[CLSA-2026:1792414477] openssl: Fix of 4 CVEs
Type:
security
Severity:
Moderate
Release date:
2026-10-23 22:41:45 UTC
Description:
- CVE-2026-54872: pad the ladder scalar to a fixed, value-independent width before the cardinality additions so EC scalar multiplication on curves using the generic Montgomery ladder no longer leaks the scalar's magnitude by timing - CVE-2026-75805: guard the issuer and serial-number comparisons in OSSL_CMP_exec_RR_ses() so a revocation response containing a CertId does not dereference NULL when the certificate to be revoked was given as a PKCS#10 CSR - CVE-2026-75806: reject TLS 1.2 and DTLS 1.2 AEAD records shorter than the mandatory explicit IV and authentication tag before AEAD processing, so a short record is reported as bad_record_mac (TLS) or silently dropped (DTLS) instead of raising a fatal internal error
CVEs fixed:
Updated packages:
  • openssl-3.0.7-20.el9_2.tuxcare.1.els26.aarch64.rpm
    sha:af458bb139e049bbe1ff8fce8b712851d9486f5908da63da59fd4f6c2f771e1f
  • openssl-3.0.7-20.el9_2.tuxcare.1.els26.i686.rpm
    sha:9528de5167eb4a06c79ada7a2922ada65c2e52d370f89e51134317d86ab71177
  • openssl-3.0.7-20.el9_2.tuxcare.1.els26.x86_64.rpm
    sha:9858aa059956b2b04e19a2cd4ffd6ee03130f35bf62037d8bb245522eedb4da9
  • openssl-devel-3.0.7-20.el9_2.tuxcare.1.els26.aarch64.rpm
    sha:afb779acf5156f539cad52bdc22bb040875578961793b3971bdf82e2b9d68f9b
  • openssl-devel-3.0.7-20.el9_2.tuxcare.1.els26.i686.rpm
    sha:8fdad743ee96384b7ddb5125805f631f1787c8fdcc560238dfcddbba601eab44
  • openssl-devel-3.0.7-20.el9_2.tuxcare.1.els26.x86_64.rpm
    sha:3a42f0b6bc06b3c7530e47fd13e0c8b3e766293004a168efdb4b7b0f5b66d563
  • openssl-libs-3.0.7-20.el9_2.tuxcare.1.els26.aarch64.rpm
    sha:17209b64df03f15194bc270984dfa337e68cfe5b0aa1506172e2bd0df99b82a1
  • openssl-libs-3.0.7-20.el9_2.tuxcare.1.els26.i686.rpm
    sha:ef57150168268538bc762dcc4a43c12fa1e6e721f19f725bf05b73b5923a6ca9
  • openssl-libs-3.0.7-20.el9_2.tuxcare.1.els26.x86_64.rpm
    sha:b1b8a3d5a523b21ceadb80c589ef0b36e115375dae4b403fcf80694698dc4e2a
  • openssl-perl-3.0.7-20.el9_2.tuxcare.1.els26.aarch64.rpm
    sha:e324193b0c66bd94492c8621f51a2a97b11c191a97afadef046ad21caf7595d2
  • openssl-perl-3.0.7-20.el9_2.tuxcare.1.els26.i686.rpm
    sha:1da58f5a7fea7b2afd914e07a455bd3ffd1561bfceb140474e47d131023a850b
  • openssl-perl-3.0.7-20.el9_2.tuxcare.1.els26.x86_64.rpm
    sha:9d537eeb0b0a2986479df46db96bcea531c3bbbe167a4f81743871a3c42c47ab
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.