Summary
[3.5.5-4.0.1]
- Replace upstream references [Orabug: 34340177]
[3.5.5.openela.0.1]
- Add OpenELA specific changes
[1:3.5.5-4]
- Fix CVE-2026-7383, CVE-2026-9076, CVE-2026-34180, CVE-2026-34181,
CVE-2026-34183, CVE-2026-42764, CVE-2026-42766, CVE-2026-42767, CVE-2026-42768,
CVE-2026-42769, CVE-2026-42770, CVE-2026-45445, CVE-2026-45446, CVE-2026-45447,
CVE-2026-34182.
Resolves: RHEL-179274
Resolves: RHEL-179287
Resolves: RHEL-179539
Resolves: RHEL-179544
Resolves: RHEL-179547
Resolves: RHEL-179552
Resolves: RHEL-179556
Resolves: RHEL-179633
Resolves: RHEL-179661
Resolves: RHEL-179678
Resolves: RHEL-179684
Resolves: RHEL-179688
Resolves: RHEL-179691
Resolves: RHEL-179696
Resolves: RHEL-179699
[1:3.5.5-3]
- Fix CVE-2026-28390
Resolves: RHEL-165870
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 9 | openssl | 1:3.5.5-4.0.1.el9_8 |
| Oracle Linux · 9 | openssl-devel | 1:3.5.5-4.0.1.el9_8 |
| Oracle Linux · 9 | openssl-libs | 1:3.5.5-4.0.1.el9_8 |
| Oracle Linux · 9 | openssl-perl | 1:3.5.5-4.0.1.el9_8 |
Vulnerabilities 1
-
High 7.5
Possible NULL Dereference When Processing CMS KeyTransportRecipientInfo
Issue summary: During processing of a crafted CMS EnvelopedData message with KeyTransportRecipientInfo a NULL pointer dereference can happen. Impact summary: Applications that process attacker-controlled CMS data may crash before authentication or cryptograph…