Summary
[3.5.5-5.0.1]
- Replace upstream references [Orabug: 34340177]
- Update FIPS provider name [Orabug: 35824276]
[1:3.5.5-5]
- Patch asn1_d2i_read_bio to read headers without blocking
Resolves: RHEL-169991
[1:3.5.5-4]
- Fix CVE-2026-7383, CVE-2026-9076, CVE-2026-34180, CVE-2026-34181,
CVE-2026-34183, CVE-2026-42764, CVE-2026-42766, CVE-2026-42767, CVE-2026-42768,
CVE-2026-42769, CVE-2026-42770, CVE-2026-45445, CVE-2026-45446, CVE-2026-45447,
CVE-2026-34182.
Resolves: RHEL-179267
Resolves: RHEL-179281
Resolves: RHEL-179537
Resolves: RHEL-179542
Resolves: RHEL-179545
Resolves: RHEL-179550
Resolves: RHEL-179553
Resolves: RHEL-179626
Resolves: RHEL-179658
Resolves: RHEL-179675
Resolves: RHEL-179682
Resolves: RHEL-179685
Resolves: RHEL-179689
Resolves: RHEL-179693
Resolves: RHEL-179697
[1:3.5.5-3]
- Fix CVE-2026-28390
Resolves: RHEL-165705
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 10 | openssl | 1:3.5.5-5.0.1.el10_2 |
| Oracle Linux · 10 | openssl-devel | 1:3.5.5-5.0.1.el10_2 |
| Oracle Linux · 10 | openssl-libs | 1:3.5.5-5.0.1.el10_2 |
| Oracle Linux · 10 | openssl-perl | 1:3.5.5-5.0.1.el10_2 |
Vulnerabilities 1
-
High 7.5
Possible NULL Dereference When Processing CMS KeyTransportRecipientInfo
Issue summary: During processing of a crafted CMS EnvelopedData message with KeyTransportRecipientInfo a NULL pointer dereference can happen. Impact summary: Applications that process attacker-controlled CMS data may crash before authentication or cryptograph…