Skip to content
OpenAdvisories
Medium ELSA-2026-27746 1 CVE

Moderate: openssl-fips-provider security update (Oracle Linux 10)

Published Sep 16, 2026 · Updated Sep 16, 2026

Ecosystem: Oracle Linux

Summary

[3.0.7-11.0.1]
- Add bundle with Oracle Linux 9 OpenSSL FIPS module packages [Orabug: 40015480]
- Update extract-src.sh script to support non-hobbled openssl tarball [Orabug: 40015480]

[3.0.7-11]
- Update sources and scripts for new build, to address CVE-2026-31790
Resolves: RHEL-173523

Fixed packages 2

ReleasePackageFixed in
Oracle Linux · 10 openssl-fips-provider 0:3.0.7-11.0.1.el10_2
Oracle Linux · 10 openssl-fips-provider-so 0:3.0.7-11.0.1.el10_2

Vulnerabilities 1

  • High 7.5
    CVE-2026-31790

    Incorrect Failure Handling in RSA KEM RSASVE Encapsulation

    Issue summary: Applications using RSASVE key encapsulation to establish a secret encryption key can send contents of an uninitialized memory buffer to a malicious peer. Impact summary: The uninitialized buffer might contain sensitive data from the previous ex…

    OpenSSL OpenSSL openssl openssl Debian Ubuntu Azure Linux Alpine Wolfi