Skip to content
OpenAdvisories
Low ALSA-2024:9333 4 CVEs

Low: openssl security update

Published Nov 12, 2024 · Updated Oct 29, 2026

Ecosystem: AlmaLinux

Summary

OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library.

Security Fix(es):

* openssl: Unbounded memory growth with session handling in TLSv1.3 (CVE-2024-2511)
* openssl: Excessive time spent checking DSA keys and parameters (CVE-2024-4603)
* openssl: Use After Free with SSL_free_buffers (CVE-2024-4741)
* openssl: SSL_select_next_proto buffer overread (CVE-2024-5535)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Fixed packages 4

ReleasePackageFixed in
AlmaLinux · 9 openssl 1:3.2.2-6.el9_5
AlmaLinux · 9 openssl-devel 1:3.2.2-6.el9_5
AlmaLinux · 9 openssl-libs 1:3.2.2-6.el9_5
AlmaLinux · 9 openssl-perl 1:3.2.2-6.el9_5

Vulnerabilities 4

  • Critical 9.8
    CVE-2024-4741

    Use After Free with SSL_free_buffers

    Issue summary: Calling the OpenSSL API function SSL_free_buffers may cause memory to be accessed that was previously freed in some situations Impact summary: A use after free can have a range of potential consequences such as the corruption of valid data, cra…

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  • Critical 9.1
    CVE-2024-5535 Public exploit

    SSL_select_next_proto buffer overread

    Issue summary: Calling the OpenSSL API function SSL_select_next_proto with an empty supported client protocols buffer may cause a crash or memory contents to be sent to the peer. Impact summary: A buffer overread can have a range of potential consequences suc…

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  • Medium 5.9
    CVE-2024-2511 EPSS 59%

    Unbounded memory growth with session handling in TLSv1.3

    Issue summary: Some non-default TLS server configurations can cause unbounded memory growth when processing TLSv1.3 sessions Impact summary: An attacker may exploit certain server configurations to trigger unbounded memory growth that would lead to a Denial o…

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  • Medium 5.3
    CVE-2024-4603

    Excessive time spent checking DSA keys and parameters

    Issue summary: Checking excessively long DSA keys or parameters may be very slow. Impact summary: Applications that use the functions EVP_PKEY_param_check() or EVP_PKEY_public_check() to check a DSA public key or DSA parameters may experience long delays. Whe…

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi

References

  • report
    https://access.redhat.com/security/cve/CVE-2024-2511
  • report
    https://access.redhat.com/security/cve/CVE-2024-4603
  • report
    https://access.redhat.com/security/cve/CVE-2024-4741
  • report
    https://access.redhat.com/security/cve/CVE-2024-5535
  • report
    https://bugzilla.redhat.com/2274020
  • report
    https://bugzilla.redhat.com/2281029
  • report
    https://bugzilla.redhat.com/2283757
  • report
    https://bugzilla.redhat.com/2294581
  • advisory
    https://errata.almalinux.org/9/ALSA-2024-9333.html