Release date:
2026-09-16 09:35:44 UTC
Description:
- CVE-2026-54874: buffer only a DTLS record's own bytes instead of the whole
read buffer, and lower the unprocessed records queue limit, to avoid remote
memory exhaustion
- CVE-2026-63072: size the CMS key-unwrap output buffer for the AES-WRAP-PAD
worst case to prevent an 8-byte out-of-bounds heap write in CMS_decrypt()
Updated packages:
-
openssl-3.0.7-20.el9_2.tuxcare.1.els22.x86_64.rpm
sha:444f924b5f8c0d4c6d2792040c3c9658a0b30da1f48c5e059d10828069cc08cf
-
openssl-devel-3.0.7-20.el9_2.tuxcare.1.els22.i686.rpm
sha:59966ee77c9a28aeb07ee3889db545fd4c637eb5ecc7008c2d221ad2b20efb50
-
openssl-devel-3.0.7-20.el9_2.tuxcare.1.els22.x86_64.rpm
sha:d927b53c2bd8f4fc434727f01d8e9b9d8015b189073a0c102be816f84acd296e
-
openssl-libs-3.0.7-20.el9_2.tuxcare.1.els22.i686.rpm
sha:96f5c063ca34ffcca9422c58249fbbda510dae669be3e6cde20394e6b51f437c
-
openssl-libs-3.0.7-20.el9_2.tuxcare.1.els22.x86_64.rpm
sha:ecdbb05ac2596a23918eae53e304d3fc28045b1547c1c191b9cdc859acfc06c7
-
openssl-perl-3.0.7-20.el9_2.tuxcare.1.els22.x86_64.rpm
sha:b4f59050f265471b07addd14bcccc76979c605b857a706d036f46aac68f22580
Notes:
This page is generated automatically and has not been checked for errors. For clarification or
corrections please contact the
CloudLinux Packaging Team.
