Red Hat Security Advisory

RHSA-2026:58563

openssl security update

Released 2026-08-24 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Enterprise Linux Server (v. 7 ELS) openssl-1:1.0.2k-26.el7_9.2, openssl-devel-1:1.0.2k-26.el7_9.2, openssl-devel-1:1.0.2k-26.el7_9.2.ppc +2
Red Hat Enterprise Linux Server Optional (v. 7 ELS) openssl-perl-1:1.0.2k-26.el7_9.2, openssl-static-1:1.0.2k-26.el7_9.2, openssl-static-1:1.0.2k-26.el7_9.2.ppc

Fixes 3 records

TI-2024-05145 CVE-2024-5535 · GHSA-4fc7-mvrr-wv2c

SSL_select_next_proto buffer overread

MEDIUM 54

Issue summary: Calling the OpenSSL API function SSL_select_next_proto with an empty supported client protocols buffer may cause a crash or memory contents to be sent to the peer.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.05582 Published 2024-06-27 Partial fix · 3.3.2, 3.2.3 +4 CWE-125

TI-2026-33226 CVE-2026-45447 · GHSA-f684-cpcq-j565

Heap Use-After-Free in the PKCS7_verify() Function

MEDIUM 47

Issue summary: A specially crafted PKCS#7 or S/MIME signed message could trigger a use-after-free during PKCS#7 signature verification.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.04002 Published 2026-06-09 Partial fix · 4.0.1, 3.6.3 +5 CWE-416

TI-2026-22665 CVE-2026-28390 · GHSA-fgpp-q3px-3xhc

Possible NULL Dereference When Processing CMS KeyTransportRecipientInfo

MEDIUM 40

Issue summary: During processing of a crafted CMS EnvelopedData message with KeyTransportRecipientInfo a NULL pointer dereference can happen.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00836 Published 2026-04-07 Partial fix · 3.6.2, 3.5.6 +5 CWE-476