Description
The SSL 3.0 implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f does not properly initialize data structures for block cipher padding, which might allow remote attackers to obtain sensitive information by decrypting the padding data sent by an SSL peer.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | openssl | 1.0.0f-1 | — |
| Debian 13 | openssl | 1.0.0f-1 | — |
| Debian 12 | openssl | 1.0.0f-1 | — |
| Debian 6.0 | openssl | 0.9.8o-4squeeze5 | DSA-2390-1 |
| Debian 5.0 | openssl | 0.9.8g-15+lenny15 | DSA-2390-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | openssl +3 | 1.0.0-20.el6_2.1 | RHSA-2012:0059 |
| RHEL 6 | rhev-hypervisor6 +1 | 6.2-20120209.0.el6_2 | RHSA-2012:0109 |
| RHEL 5 | openssl +2 | 0.9.8e-20.el5_7.1 | RHSA-2012:0060 |
| RHEL 4 | openssl +2 | 0.9.7a-43.18.el4 | RHSA-2012:0086 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 SP1 | libqt4 +1 | 4.8.6-7.1 | SUSE-SU-403 Forbidden-1, SUSE-SU-403 |
| SLES 12 SP1 | libqt4-devel-doc | 4.8.6-7.3 | SUSE-SU-403 Forbidden-1, SUSE-SU-403 |
| SLES 12 | libqt4 +1 | 4.8.6-7.1 | SUSE-SU-403 Forbidden-1, SUSE-SU-403 |
| SLES 12 | libqt4-devel-doc | 4.8.6-7.3 | SUSE-SU-403 Forbidden-1, SUSE-SU-403 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 12 SP1 | libqt4 +1 | 4.8.6-7.1 | SUSE-SU-403 Forbidden-1, SUSE-SU-403 |
| SLES for SAP 12 SP1 | libqt4-devel-doc | 4.8.6-7.3 | SUSE-SU-403 Forbidden-1, SUSE-SU-403 |
| SLES for SAP 12 | libqt4 +1 | 4.8.6-7.1 | SUSE-SU-403 Forbidden-1, SUSE-SU-403 |
| SLES for SAP 12 | libqt4-devel-doc | 4.8.6-7.3 | SUSE-SU-403 Forbidden-1, SUSE-SU-403 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | openssl-1_1 | 1.1.1l-1.2 | openSUSE-SU-2024:11127-1 |
| openSUSE Tumbleweed | tor | 0.2.8.11-1.1 | openSUSE-SU-2024:10423-1 |
Advisories 9
- RHSA-2012:0109 Red Hat Security Advisory: rhev-hypervisor6 security and bug fix update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- RHSA-2012:0060 Red Hat Security Advisory: openssl security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2012:0086 Red Hat Security Advisory: openssl security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2012:0059 Red Hat Security Advisory: openssl security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-2390-1 openssl - several Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:10423-1 tor-0.2.8.11-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-403 Forbidden-1 Security update for OpenSSL SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-403 Security update for OpenSSL SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:11127-1 libopenssl-1_1-devel-1.1.1l-1.2 on GA media SUSE / openSUSE Security Updates · May 7, 2025
References
- 48528 third-party-advisory
- HPSBMU02786 vendor-advisory
- http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004564
- openSUSE-SU-2012:0083 vendor-advisory
- MDVSA-2012:006 vendor-advisory
- FEDORA-2012-18035 vendor-advisory
- http://www.openssl.org/news/secadv_20120104.txt
- SUSE-SU-2012:0084 vendor-advisory
- RHSA-2012:1308 vendor-advisory
- RHSA-2012:1307 vendor-advisory
- http://support.apple.com/kb/HT5784
- APPLE-SA-2013-06-04-1 vendor-advisory
- VU#737740 third-party-advisory
- HPSBUX02734 vendor-advisory
- MDVSA-2012:007 vendor-advisory
- RHSA-2012:1306 vendor-advisory
- HPSBOV02793 vendor-advisory
- 57353 third-party-advisory
- SSRT100852 vendor-advisory
- DSA-2390 vendor-advisory
- 55069 third-party-advisory
- http://aix.software.ibm.com/aix/efixes/security/openssl_advisory3.asc