Summary
OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library.
Security Fix(es):
* openssl: openssl: Information Disclosure from Uninitialized Memory via Invalid RSA Public Key (CVE-2026-31790)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 10 | openssl | 1:3.5.5-2.el10_2.alma.1 |
| AlmaLinux · 10 | openssl-devel | 1:3.5.5-2.el10_2.alma.1 |
| AlmaLinux · 10 | openssl-libs | 1:3.5.5-2.el10_2.alma.1 |
| AlmaLinux · 10 | openssl-perl | 1:3.5.5-2.el10_2.alma.1 |
Vulnerabilities 2
-
High 7.5
Incorrect Failure Handling in RSA KEM RSASVE Encapsulation
Issue summary: Applications using RSASVE key encapsulation to establish a secret encryption key can send contents of an uninitialized memory buffer to a malicious peer. Impact summary: The uninitialized buffer might contain sensitive data from the previous ex…
-
Medium 6.5
OpenSSL TLS 1.3 server may choose unexpected key agreement group
Issue summary: An OpenSSL TLS 1.3 server may fail to negotiate the expected preferred key exchange group when its key exchange group configuration includes the default by using the 'DEFAULT' keyword. Impact summary: A less preferred key exchange may be used e…