Skip to content
OpenAdvisories
Medium ELSA-2026-3042 1 CVE

Moderate: openssl security update (Oracle Linux 8)

Published Feb 23, 2026 · Updated Feb 23, 2026

Ecosystem: Oracle Linux

Summary

[1:1.1.1k-15]
- Fix CVE-2025-69419: Arbitrary code execution due to out-of-bounds write in PKCS#12 processing
ticket_lifetime_hint exceed 1 week in TLSv1.3 and breaks compliant clients
Resolves: RHEL-149165
Resolves: RHEL-142715

[1:1.1.1k-14.1]
- Backport fix for openssl: Out-of-bounds read & write in RFC 3211 KEK Unwrap
Fix CVE-2025-9230
Resolves: RHEL-128615

Fixed packages 4

ReleasePackageFixed in
Oracle Linux · 8 openssl 1:1.1.1k-15.el8_6
Oracle Linux · 8 openssl-devel 1:1.1.1k-15.el8_6
Oracle Linux · 8 openssl-libs 1:1.1.1k-15.el8_6
Oracle Linux · 8 openssl-perl 1:1.1.1k-15.el8_6

Vulnerabilities 1

  • High 7.4
    CVE-2025-69419 Public exploit

    Out of bounds write in PKCS12_get_friendlyname() UTF-8 conversion

    Issue summary: Calling PKCS12_get_friendlyname() function on a maliciously crafted PKCS#12 file with a BMPString (UTF-16BE) friendly name containing non-ASCII BMP code point can trigger a one byte write before the allocated buffer. Impact summary: The out-of-…

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi