out of bounds write in PKCS12_get_friendlyname() UTF-8 conversion

LOW 35

Issue summary: Calling PKCS12_get_friendlyname() function on a maliciously crafted PKCS#12 file with a BMPString (UTF-16BE) friendly name containing non-ASCII BMP code point can trigger a one byte write before the alloca…

CVSS 3.1HIGH 7.4 Network No auth No interaction EPSS 0.00607 Published 2026-01-27 Partial fix · 3.6.1, 3.5.5 +4 CWE-787