Summary
[3.5.5-3.0.1]
- Replace upstream references in fips man pages [Orabug: 35824276]
- Update additional upstream references
- Add FIPS package change: add fips suffix to Release and
set Epoch to 10 [Orabug: 35824276]
- Update FIPS module name [Orabug: 35824276]
- Enable openssl-fips-provider dependency [Orabug: 36504822]
- Temporary disable openssl-fips-provider dependency [Orabug: 36504822]
- Replace upstream references [Orabug: 34340177]
[1:3.5.5-3]
- Fix CVE-2026-28390
Resolves: RHEL-165870
[1:3.5.5-2]
- Fix CVE-2026-31790
Resolves: RHEL-161586
[1:3.5.5-1]
- Rebase to OpenSSL 3.5.5
Resolves: RHEL-136895
Resolves: RHEL-142004
Resolves: RHEL-142012
Resolves: RHEL-142020
Resolves: RHEL-142024
Resolves: RHEL-142028
Resolves: RHEL-142032
Resolves: RHEL-142036
Resolves: RHEL-142040
Resolves: RHEL-142044
Resolves: RHEL-142048
Resolves: RHEL-142052
Resolves: RHEL-142056
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 9 | openssl | 10:3.5.5-3.0.1.el9_8_fips |
| Oracle Linux · 9 | openssl-devel | 10:3.5.5-3.0.1.el9_8_fips |
| Oracle Linux · 9 | openssl-libs | 10:3.5.5-3.0.1.el9_8_fips |
| Oracle Linux · 9 | openssl-perl | 10:3.5.5-3.0.1.el9_8_fips |
Vulnerabilities 1
-
High 7.5
Possible NULL Dereference When Processing CMS KeyTransportRecipientInfo
Issue summary: During processing of a crafted CMS EnvelopedData message with KeyTransportRecipientInfo a NULL pointer dereference can happen. Impact summary: Applications that process attacker-controlled CMS data may crash before authentication or cryptograph…