Summary
[3.0.7-11.0.1]
- Drop OpenELA branding [Orabug: 37274593]
- Add bundle with Oracle Linux 9 OpenSSL FIPS module packages [Orabug: 39910507]
- Update extract-src.sh script to support non-hobbled openssl tarball [Orabug: 39910507]
[3.0.7.openela.0.1]
- Add OpenELA specific changes
[3.0.7-11]
- Update sources and scripts for new build, to address CVE-2026-31790
Resolves: RHEL-173517
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 9 | openssl-fips-provider | 0:3.0.7-11.0.1.el9_8 |
| Oracle Linux · 9 | openssl-fips-provider-so | 0:3.0.7-11.0.1.el9_8 |
Vulnerabilities 1
-
High 7.5
Incorrect Failure Handling in RSA KEM RSASVE Encapsulation
Issue summary: Applications using RSASVE key encapsulation to establish a secret encryption key can send contents of an uninitialized memory buffer to a malicious peer. Impact summary: The uninitialized buffer might contain sensitive data from the previous ex…