Summary
[3.5.1-4.0.1]
- Enable openssl-fips-provider dependency [Orabug: 36504822]
- Temporary disable openssl-fips-provider dependency [Orabug: 36504822]
- Replace upstream references [Orabug: 34340177]
[3.5.1.openela.0.1]
- Add OpenELA specific changes
[1:3.5.1-4]
- Fix CVE-2025-9230
Resolves: RHEL-115929
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 9 | openssl | 1:3.5.1-4.0.1.el9_7 |
| Oracle Linux · 9 | openssl-devel | 1:3.5.1-4.0.1.el9_7 |
| Oracle Linux · 9 | openssl-libs | 1:3.5.1-4.0.1.el9_7 |
| Oracle Linux · 9 | openssl-perl | 1:3.5.1-4.0.1.el9_7 |
Vulnerabilities 1
-
Critical 9.8
Out-of-bounds read & write in RFC 3211 KEK Unwrap
Issue summary: An application trying to decrypt CMS messages encrypted using password based encryption can trigger an out-of-bounds read and write. Impact summary: This out-of-bounds read may trigger a crash which leads to Denial of Service for an application…