Skip to content
OpenAdvisories
Critical SUSE-RU-2026:5018-1 1 CVE

Recommended update for openssl-3

Published Nov 2, 2026 · Updated Nov 3, 2026

Ecosystem: SUSE

Summary

This update for openssl-3 fixes the following issues:

- Allow to bypass the strict tag initialization and length
enforcement added in the fix for CVE-2026-34182 when the env
variable OPENSSL_ALLOW_CMS_UNAUTHENTICATED_AEAD is defined and
set to a non-zero value. (bsc#1281325)

Fixed packages 6

ReleasePackageFixed in
SUSE · SLE HPC 15 SP4 Linux Enterprise High Performance Computing 15 SP4-ESPOS openssl-3 3.0.8-150400.4.104.1
SUSE · SLE HPC 15 SP4 Linux Enterprise High Performance Computing 15 SP4-LTSS openssl-3 3.0.8-150400.4.104.1
SUSE · SLE Micro 5.3 Linux Enterprise Micro 5.3 openssl-3 3.0.8-150400.4.104.1
SUSE · SLE Micro 5.4 Linux Enterprise Micro 5.4 openssl-3 3.0.8-150400.4.104.1
SUSE · SLES 15 SP4 Linux Enterprise Server 15 SP4-LTSS openssl-3 3.0.8-150400.4.104.1
SUSE · SLES for SAP 15 SP4 Linux Enterprise Server for SAP Applications 15 SP4 openssl-3 3.0.8-150400.4.104.1

Vulnerabilities 1

  • Critical 9.1
    CVE-2026-34182

    CMS AuthEnvelopedData Processing May Accept Forged Messages

    Issue Summary: Cryptographic Message Services (CMS) processing fails to perform sufficient input validation on the cipher and tag length fields of AuthEnvelopedData containers, leading to various potential compromises. Impact Summary: Attackers making use of …

    OpenSSL OpenSSL openssl openssl Debian Ubuntu Azure Linux Alpine Wolfi

References

  • report
    https://bugzilla.suse.com/1281325
  • web
    https://www.suse.com/security/cve/CVE-2026-34182