Skip to content
OpenAdvisories
Critical SUSE-RU-2026:5149-1 1 CVE

Recommended update for openssl-3

Published Nov 9, 2026 · Updated Nov 10, 2026

Ecosystem: SUSE

Summary

This update for openssl-3 fixes the following issues:

- Build with enable-sslkeylog to support the SSLKEYLOGFILE
environment variable usage. (jsc#PED-17079)

- Allow to bypass the strict tag initialization and length
enforcement added in the fix for CVE-2026-34182 when the env
variable OPENSSL_ALLOW_CMS_UNAUTHENTICATED_AEAD is defined and
set to a non-zero value. (bsc#1281325)

Fixed packages 1

ReleasePackageFixed in
SUSE · SLES 15 SP7 Linux Enterprise Module for Basesystem 15 SP7 openssl-3 3.5.0-150700.5.56.1

Vulnerabilities 1

  • Critical 9.1
    CVE-2026-34182

    CMS AuthEnvelopedData Processing May Accept Forged Messages

    Issue Summary: Cryptographic Message Services (CMS) processing fails to perform sufficient input validation on the cipher and tag length fields of AuthEnvelopedData containers, leading to various potential compromises. Impact Summary: Attackers making use of …

    OpenSSL OpenSSL openssl openssl Debian Ubuntu Azure Linux Alpine Wolfi

References

  • report
    https://bugzilla.suse.com/1281325
  • web
    https://www.suse.com/security/cve/CVE-2026-34182