Red Hat Security Advisory

RHSA-2026:84573

openssl security update

Released 2026-10-19 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream E4S (v.9.4)
Red Hat Enterprise Linux BaseOS E4S (v.9.4) openssl-1:3.0.7-29.el9_4.3, openssl-libs-1:3.0.7-29.el9_4.3

Fixes 6 records

TI-2026-33226 CVE-2026-45447 · GHSA-f684-cpcq-j565

Heap Use-After-Free in the PKCS7_verify() Function

MEDIUM 47

Issue summary: A specially crafted PKCS#7 or S/MIME signed message could trigger a use-after-free during PKCS#7 signature verification.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.04002 Published 2026-06-09 Partial fix · 4.0.1, 3.6.3 +5 CWE-416

TI-2026-26479 CVE-2026-34182 · GHSA-f9v2-4w9p-2cwc

CMS AuthEnvelopedData Processing May Accept Forged Messages

MEDIUM 47

Issue Summary: Cryptographic Message Services (CMS) processing fails to perform sufficient input validation on the cipher and tag length fields of AuthEnvelopedData containers, leading to various potential compromises.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.01057 Published 2026-06-09 Fixed in 4.0.1, 3.6.3 +3 CWE-354

TI-2026-24346 CVE-2026-31790 · GHSA-vgxx-5xj5-q97x

Incorrect Failure Handling in RSA KEM RSASVE Encapsulation

MEDIUM 41

Issue summary: Applications using RSASVE key encapsulation to establish a secret encryption key can send contents of an uninitialized memory buffer to a malicious peer.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01049 Published 2026-04-07 Partial fix · 3.6.2, 3.5.6 +3 CWE-754

TI-2026-33224 CVE-2026-45445 · GHSA-v446-xwfm-x7mr

AES-OCB IV Ignored on EVP_Cipher() Path

MEDIUM 40

Issue summary: When an application drives an AES-OCB context through the public EVP_Cipher() one-shot interface, the application-supplied initialisation vector (IV) is silently discarded.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00704 Published 2026-06-09 Fixed in 4.0.1, 3.6.3 +3 CWE-325

TI-2026-22665 CVE-2026-28390 · GHSA-fgpp-q3px-3xhc

Possible NULL Dereference When Processing CMS KeyTransportRecipientInfo

MEDIUM 40

Issue summary: During processing of a crafted CMS EnvelopedData message with KeyTransportRecipientInfo a NULL pointer dereference can happen.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00836 Published 2026-04-07 Partial fix · 3.6.2, 3.5.6 +5 CWE-476

TI-2025-42861 CVE-2025-69418 · GHSA-78qr-24v5-7q73

Unauthenticated/unencrypted trailing bytes with low-level OCB function calls

LOW 18

Issue summary: When using the low-level OCB API directly with AES-NI or<br>other hardware-accelerated code paths, inputs whose length is not a multiple<br>of 16 bytes can leave the final partial block unencrypted and una…

CVSS 3.1MEDIUM 4.0 Local No auth No interaction EPSS 0.00132 Published 2026-01-27 Partial fix · 3.6.1, 3.5.5 +4 CWE-325