Description
Validating the order of the public keys in the Diffie-Hellman Key Agreement Protocol, when an approved safe prime is used, allows remote attackers (from the client side) to trigger unnecessarily expensive server-side DHE modular-exponentiation calculations. The client may cause asymmetric resource consumption. The basic attack scenario is that the client must claim that it can only communicate with DHE, and the server must be configured to allow DHE and validate the order of the public key.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP6 | openssl-3 | 3.1.4-150600.5.18.1 | SUSE-SU-2024:3501-1 |
| SLES 15 SP5 | openssl-3 | 3.0.8-150500.5.45.1 | SUSE-SU-2024:3766-1, SUSE-SU-2024:3500-1 |
| SLES 15 SP4 | openssl-3 | 3.0.8-150400.4.66.1 | SUSE-SU-2024:3871-1, SUSE-SU-2024:3525-1 |
Show 8 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 15 SP4 | openssl-3 | 3.0.8-150400.4.66.1 | SUSE-SU-2024:3525-1 |
| SLE Micro 6.1 | openssl-3 | 3.1.4-slfo.1.1_10.1 | SUSE-SU-2026:22132-1 |
| SLE Micro 6.0 | openssl-3 | 3.1.4-7.1 | SUSE-SU-2025:20081-1 |
| SLE Micro 5.4 | openssl-3 | 3.0.8-150400.4.66.1 | SUSE-SU-2024:3871-1, SUSE-SU-2024:3525-1 |
| SLE Micro 5.3 | openssl-3 | 3.0.8-150400.4.66.1 | SUSE-SU-2024:3871-1, SUSE-SU-2024:3525-1 |
| SLE HPC 15 SP4 | openssl-3 | 3.0.8-150400.4.66.1 | SUSE-SU-2024:3525-1 |
| SUSE Manager Server 4.3 | openssl-3 | 3.0.8-150400.4.66.1 | SUSE-SU-2024:3871-1, SUSE-SU-2024:3525-1 |
| SUSE Manager Proxy 4.3 | openssl-3 | 3.0.8-150400.4.66.1 | SUSE-SU-2024:3525-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | openssl-3 | 3.1.4-14.1 | openSUSE-SU-2024:14366-1 |
| openSUSE Leap 15.6 | openssl-3 | 3.1.4-150600.5.18.1 | SUSE-SU-2024:3501-1 |
| openSUSE Leap 15.5 | openssl-3 | 3.0.8-150500.5.45.1 | SUSE-SU-2024:3766-1, SUSE-SU-2024:3500-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | openssl +4 | 1:3.0.8-1.amzn2023.0.16 | ALAS2023-2024-727 |
Advisories 17
- SSA-265688 SSA-265688: Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 TM MFP V1.1 Siemens ProductCERT · Oct 13, 2026
- SUSE-SU-2026:22132-1 Security update for openssl-3 SUSE / openSUSE Security Updates · Jun 18, 2026
- ICSA-24-102-01 Siemens SIMATIC S7-1500 TM MFP CISA ICS & IT advisories · May 14, 2026
- SUSE-SU-2025:20081-1 Security update for openssl-3 SUSE / openSUSE Security Updates · Mar 23, 2026
- ICSA-26-071-03 Siemens SIDIS Prime CISA ICS & IT advisories · Mar 12, 2026
- NCSC-2026-0079 Kwetsbaarheden verholpen in Siemens producten NCSC-NL (Netherlands) · Mar 10, 2026
- SSA-485750 SSA-485750: Multiple Vulnerabilities in SIDIS Prime Before V4.0.800 Siemens ProductCERT · Mar 10, 2026
- ICSA-26-043-06 Siemens SINEC OS CISA ICS & IT advisories · Feb 25, 2026
- SSA-089022 SSA-089022: Multiple Vulnerabilities in Third-Party Components in SINEC OS before V3.3 Siemens ProductCERT · Feb 24, 2026
- SUSE-SU-2024:3500-1 Security update for openssl-3 SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:14366-1 libopenssl-3-devel-3.1.4-14.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:3871-1 Security update for openssl-3 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:3525-1 Security update for openssl-3 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:3766-1 Security update for openssl-3 SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2024-3056 Diffie-Hellman Implementierungen: Mehrere Schwachstellen ermöglichen Denial of Service BSI CERT-Bund (WID) · Jul 29, 2025
- SUSE-SU-2024:3501-1 Security update for openssl-3 SUSE / openSUSE Security Updates · May 2, 2025
- ALAS2023-2024-727 Moderate: openssl security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Oct 14, 2024