Skip to content
OpenAdvisories
High RHSA-2023:2523 1 CVE

Red Hat Security Advisory: openssl security and bug fix update

Published Sep 16, 2024 · Updated Jun 30, 2026

Ecosystem: Red Hat

Fixed packages 10

ReleasePackageFixed in
Red Hat · RHEL 9 enterprise_linux:9::appstream openssl-debuginfo 1:3.0.7-6.el9_2
Red Hat · RHEL 9 enterprise_linux:9::appstream openssl-debugsource 1:3.0.7-6.el9_2
Red Hat · RHEL 9 enterprise_linux:9::appstream openssl-devel 1:3.0.7-6.el9_2
Red Hat · RHEL 9 enterprise_linux:9::appstream openssl-libs-debuginfo 1:3.0.7-6.el9_2
Red Hat · RHEL 9 enterprise_linux:9::appstream openssl-perl 1:3.0.7-6.el9_2
Red Hat · RHEL 9 enterprise_linux:9::baseos openssl 1:3.0.7-6.el9_2
Red Hat · RHEL 9 enterprise_linux:9::baseos openssl-debuginfo 1:3.0.7-6.el9_2
Red Hat · RHEL 9 enterprise_linux:9::baseos openssl-debugsource 1:3.0.7-6.el9_2
Red Hat · RHEL 9 enterprise_linux:9::baseos openssl-libs 1:3.0.7-6.el9_2
Red Hat · RHEL 9 enterprise_linux:9::baseos openssl-libs-debuginfo 1:3.0.7-6.el9_2

Vulnerabilities 1

  • High 7.5
    CVE-2022-3358 Public exploit

    Using a Custom Cipher with NID_undef may lead to NULL encryption

    OpenSSL supports creating a custom cipher via the legacy EVP_CIPHER_meth_new() function and associated function calls. This function was deprecated in OpenSSL 3.0 and application authors are instead encouraged to use the new provider mechanism in order to imp…

    OpenSSL OpenSSL openssl openssl Debian Ubuntu Alpine Wolfi crates.io

References

  • article
    https://access.redhat.com/security/updates/classification/#low
  • article
    https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/9.2_release_notes/index
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2060044
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2083879
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2094956
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2128412
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2129063
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2133809
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2134740
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2136250
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2137557
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2141597
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2141695
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2141748
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2142087
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2142121
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2142131
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2142517
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2144561
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2157965
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2168224
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_2523.json
  • report
    https://access.redhat.com/security/cve/CVE-2022-3358
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2022-3358
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2022-3358
  • article
    https://www.openssl.org/news/secadv/20221011.txt