{"id":"CVE-2024-5535","aliases":["ALPINE-CVE-2024-5535","ALSA-2024:7848","ALSA-2024:9333","ALSA-2025:1671","ALSA-2025:1673","ALSA-2026:60329","AZL-42975","AZL-42988","AZL-43309","AZL-47733","AZL-78567","BELL-CVE-2024-5535","CLSA-2024-1730801286","CLSA-2024-1730801437","CLSA-2024-1731344946","CLSA-2025-1740823577","CLSA-2025-1740824456","CLSA-2025-1741074282","CLSA-2026-1780682107","CLSA-2026-1780682108","CLSA-2026-1780683040","DEBIAN-CVE-2024-5535","DLA-3942-1","DLA-3942-2","EUVD-2024-46737","GHSA-4fc7-mvrr-wv2c","JLSEC-2026-252","MGASA-2024-0247","MGASA-2024-0281","MGASA-2024-0330","OESA-2024-1879","OESA-2024-1914","OESA-2025-1288","RHSA-2024:7846","RHSA-2024:7847","RHSA-2024:7848","RHSA-2024:9333","RHSA-2025:1671","RHSA-2025:1673","RHSA-2025:3452","RHSA-2025:3666","RHSA-2026:58563","RHSA-2026:60329","RHSA-2026:66524","RLSA-2024:7848","RLSA-2024:9333","RLSA-2025:1671","RLSA-2025:1673","RLSA-2026:60329","ROOT-OS-ALPINE-315-CVE-2024-5535","SUSE-SU-2024:2635-1","SUSE-SU-2024:2761-1","SUSE-SU-2024:2891-1","SUSE-SU-2024:2909-1","SUSE-SU-2024:2927-1","SUSE-SU-2024:2931-1","SUSE-SU-2024:2933-1","SUSE-SU-2024:2953-1","SUSE-SU-2024:2989-1","SUSE-SU-2024:2991-1","SUSE-SU-2024:3019-1","SUSE-SU-2024:3119-1","SUSE-SU-2025:20014-1","UBUNTU-CVE-2024-5535","USN-6937-1","USN-7894-1","USN-8678-2","openSUSE-SU-2024:14219-1","openSUSE-SU-2024:14220-1"],"status":"published","title":"SSL_select_next_proto buffer overread","description":"Issue summary: Calling the OpenSSL API function SSL_select_next_proto with an\nempty supported client protocols buffer may cause a crash or memory contents to\nbe sent to the peer.\n\nImpact summary: A buffer overread can have a range of potential consequences\nsuch as unexpected application beahviour or a crash. In particular this issue\ncould result in up to 255 bytes of arbitrary private data from memory being sent\nto the peer leading to a loss of confidentiality. However, only applications\nthat directly call the SSL_select_next_proto function with a 0 length list of\nsupported client protocols are affected by this issue. This would normally never\nbe a valid scenario and is typically not under attacker control but may occur by\naccident in the case of a configuration or programming error in the calling\napplication.\n\nThe OpenSSL API function SSL_select_next_proto is typically used by TLS\napplications that support ALPN (Application Layer Protocol Negotiation) or NPN\n(Next Protocol Negotiation). NPN is older, was never standardised and\nis deprecated in favour of ALPN. We believe that ALPN is significantly more\nwidely deployed than NPN. The SSL_select_next_proto function accepts a list of\nprotocols from the server and a list of protocols from the client and returns\nthe first protocol that appears in the server list that also appears in the\nclient list. In the case of no overlap between the two lists it returns the\nfirst item in the client list. In either case it will signal whether an overlap\nbetween the two lists was found. In the case where SSL_select_next_proto is\ncalled with a zero length client list it fails to notice this condition and\nreturns the memory immediately following the client list pointer (and reports\nthat there was no overlap in the lists).\n\nThis function is typically called from a server side application callback for\nALPN or a client side application callback for NPN. In the case of ALPN the list\nof protocols supplied by the client is guaranteed by libssl to never be zero in\nlength. The list of server protocols comes from the application and should never\nnormally be expected to be of zero length. In this case if the\nSSL_select_next_proto function has been called as expected (with the list\nsupplied by the client passed in the client/client_len parameters), then the\napplication will not be vulnerable to this issue. If the application has\naccidentally been configured with a zero length server list, and has\naccidentally passed that zero length server list in the client/client_len\nparameters, and has additionally failed to correctly handle a \"no overlap\"\nresponse (which would normally result in a handshake failure in ALPN) then it\nwill be vulnerable to this problem.\n\nIn the case of NPN, the protocol permits the client to opportunistically select\na protocol when there is no overlap. OpenSSL returns the first client protocol\nin the no overlap case in support of this. The list of client protocols comes\nfrom the application and should never normally be expected to be of zero length.\nHowever if the SSL_select_next_proto function is accidentally called with a\nclient_len of 0 then an invalid memory pointer will be returned instead. If the\napplication uses this output as the opportunistic protocol then the loss of\nconfidentiality will occur.\n\nThis issue has been assessed as Low severity because applications are most\nlikely to be vulnerable if they are using NPN instead of ALPN - but NPN is not\nwidely used. It also requires an application configuration or programming error.\nFinally, this issue would not typically be under attacker control making active\nexploitation unlikely.\n\nThe FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue.\n\nDue to the low severity of this issue we are not issuing new releases of\nOpenSSL at this time. The fix will be included in the next releases when they\nbecome available.","severity":{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.05582,"percentile":0.92944,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-125","CWE-200"],"published":"2024-06-27T10:30:53Z","modified":"2026-11-05T05:36:30Z","exploits":[{"source":"pocgithub","id":"websecnl/CVE-2024-5535","title":"websecnl/CVE-2024-5535","date":"2025-03-15","url":"https://github.com/websecnl/CVE-2024-5535"}],"fixes":[{"ecosystem":"Alpine:v3.17","package":"openssl","fixed_in":["3.0.14-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"openssl","fixed_in":["3.1.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"openssl","fixed_in":["3.1.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"openssl","fixed_in":["3.3.1-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"openssl","fixed_in":["3.3.1-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"openssl","fixed_in":["3.3.1-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"openssl","fixed_in":["3.3.1-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"openssl","fixed_in":["3.3.1-r1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"openssl","fixed_in":["1:1.1.1k-14.el8_6"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"openssl-devel","fixed_in":["1:1.1.1k-14.el8_6"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"openssl-libs","fixed_in":["1:1.1.1k-14.el8_6"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"openssl-perl","fixed_in":["1:1.1.1k-14.el8_6"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"mingw32-openssl","fixed_in":["1.0.2k-4.el8_10"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"mingw64-openssl","fixed_in":["1.0.2k-4.el8_10"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"openssl","fixed_in":["3.3.0-2"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"cloud-hypervisor-cvm","fixed_in":["38.0.72.2-3"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"openssl","fixed_in":["1.1.1k-33"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"hvloader","fixed_in":["1.0.1-6"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"openssl","fixed_in":["3.0.14-r1"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"openssl","fixed_in":["3.3.1-r2"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:23","package":"openssl","fixed_in":["3.0.14-r1"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:stream","package":"openssl","fixed_in":["3.3.1-r2"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.4","package":"openssl","fixed_in":["1:1.1.1g-15.el8.4.tuxcare.els12"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.4","package":"openssl-devel","fixed_in":["1:1.1.1g-15.el8.4.tuxcare.els12"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.4","package":"openssl-libs","fixed_in":["1:1.1.1g-15.el8.4.tuxcare.els12"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.4","package":"openssl-perl","fixed_in":["1:1.1.1g-15.el8.4.tuxcare.els12"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.4","package":"openssl-static","fixed_in":["1:1.1.1g-15.el8.4.tuxcare.els12"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.5","package":"openssl","fixed_in":["1:1.1.1k-5.el8.5.tuxcare.els11"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.5","package":"openssl-devel","fixed_in":["1:1.1.1k-5.el8.5.tuxcare.els11"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.5","package":"openssl-libs","fixed_in":["1:1.1.1k-5.el8.5.tuxcare.els11"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.5","package":"openssl-perl","fixed_in":["1:1.1.1k-5.el8.5.tuxcare.els11"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.5","package":"openssl-static","fixed_in":["1:1.1.1k-5.el8.5.tuxcare.els11"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS-Stream:8","package":"openssl","fixed_in":["1:1.1.1k-12.el8.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS-Stream:8","package":"openssl-devel","fixed_in":["1:1.1.1k-12.el8.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS-Stream:8","package":"openssl-libs","fixed_in":["1:1.1.1k-12.el8.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS-Stream:8","package":"openssl-perl","fixed_in":["1:1.1.1k-12.el8.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS-Stream:8","package":"openssl-static","fixed_in":["1:1.1.1k-12.el8.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"openssl","fixed_in":["3.0.15-1~deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"openssl","fixed_in":["3.3.2-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"openssl","fixed_in":["3.3.2-1"],"sources":["osv"]},{"ecosystem":"Julia","package":"OpenSSL_jll","fixed_in":["3.0.15+0"],"sources":["osv"]},{"ecosystem":"Julia","package":"Openresty_jll","fixed_in":["1.27.1+0"],"sources":["osv"]},{"ecosystem":"Mageia:9","package":"openssl","fixed_in":["3.0.14-1.mga9"],"sources":["osv"]},{"ecosystem":"Mageia:9","package":"quictls","fixed_in":["3.0.15-1.mga9"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"openssl","fixed_in":["1.1.1f-35.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS","package":"openssl","fixed_in":["3.0.12-9.oe2403"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"openssl","fixed_in":["1.1.1wa-8.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP1","package":"openssl","fixed_in":["1.1.1m-37.oe2203sp1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP3","package":"openssl","fixed_in":["1.1.1wa-8.oe2203sp3"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP3","package":"edk2","fixed_in":["202011-19.oe2203sp3"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"edk2","fixed_in":["202002-23.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP1","package":"edk2","fixed_in":["202011-19.oe2203sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS","package":"edk2","fixed_in":["202308-9.oe2403"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"edk2","fixed_in":["202011-19.oe2203sp4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.6::baseos","package":"openssl","fixed_in":["1:1.1.1k-14.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.6::baseos","package":"openssl-debuginfo","fixed_in":["1:1.1.1k-14.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.6::baseos","package":"openssl-debugsource","fixed_in":["1:1.1.1k-14.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.6::baseos","package":"openssl-devel","fixed_in":["1:1.1.1k-14.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.6::baseos","package":"openssl-libs","fixed_in":["1:1.1.1k-14.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.6::baseos","package":"openssl-libs-debuginfo","fixed_in":["1:1.1.1k-14.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.6::baseos","package":"openssl-perl","fixed_in":["1:1.1.1k-14.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.6::baseos","package":"openssl","fixed_in":["1:1.1.1k-14.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.6::baseos","package":"openssl-debuginfo","fixed_in":["1:1.1.1k-14.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.6::baseos","package":"openssl-debugsource","fixed_in":["1:1.1.1k-14.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.6::baseos","package":"openssl-devel","fixed_in":["1:1.1.1k-14.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.6::baseos","package":"openssl-libs","fixed_in":["1:1.1.1k-14.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.6::baseos","package":"openssl-libs-debuginfo","fixed_in":["1:1.1.1k-14.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.6::baseos","package":"openssl-perl","fixed_in":["1:1.1.1k-14.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.6::baseos","package":"openssl","fixed_in":["1:1.1.1k-14.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.6::baseos","package":"openssl-debuginfo","fixed_in":["1:1.1.1k-14.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.6::baseos","package":"openssl-debugsource","fixed_in":["1:1.1.1k-14.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.6::baseos","package":"openssl-devel","fixed_in":["1:1.1.1k-14.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.6::baseos","package":"openssl-libs","fixed_in":["1:1.1.1k-14.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.6::baseos","package":"openssl-libs-debuginfo","fixed_in":["1:1.1.1k-14.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.6::baseos","package":"openssl-perl","fixed_in":["1:1.1.1k-14.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.8::baseos","package":"openssl","fixed_in":["1:1.1.1k-14.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.8::baseos","package":"openssl-debuginfo","fixed_in":["1:1.1.1k-14.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.8::baseos","package":"openssl-debugsource","fixed_in":["1:1.1.1k-14.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.8::baseos","package":"openssl-devel","fixed_in":["1:1.1.1k-14.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.8::baseos","package":"openssl-libs","fixed_in":["1:1.1.1k-14.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.8::baseos","package":"openssl-libs-debuginfo","fixed_in":["1:1.1.1k-14.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.8::baseos","package":"openssl-perl","fixed_in":["1:1.1.1k-14.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"openssl","fixed_in":["1:1.1.1k-14.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"openssl-debuginfo","fixed_in":["1:1.1.1k-14.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"openssl-debugsource","fixed_in":["1:1.1.1k-14.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"openssl-devel","fixed_in":["1:1.1.1k-14.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"openssl-libs","fixed_in":["1:1.1.1k-14.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"openssl-libs-debuginfo","fixed_in":["1:1.1.1k-14.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"openssl-perl","fixed_in":["1:1.1.1k-14.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"openssl-debuginfo","fixed_in":["1:3.0.7-29.el9_4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"openssl-debugsource","fixed_in":["1:3.0.7-29.el9_4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"openssl-devel","fixed_in":["1:3.0.7-29.el9_4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"openssl-libs-debuginfo","fixed_in":["1:3.0.7-29.el9_4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"openssl-perl","fixed_in":["1:3.0.7-29.el9_4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.4::baseos","package":"openssl","fixed_in":["1:3.0.7-29.el9_4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.4::baseos","package":"openssl-debuginfo","fixed_in":["1:3.0.7-29.el9_4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.4::baseos","package":"openssl-debugsource","fixed_in":["1:3.0.7-29.el9_4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.4::baseos","package":"openssl-libs","fixed_in":["1:3.0.7-29.el9_4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.4::baseos","package":"openssl-libs-debuginfo","fixed_in":["1:3.0.7-29.el9_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"mingw-openssl","fixed_in":["0:1.0.2k-4.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"mingw32-openssl","fixed_in":["0:1.0.2k-4.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"mingw32-openssl-debuginfo","fixed_in":["0:1.0.2k-4.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"mingw64-openssl","fixed_in":["0:1.0.2k-4.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"mingw64-openssl-debuginfo","fixed_in":["0:1.0.2k-4.el8_10"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"openssl","fixed_in":["1:1.1.1k-14.el8_10"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"mingw-openssl","fixed_in":["0:1.0.2k-4.el8_10"],"sources":["osv"]},{"ecosystem":"Root:Alpine:3.15","package":"openssl","fixed_in":["1.1.1w-r10073","1.1.1w-r10076","1.1.1w-r10074","1.1.1w-r10075"],"sources":["osv"]},{"ecosystem":"Root:Alpine:3.15","package":"rootio-openssl","fixed_in":["1.1.1w-r10073","1.1.1w-r10076","1.1.1w-r10074","1.1.1w-r10075"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"openssl-3","fixed_in":["3.1.4-150600.5.10.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.6","package":"openssl-3","fixed_in":["3.1.4-150600.5.10.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Live Patching 15 SP6","package":"openssl-3-livepatches","fixed_in":["0.1-150600.13.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"openssl-1_1","fixed_in":["1.1.1l-150500.17.34.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"openssl-1_1","fixed_in":["1.1.1l-150500.17.34.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap Micro 5.5","package":"openssl-1_1","fixed_in":["1.1.1l-150500.17.34.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.5","package":"openssl-1_1","fixed_in":["1.1.1l-150500.17.34.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"openssl-1_1","fixed_in":["1.1.1d-150200.11.94.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"openssl-1_1","fixed_in":["1.1.1d-150200.11.94.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"openssl-1_1","fixed_in":["1.1.1d-150200.11.94.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"openssl-1_1","fixed_in":["1.1.1d-150200.11.94.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"openssl-1_1","fixed_in":["1.1.1d-150200.11.94.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"openssl-1_1","fixed_in":["1.1.1d-150200.11.94.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.1","package":"openssl-1_1","fixed_in":["1.1.1d-150200.11.94.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"openssl-1_1","fixed_in":["1.1.1d-150200.11.94.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 7.1","package":"openssl-1_1","fixed_in":["1.1.1d-150200.11.94.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"openssl-1_1","fixed_in":["1.1.1l-150400.7.72.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"openssl-1_1","fixed_in":["1.1.1l-150400.7.72.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"openssl-1_1","fixed_in":["1.1.1l-150400.7.72.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"openssl-1_1","fixed_in":["1.1.1l-150400.7.72.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"openssl-1_1","fixed_in":["1.1.1l-150400.7.72.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"openssl-1_1","fixed_in":["1.1.1l-150400.7.72.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Proxy 4.3","package":"openssl-1_1","fixed_in":["1.1.1l-150400.7.72.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 4.3","package":"openssl-1_1","fixed_in":["1.1.1l-150400.7.72.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"openssl-3","fixed_in":["3.0.8-150400.4.60.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"openssl-3","fixed_in":["3.0.8-150400.4.60.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"openssl-3","fixed_in":["3.0.8-150400.4.60.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"openssl-3","fixed_in":["3.0.8-150400.4.60.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"openssl-3","fixed_in":["3.0.8-150400.4.60.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"openssl-3","fixed_in":["3.0.8-150400.4.60.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Proxy 4.3","package":"openssl-3","fixed_in":["3.0.8-150400.4.60.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 4.3","package":"openssl-3","fixed_in":["3.0.8-150400.4.60.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"openssl-1_1","fixed_in":["1.1.1w-150600.5.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP6","package":"openssl-1_1","fixed_in":["1.1.1w-150600.5.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Legacy 15 SP6","package":"openssl-1_1","fixed_in":["1.1.1w-150600.5.6.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.6","package":"openssl-1_1","fixed_in":["1.1.1w-150600.5.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"openssl-1_0_0","fixed_in":["1.0.2p-3.95.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"openssl-1_0_0","fixed_in":["1.0.2p-3.95.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"openssl-1_0_0","fixed_in":["1.0.2p-3.95.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 11 SP4 LTSS EXTREME CORE","package":"openssl1","fixed_in":["1.0.1g-0.58.82.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"openssl-3","fixed_in":["3.0.8-150500.5.39.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.5","package":"openssl-3","fixed_in":["3.0.8-150500.5.39.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Legacy 15 SP5","package":"openssl-1_0_0","fixed_in":["1.0.2p-150000.3.94.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Legacy 15 SP6","package":"openssl-1_0_0","fixed_in":["1.0.2p-150000.3.94.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"openssl-1_0_0","fixed_in":["1.0.2p-150000.3.94.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"openssl-1_0_0","fixed_in":["1.0.2p-150000.3.94.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"openssl-1_0_0","fixed_in":["1.0.2p-150000.3.94.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"openssl-1_0_0","fixed_in":["1.0.2p-150000.3.94.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"openssl-1_0_0","fixed_in":["1.0.2p-150000.3.94.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"openssl-1_0_0","fixed_in":["1.0.2p-150000.3.94.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"openssl-1_0_0","fixed_in":["1.0.2p-150000.3.94.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"openssl-1_0_0","fixed_in":["1.0.2p-150000.3.94.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"openssl-1_0_0","fixed_in":["1.0.2p-150000.3.94.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 7.1","package":"openssl-1_0_0","fixed_in":["1.0.2p-150000.3.94.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.5","package":"openssl-1_0_0","fixed_in":["1.0.2p-150000.3.94.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.6","package":"openssl-1_0_0","fixed_in":["1.0.2p-150000.3.94.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"openssl","fixed_in":["1.0.1f-1ubuntu2.27+esm16"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"openssl","fixed_in":["1.0.2g-1ubuntu4.20+esm18"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"openssl","fixed_in":["1.1.1-1ubuntu2.1~18.04.23+esm10"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"openssl1.0","fixed_in":["1.0.2n-1ubuntu5.13+esm6"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"openssl","fixed_in":["1.1.1f-1ubuntu2.23"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"edk2","fixed_in":["2022.02-3ubuntu0.22.04.4"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"openssl","fixed_in":["3.0.2-0ubuntu1.17"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:FIPS-updates:22.04:LTS","package":"openssl","fixed_in":["3.0.2-0ubuntu1.17+Fips1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"edk2","fixed_in":["2024.02-2ubuntu0.6"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"openssl","fixed_in":["3.0.13-0ubuntu3.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:FIPS-updates:24.04:LTS","package":"openssl-fips","fixed_in":["3.0.13-0ubuntu3.6+Fips1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.17","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.14-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.1-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.1-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.1-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.1-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.1-r1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-14.el8_6"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"openssl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-14.el8_6"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"openssl-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-14.el8_6"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"openssl-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-14.el8_6"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.2.2-6.el9_5"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"openssl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.2.2-6.el9_5"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"openssl-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.2.2-6.el9_5"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"openssl-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.2.2-6.el9_5"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"mysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.41-2.el9_5"}]}],"bundled":49},{"source":"osv","ecosystem":"AlmaLinux:9","package":"mysql-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.41-2.el9_5"}]}],"bundled":49},{"source":"osv","ecosystem":"AlmaLinux:9","package":"mysql-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.41-2.el9_5"}]}],"bundled":49},{"source":"osv","ecosystem":"AlmaLinux:9","package":"mysql-errmsg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.41-2.el9_5"}]}],"bundled":49},{"source":"osv","ecosystem":"AlmaLinux:9","package":"mysql-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.41-2.el9_5"}]}],"bundled":49},{"source":"osv","ecosystem":"AlmaLinux:9","package":"mysql-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.41-2.el9_5"}]}],"bundled":49},{"source":"osv","ecosystem":"AlmaLinux:9","package":"mysql-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.41-2.el9_5"}]}],"bundled":49},{"source":"osv","ecosystem":"AlmaLinux:8","package":"mecab","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.996-2.module_el8.10.0+3965+b415b607"}]}],"bundled":49},{"source":"osv","ecosystem":"AlmaLinux:8","package":"mecab","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.996-2.module_el8.6.0+3340+d764b636"}]}],"bundled":49},{"source":"osv","ecosystem":"AlmaLinux:8","package":"mecab-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.996-2.module_el8.10.0+3965+b415b607"}]}],"bundled":49},{"source":"osv","ecosystem":"AlmaLinux:8","package":"mecab-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.996-2.module_el8.6.0+3340+d764b636"}]}],"bundled":49},{"source":"osv","ecosystem":"AlmaLinux:8","package":"mecab-ipadic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.0.20070801-17.module_el8.10.0+3965+b415b607"}]}],"bundled":49},{"source":"osv","ecosystem":"AlmaLinux:8","package":"mecab-ipadic-EUCJP","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.0.20070801-17.module_el8.10.0+3965+b415b607"}]}],"bundled":49},{"source":"osv","ecosystem":"AlmaLinux:8","package":"mysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.41-1.module_el8.10.0+3965+b415b607"}]}],"bundled":49},{"source":"osv","ecosystem":"AlmaLinux:8","package":"mysql-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.41-1.module_el8.10.0+3965+b415b607"}]}],"bundled":49},{"source":"osv","ecosystem":"AlmaLinux:8","package":"mysql-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.41-1.module_el8.10.0+3965+b415b607"}]}],"bundled":49},{"source":"osv","ecosystem":"AlmaLinux:8","package":"mysql-errmsg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.41-1.module_el8.10.0+3965+b415b607"}]}],"bundled":49},{"source":"osv","ecosystem":"AlmaLinux:8","package":"mysql-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.41-1.module_el8.10.0+3965+b415b607"}]}],"bundled":49},{"source":"osv","ecosystem":"AlmaLinux:8","package":"mysql-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.41-1.module_el8.10.0+3965+b415b607"}]}],"bundled":49},{"source":"osv","ecosystem":"AlmaLinux:8","package":"mysql-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.41-1.module_el8.10.0+3965+b415b607"}]}],"bundled":49},{"source":"osv","ecosystem":"AlmaLinux:8","package":"mingw32-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2k-4.el8_10"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"mingw64-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2k-4.el8_10"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.0-2"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"cloud-hypervisor-cvm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"38.0.72.2-3"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1k-33"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"hvloader","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.1-6"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"openssl-fips-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.1.2-2"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.8-r4"},{"fixed":"3.0.14-r1"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.1-r1"},{"fixed":"3.3.1-r2"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:23","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.8-r4"},{"fixed":"3.0.14-r1"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:stream","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.1-r1"},{"fixed":"3.3.1-r2"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1g-15.el8.4.tuxcare.els12"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"openssl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1g-15.el8.4.tuxcare.els12"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"openssl-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1g-15.el8.4.tuxcare.els12"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"openssl-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1g-15.el8.4.tuxcare.els12"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"openssl-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1g-15.el8.4.tuxcare.els12"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-5.el8.5.tuxcare.els11"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"openssl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-5.el8.5.tuxcare.els11"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"openssl-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-5.el8.5.tuxcare.els11"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"openssl-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-5.el8.5.tuxcare.els11"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"openssl-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-5.el8.5.tuxcare.els11"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-12.el8.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"openssl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-12.el8.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"openssl-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-12.el8.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"openssl-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-12.el8.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"openssl-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-12.el8.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"mysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.41-1.module_el8.4.0+2262+68960773.tuxcare.els1"}]}],"bundled":49},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"mysql-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.41-1.module_el8.4.0+2262+68960773.tuxcare.els1"}]}],"bundled":49},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"mysql-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.41-1.module_el8.4.0+2262+68960773.tuxcare.els1"}]}],"bundled":49},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"mysql-errmsg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.41-1.module_el8.4.0+2262+68960773.tuxcare.els1"}]}],"bundled":49},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"mysql-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.41-1.module_el8.4.0+2262+68960773.tuxcare.els1"}]}],"bundled":49},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"mysql-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.41-1.module_el8.4.0+2262+68960773.tuxcare.els1"}]}],"bundled":49},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"mysql-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.41-1.module_el8.4.0+2262+68960773.tuxcare.els1"}]}],"bundled":49},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"mysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.41-1.module_el8.5.0+2263+dd0000b0.tuxcare.els1"}]}],"bundled":49},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"mysql-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.41-1.module_el8.5.0+2263+dd0000b0.tuxcare.els1"}]}],"bundled":49},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"mysql-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.41-1.module_el8.5.0+2263+dd0000b0.tuxcare.els1"}]}],"bundled":49},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"mysql-errmsg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.41-1.module_el8.5.0+2263+dd0000b0.tuxcare.els1"}]}],"bundled":49},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"mysql-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.41-1.module_el8.5.0+2263+dd0000b0.tuxcare.els1"}]}],"bundled":49},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"mysql-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.41-1.module_el8.5.0+2263+dd0000b0.tuxcare.els1"}]}],"bundled":49},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"mysql-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.41-1.module_el8.5.0+2263+dd0000b0.tuxcare.els1"}]}],"bundled":49},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"mysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.41-1.module_el8+2274+9bedbd95.tuxcare.els1"}]}],"bundled":49},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"mysql-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.41-1.module_el8+2274+9bedbd95.tuxcare.els1"}]}],"bundled":49},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"mysql-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.41-1.module_el8+2274+9bedbd95.tuxcare.els1"}]}],"bundled":49},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"mysql-errmsg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.41-1.module_el8+2274+9bedbd95.tuxcare.els1"}]}],"bundled":49},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"mysql-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.41-1.module_el8+2274+9bedbd95.tuxcare.els1"}]}],"bundled":49},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"mysql-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.41-1.module_el8+2274+9bedbd95.tuxcare.els1"}]}],"bundled":49},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"mysql-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.41-1.module_el8+2274+9bedbd95.tuxcare.els1"}]}],"bundled":49},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"openssl11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-7.el7.tuxcare.els1"}]}],"bundled":14},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"openssl11-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-7.el7.tuxcare.els1"}]}],"bundled":14},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"openssl11-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-7.el7.tuxcare.els1"}]}],"bundled":14},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"openssl11-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-7.el7.tuxcare.els1"}]}],"bundled":14},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"openssl11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-7.el7.tuxcare.els1"}]}],"bundled":14},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"openssl11-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-7.el7.tuxcare.els1"}]}],"bundled":14},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"openssl11-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-7.el7.tuxcare.els1"}]}],"bundled":14},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"openssl11-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-7.el7.tuxcare.els1"}]}],"bundled":14},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"openssl11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-7.el7.tuxcare.els1"}]}],"bundled":14},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"openssl11-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-7.el7.tuxcare.els1"}]}],"bundled":14},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"openssl11-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-7.el7.tuxcare.els1"}]}],"bundled":14},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"openssl11-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-7.el7.tuxcare.els1"}]}],"bundled":14},{"source":"osv","ecosystem":"Debian:12","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.15-1~deb12u1"}]}],"versions":["3.0.10-1","3.0.10-1~deb12u1","3.0.11-1","3.0.11-1~deb12u1","3.0.11-1~deb12u2","3.0.12-1","3.0.12-2","3.0.13-1~deb12u1","3.0.13-1~deb12u2","3.0.14-1~deb12u1","3.0.14-1~deb12u2","3.0.9-1"]},{"source":"osv","ecosystem":"Debian:13","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.2-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.2-1"}]}]},{"source":"osv","ecosystem":"Debian:11","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1n-0+deb11u6"}]}],"versions":["1.1.1k-1","1.1.1k-1+deb11u1","1.1.1k-1+deb11u2","1.1.1l-1","1.1.1m-0+deb11u1","1.1.1m-1","1.1.1n-0+deb11u1","1.1.1n-0+deb11u2","1.1.1n-0+deb11u3","1.1.1n-0+deb11u4","1.1.1n-0+deb11u5"],"bundled":6},{"source":"osv","ecosystem":"Debian:11","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1w-0+deb11u2"}]}],"versions":["1.1.1k-1","1.1.1k-1+deb11u1","1.1.1k-1+deb11u2","1.1.1l-1","1.1.1m-0+deb11u1","1.1.1m-1","1.1.1n-0+deb11u1","1.1.1n-0+deb11u2","1.1.1n-0+deb11u3","1.1.1n-0+deb11u4","1.1.1n-0+deb11u5","1.1.1n-0+deb11u6","1.1.1n-1","1.1.1o-1","1.1.1v-0~deb11u1","1.1.1w-0+deb11u1","1.1.1w-0~deb11u1"],"bundled":6},{"source":"osv","ecosystem":"Julia","package":"OpenSSL_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.0.15+0"}]}]},{"source":"osv","ecosystem":"Julia","package":"Openresty_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.27.1+0"}]}]},{"source":"osv","ecosystem":"Mageia:9","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.14-1.mga9"}]}]},{"source":"osv","ecosystem":"Mageia:9","package":"quictls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.14-1.1.mga9"}]}],"bundled":8},{"source":"osv","ecosystem":"Mageia:9","package":"quictls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.15-1.mga9"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1f-35.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.12-9.oe2403"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1wa-8.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1m-37.oe2203sp1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1wa-8.oe2203sp3"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"202011-19.oe2203sp3"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"202002-23.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"202011-19.oe2203sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"202308-9.oe2403"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"202011-19.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"compat-openssl11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1m-13.oe2403"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::baseos","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-14.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::baseos","package":"openssl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-14.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::baseos","package":"openssl-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-14.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::baseos","package":"openssl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-14.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::baseos","package":"openssl-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-14.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::baseos","package":"openssl-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-14.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::baseos","package":"openssl-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-14.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.6::baseos","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-14.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.6::baseos","package":"openssl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-14.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.6::baseos","package":"openssl-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-14.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.6::baseos","package":"openssl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-14.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.6::baseos","package":"openssl-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-14.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.6::baseos","package":"openssl-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-14.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.6::baseos","package":"openssl-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-14.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.6::baseos","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-14.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.6::baseos","package":"openssl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-14.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.6::baseos","package":"openssl-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-14.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.6::baseos","package":"openssl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-14.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.6::baseos","package":"openssl-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-14.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.6::baseos","package":"openssl-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-14.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.6::baseos","package":"openssl-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-14.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::baseos","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-14.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::baseos","package":"openssl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-14.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::baseos","package":"openssl-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-14.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::baseos","package":"openssl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-14.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::baseos","package":"openssl-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-14.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::baseos","package":"openssl-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-14.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::baseos","package":"openssl-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-14.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-14.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"openssl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-14.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"openssl-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-14.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"openssl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-14.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"openssl-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-14.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"openssl-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-14.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"openssl-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-14.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"openssl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.2.2-6.el9_5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"openssl-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.2.2-6.el9_5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"openssl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.2.2-6.el9_5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"openssl-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.2.2-6.el9_5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"openssl-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.2.2-6.el9_5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.2.2-6.el9_5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"openssl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.2.2-6.el9_5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"openssl-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.2.2-6.el9_5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"openssl-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.2.2-6.el9_5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"openssl-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.2.2-6.el9_5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"mysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.41-2.el9_5"}]}],"bundled":49},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"mysql-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.41-2.el9_5"}]}],"bundled":49},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"mysql-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.41-2.el9_5"}]}],"bundled":49},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"mysql-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.41-2.el9_5"}]}],"bundled":49},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"mysql-devel-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.41-2.el9_5"}]}],"bundled":49},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"mysql-errmsg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.41-2.el9_5"}]}],"bundled":49},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"mysql-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.41-2.el9_5"}]}],"bundled":49},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"mysql-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.41-2.el9_5"}]}],"bundled":49},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"mysql-server-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.41-2.el9_5"}]}],"bundled":49},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"mysql-test-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.41-2.el9_5"}]}],"bundled":49},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"mysql-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.41-2.el9_5"}]}],"bundled":49},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"mysql-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.41-2.el9_5"}]}],"bundled":49},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"mysql-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.41-2.el9_5"}]}],"bundled":49},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"mysql-devel-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.41-2.el9_5"}]}],"bundled":49},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"mysql-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.41-2.el9_5"}]}],"bundled":49},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"mysql-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.41-2.el9_5"}]}],"bundled":49},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"mysql-server-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.41-2.el9_5"}]}],"bundled":49},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"mysql-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.41-2.el9_5"}]}],"bundled":49},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"mysql-test-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.41-2.el9_5"}]}],"bundled":49},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"mecab","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.996-2.module+el8.10.0+22857+7f331edd"}]}],"bundled":49},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"mecab-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.996-2.module+el8.10.0+22857+7f331edd"}]}],"bundled":49},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"mecab-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.996-2.module+el8.10.0+22857+7f331edd"}]}],"bundled":49},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"mecab-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.996-2.module+el8.10.0+22857+7f331edd"}]}],"bundled":49},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"mecab-ipadic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.0.20070801-17.module+el8.10.0+22857+7f331edd"}]}],"bundled":49},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"mecab-ipadic-EUCJP","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.0.20070801-17.module+el8.10.0+22857+7f331edd"}]}],"bundled":49},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"mysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.41-1.module+el8.10.0+22857+7f331edd"}]}],"bundled":49},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"mysql-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.41-1.module+el8.10.0+22857+7f331edd"}]}],"bundled":49},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"mysql-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.41-1.module+el8.10.0+22857+7f331edd"}]}],"bundled":49},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"mysql-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.41-1.module+el8.10.0+22857+7f331edd"}]}],"bundled":49},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"mysql-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.41-1.module+el8.10.0+22857+7f331edd"}]}],"bundled":49},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"mysql-devel-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.41-1.module+el8.10.0+22857+7f331edd"}]}],"bundled":49},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"mysql-errmsg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.41-1.module+el8.10.0+22857+7f331edd"}]}],"bundled":49},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"mysql-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.41-1.module+el8.10.0+22857+7f331edd"}]}],"bundled":49},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"mysql-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.41-1.module+el8.10.0+22857+7f331edd"}]}],"bundled":49},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"mysql-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.41-1.module+el8.10.0+22857+7f331edd"}]}],"bundled":49},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"mysql-server-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.41-1.module+el8.10.0+22857+7f331edd"}]}],"bundled":49},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"mysql-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.41-1.module+el8.10.0+22857+7f331edd"}]}],"bundled":49},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"mysql-test-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.41-1.module+el8.10.0+22857+7f331edd"}]}],"bundled":49},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-19.el7jbcs"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-openssl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-19.el7jbcs"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-openssl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-19.el7jbcs"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-openssl-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-19.el7jbcs"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-openssl-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-19.el7jbcs"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-openssl-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-19.el7jbcs"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-httpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.62-5.el7jbcs"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-httpd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.62-5.el7jbcs"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-httpd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.62-5.el7jbcs"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-httpd-manual","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.62-5.el7jbcs"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-httpd-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.62-5.el7jbcs"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-httpd-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.62-5.el7jbcs"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-mod_ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.62-5.el7jbcs"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-mod_proxy_html","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.62-5.el7jbcs"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-mod_session","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.62-5.el7jbcs"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-mod_ssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.62-5.el7jbcs"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-httpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.62-5.el8jbcs"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-httpd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.62-5.el8jbcs"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-httpd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.62-5.el8jbcs"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-httpd-manual","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.62-5.el8jbcs"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-httpd-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.62-5.el8jbcs"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-httpd-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.62-5.el8jbcs"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-httpd-tools-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.62-5.el8jbcs"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-mod_ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.62-5.el8jbcs"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-mod_ldap-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.62-5.el8jbcs"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-mod_proxy_html","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.62-5.el8jbcs"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-mod_proxy_html-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.62-5.el8jbcs"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-mod_session","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.62-5.el8jbcs"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-mod_session-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.62-5.el8jbcs"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-mod_ssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.62-5.el8jbcs"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-mod_ssl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.62-5.el8jbcs"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-mod_http2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.29-3.el7jbcs"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el7","package":"jbcs-httpd24-mod_http2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.29-3.el7jbcs"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-mod_http2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.29-3.el8jbcs"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_core_services:1::el8","package":"jbcs-httpd24-mod_http2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.29-3.el8jbcs"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"openssl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.0.7-29.el9_4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"openssl-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.0.7-29.el9_4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"openssl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.0.7-29.el9_4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"openssl-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.0.7-29.el9_4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"openssl-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.0.7-29.el9_4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::baseos","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.0.7-29.el9_4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::baseos","package":"openssl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.0.7-29.el9_4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::baseos","package":"openssl-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.0.7-29.el9_4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::baseos","package":"openssl-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.0.7-29.el9_4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::baseos","package":"openssl-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.0.7-29.el9_4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_els:7","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.0.2k-26.el7_9.2"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_els:7","package":"openssl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.0.2k-26.el7_9.2"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_els:7","package":"openssl-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.0.2k-26.el7_9.2"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_els:7","package":"openssl-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.0.2k-26.el7_9.2"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_els:7","package":"openssl-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.0.2k-26.el7_9.2"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"mingw-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.2k-4.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"mingw32-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.2k-4.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"mingw32-openssl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.2k-4.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"mingw64-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.2k-4.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"mingw64-openssl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.2k-4.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_els:6","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.1e-61.el6_10.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_els:6","package":"openssl-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.1e-61.el6_10.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-14.el8_10"}]}]},{"source":"osv","ecosystem":"Rocky Linux:9","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.2.2-6.el9_5.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Rocky Linux:9","package":"openssl-fips-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.7-6.el9_5"}]}],"bundled":4},{"source":"osv","ecosystem":"Rocky Linux:9","package":"mysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.41-2.el9_5"}]}],"bundled":49},{"source":"osv","ecosystem":"Rocky Linux:8","package":"mecab","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.996-2.module+el8.10.0+1676+9b4b6e24"}]}],"bundled":49},{"source":"osv","ecosystem":"Rocky Linux:8","package":"mecab-ipadic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.0.20070801-17.module+el8.10.0+1937+28fbbc83"}]}],"bundled":49},{"source":"osv","ecosystem":"Rocky Linux:8","package":"mysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0.41-1.module+el8.10.0+1937+28fbbc83.0.1"}]}],"bundled":49},{"source":"osv","ecosystem":"Rocky Linux:8","package":"mingw-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.2k-4.el8_10"}]}]},{"source":"osv","ecosystem":"Root:Alpine:3.15","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1w-r10073"},{"fixed":"1.1.1w-r10076"},{"fixed":"1.1.1w-r10074"},{"fixed":"1.1.1w-r10075"}]}]},{"source":"osv","ecosystem":"Root:Alpine:3.15","package":"rootio-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1w-r10073"},{"fixed":"1.1.1w-r10076"},{"fixed":"1.1.1w-r10074"},{"fixed":"1.1.1w-r10075"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.4-150600.5.10.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.4-150600.5.10.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Live Patching 15 SP6","package":"openssl-3-livepatches","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1-150600.13.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"openssl-1_1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1l-150500.17.34.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"openssl-1_1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1l-150500.17.34.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap Micro 5.5","package":"openssl-1_1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1l-150500.17.34.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"openssl-1_1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1l-150500.17.34.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"openssl-1_1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1d-150200.11.94.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"openssl-1_1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1d-150200.11.94.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"openssl-1_1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1d-150200.11.94.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"openssl-1_1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1d-150200.11.94.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"openssl-1_1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1d-150200.11.94.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"openssl-1_1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1d-150200.11.94.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.1","package":"openssl-1_1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1d-150200.11.94.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"openssl-1_1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1d-150200.11.94.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"openssl-1_1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1d-150200.11.94.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"openssl-1_1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1l-150400.7.72.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"openssl-1_1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1l-150400.7.72.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"openssl-1_1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1l-150400.7.72.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"openssl-1_1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1l-150400.7.72.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"openssl-1_1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1l-150400.7.72.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"openssl-1_1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1l-150400.7.72.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.3","package":"openssl-1_1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1l-150400.7.72.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 4.3","package":"openssl-1_1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1l-150400.7.72.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.8-150400.4.60.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.8-150400.4.60.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.8-150400.4.60.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.8-150400.4.60.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.8-150400.4.60.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.8-150400.4.60.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.3","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.8-150400.4.60.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 4.3","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.8-150400.4.60.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"openssl-1_1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1w-150600.5.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP6","package":"openssl-1_1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1w-150600.5.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Legacy 15 SP6","package":"openssl-1_1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1w-150600.5.6.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"openssl-1_1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1w-150600.5.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"openssl-1_1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1d-2.110.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"openssl-1_1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1d-2.110.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"openssl-1_1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1d-2.110.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"openssl-1_0_0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2p-3.95.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"openssl-1_0_0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2p-3.95.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"openssl-1_0_0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2p-3.95.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4 LTSS EXTREME CORE","package":"openssl1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.1g-0.58.82.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.8-150500.5.39.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.8-150500.5.39.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Legacy 15 SP5","package":"openssl-1_0_0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2p-150000.3.94.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Legacy 15 SP6","package":"openssl-1_0_0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2p-150000.3.94.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"openssl-1_0_0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2p-150000.3.94.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"openssl-1_0_0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2p-150000.3.94.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"openssl-1_0_0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2p-150000.3.94.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"openssl-1_0_0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2p-150000.3.94.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"openssl-1_0_0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2p-150000.3.94.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"openssl-1_0_0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2p-150000.3.94.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"openssl-1_0_0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2p-150000.3.94.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"openssl-1_0_0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2p-150000.3.94.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"openssl-1_0_0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2p-150000.3.94.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"openssl-1_0_0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2p-150000.3.94.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"openssl-1_0_0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2p-150000.3.94.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"openssl-1_0_0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2p-150000.3.94.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"jitterentropy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.1-3.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"libpulp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.5-1.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.4-6.1"}]}],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.1f-1ubuntu2.27+esm16"}]}],"versions":["1.0.1e-3ubuntu1","1.0.1e-4ubuntu1","1.0.1e-4ubuntu2","1.0.1e-4ubuntu3","1.0.1e-4ubuntu4","1.0.1f-1ubuntu1","1.0.1f-1ubuntu2","1.0.1f-1ubuntu2.1","1.0.1f-1ubuntu2.2","1.0.1f-1ubuntu2.3","1.0.1f-1ubuntu2.4","1.0.1f-1ubuntu2.5","1.0.1f-1ubuntu2.7","1.0.1f-1ubuntu2.8","1.0.1f-1ubuntu2.11","1.0.1f-1ubuntu2.12","1.0.1f-1ubuntu2.15","1.0.1f-1ubuntu2.16","1.0.1f-1ubuntu2.17","1.0.1f-1ubuntu2.18","1.0.1f-1ubuntu2.19","1.0.1f-1ubuntu2.20","1.0.1f-1ubuntu2.21","1.0.1f-1ubuntu2.22","1.0.1f-1ubuntu2.23","1.0.1f-1ubuntu2.24","1.0.1f-1ubuntu2.25","1.0.1f-1ubuntu2.26","1.0.1f-1ubuntu2.27","1.0.1f-1ubuntu2.27+esm1","1.0.1f-1ubuntu2.27+esm2","1.0.1f-1ubuntu2.27+esm3","1.0.1f-1ubuntu2.27+esm4","1.0.1f-1ubuntu2.27+esm5","1.0.1f-1ubuntu2.27+esm6","1.0.1f-1ubuntu2.27+esm7","1.0.1f-1ubuntu2.27+esm9","1.0.1f-1ubuntu2.27+esm10","1.0.1f-1ubuntu2.27+esm11","1.0.1f-1ubuntu2.27+esm12","1.0.1f-1ubuntu2.27+esm13","1.0.1f-1ubuntu2.27+esm14"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2g-1ubuntu4.20+esm18"}]}],"versions":["1.0.2d-0ubuntu1","1.0.2d-0ubuntu2","1.0.2e-1ubuntu1","1.0.2f-2ubuntu1","1.0.2g-1ubuntu2","1.0.2g-1ubuntu3","1.0.2g-1ubuntu4","1.0.2g-1ubuntu4.1","1.0.2g-1ubuntu4.2","1.0.2g-1ubuntu4.4","1.0.2g-1ubuntu4.5","1.0.2g-1ubuntu4.6","1.0.2g-1ubuntu4.8","1.0.2g-1ubuntu4.9","1.0.2g-1ubuntu4.10","1.0.2g-1ubuntu4.11","1.0.2g-1ubuntu4.12","1.0.2g-1ubuntu4.13","1.0.2g-1ubuntu4.14","1.0.2g-1ubuntu4.15","1.0.2g-1ubuntu4.16","1.0.2g-1ubuntu4.17","1.0.2g-1ubuntu4.18","1.0.2g-1ubuntu4.19","1.0.2g-1ubuntu4.20","1.0.2g-1ubuntu4.20+esm1","1.0.2g-1ubuntu4.20+esm2","1.0.2g-1ubuntu4.20+esm3","1.0.2g-1ubuntu4.20+esm4","1.0.2g-1ubuntu4.20+esm5","1.0.2g-1ubuntu4.20+esm6","1.0.2g-1ubuntu4.20+esm7","1.0.2g-1ubuntu4.20+esm9","1.0.2g-1ubuntu4.20+esm10","1.0.2g-1ubuntu4.20+esm11","1.0.2g-1ubuntu4.20+esm12","1.0.2g-1ubuntu4.20+esm13","1.0.2g-1ubuntu4.20+esm14","1.0.2g-1ubuntu4.20+esm15","1.0.2g-1ubuntu4.20+esm16"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0~20150106.5c2d456b-2","0~20160104.c2a892d7-1","0~20160408.ffea0a2c-2","0~20160408.ffea0a2c-2ubuntu0.1","0~20160408.ffea0a2c-2ubuntu0.2","0~20160408.ffea0a2c-2ubuntu0.2+esm1","0~20160408.ffea0a2c-2ubuntu0.2+esm3","0~20160408.ffea0a2c-2ubuntu0.2+esm4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:16.04:LTS","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.2g-1ubuntu4.fips.4.9.1","1.0.2g-1ubuntu4.fips.4.13.1","1.0.2g-1ubuntu4.fips.4.15.1","1.0.2g-1ubuntu4.fips.4.16.1","1.0.2g-1ubuntu4.fips.4.17.1","1.0.2g-1ubuntu4.fips.4.18.1","1.0.2g-1ubuntu4.fips.4.19.3","1.0.2g-1ubuntu4.fips.4.20.1","1.0.2g-1ubuntu4.fips.4.20.2","1.0.2g-1ubuntu4.fips.4.20.3","1.0.2g-1ubuntu4.fips.4.20.6","1.0.2g-1ubuntu4.fips.4.20.7","1.0.2g-1ubuntu4.fips.4.20.9","1.0.2g-1ubuntu4.fips.4.20.10","1.0.2g-1ubuntu4.fips.4.20.11","1.0.2g-1ubuntu4.fips.4.20.12","1.0.2g-1ubuntu4.fips.4.20.13","1.0.2g-1ubuntu4.fips.4.20.14","1.0.2g-1ubuntu4.fips.4.20.15"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS:16.04:LTS","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.2g-1ubuntu4.fips.4.6~ppa1","1.0.2g-1ubuntu4.fips.4.6~ppa2","1.0.2g-1ubuntu4.fips.4.6~ppa3","1.0.2g-1ubuntu4.fips.4.6","1.0.2g-1ubuntu4.fips.4.6.1","1.0.2g-1ubuntu4.fips.4.6.2","1.0.2g-1ubuntu4.fips.4.6.3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1-1ubuntu2.1~18.04.23+esm10"}]}],"versions":["1.0.2g-1ubuntu13","1.0.2g-1ubuntu14","1.0.2n-1ubuntu1","1.1.0g-2ubuntu1","1.1.0g-2ubuntu2","1.1.0g-2ubuntu3","1.1.0g-2ubuntu4","1.1.0g-2ubuntu4.1","1.1.0g-2ubuntu4.3","1.1.1-1ubuntu2.1~18.04.1","1.1.1-1ubuntu2.1~18.04.2","1.1.1-1ubuntu2.1~18.04.3","1.1.1-1ubuntu2.1~18.04.4","1.1.1-1ubuntu2.1~18.04.5","1.1.1-1ubuntu2.1~18.04.6","1.1.1-1ubuntu2.1~18.04.7","1.1.1-1ubuntu2.1~18.04.8","1.1.1-1ubuntu2.1~18.04.9","1.1.1-1ubuntu2.1~18.04.10","1.1.1-1ubuntu2.1~18.04.13","1.1.1-1ubuntu2.1~18.04.14","1.1.1-1ubuntu2.1~18.04.15","1.1.1-1ubuntu2.1~18.04.17","1.1.1-1ubuntu2.1~18.04.19","1.1.1-1ubuntu2.1~18.04.20","1.1.1-1ubuntu2.1~18.04.21","1.1.1-1ubuntu2.1~18.04.22","1.1.1-1ubuntu2.1~18.04.23","1.1.1-1ubuntu2.1~18.04.23+esm1","1.1.1-1ubuntu2.1~18.04.23+esm3","1.1.1-1ubuntu2.1~18.04.23+esm4","1.1.1-1ubuntu2.1~18.04.23+esm5","1.1.1-1ubuntu2.1~18.04.23+esm6","1.1.1-1ubuntu2.1~18.04.23+esm7","1.1.1-1ubuntu2.1~18.04.23+esm8","1.1.1-1ubuntu2.1~18.04.23+esm9"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"openssl1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2n-1ubuntu5.13+esm6"}]}],"versions":["1.0.2n-1ubuntu2","1.0.2n-1ubuntu3","1.0.2n-1ubuntu4","1.0.2n-1ubuntu5","1.0.2n-1ubuntu5.1","1.0.2n-1ubuntu5.2","1.0.2n-1ubuntu5.3","1.0.2n-1ubuntu5.4","1.0.2n-1ubuntu5.5","1.0.2n-1ubuntu5.6","1.0.2n-1ubuntu5.7","1.0.2n-1ubuntu5.8","1.0.2n-1ubuntu5.9","1.0.2n-1ubuntu5.10","1.0.2n-1ubuntu5.11","1.0.2n-1ubuntu5.12","1.0.2n-1ubuntu5.13","1.0.2n-1ubuntu5.13+esm1","1.0.2n-1ubuntu5.13+esm2","1.0.2n-1ubuntu5.13+esm3","1.0.2n-1ubuntu5.13+esm4","1.0.2n-1ubuntu5.13+esm5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0~20170911.5dfba97c-1","0~20171010.234dbcef-1","0~20171027.76fd5a66-1","0~20171205.a9212288-1","0~20180105.0bc94c74-1","0~20180205.c0d9813c-1","0~20180205.c0d9813c-2","0~20180205.c0d9813c-2ubuntu0.1","0~20180205.c0d9813c-2ubuntu0.2","0~20180205.c0d9813c-2ubuntu0.3","0~20180205.c0d9813c-2ubuntu0.3+esm1","0~20180205.c0d9813c-2ubuntu0.3+esm2","0~20180205.c0d9813c-2ubuntu0.3+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:18.04:LTS","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.1-1ubuntu2.fips.2.1~18.04.5.1","1.1.1-1ubuntu2.fips.2.1~18.04.6.1","1.1.1-1ubuntu2.fips.2.1~18.04.7.1","1.1.1-1ubuntu2.fips.2.1~18.04.9.1","1.1.1-1ubuntu2.fips.2.1~18.04.9.2","1.1.1-1ubuntu2.fips.2.1~18.04.9.3","1.1.1-1ubuntu2.fips.2.1~18.04.13.2","1.1.1-1ubuntu2.fips.2.1~18.04.15","1.1.1-1ubuntu2.fips.2.1~18.04.15.1","1.1.1-1ubuntu2.fips.2.1~18.04.15.2","1.1.1-1ubuntu2.fips.2.1~18.04.17","1.1.1-1ubuntu2.fips.2.1~18.04.20","1.1.1-1ubuntu2.fips.2.1~18.04.21","1.1.1-1ubuntu2.fips.2.1~18.04.22","1.1.1-1ubuntu2.fips.2.1~18.04.23","1.1.1-1ubuntu2.fips.2.1~18.04.23.3","1.1.1-1ubuntu2.fips.2.1~18.04.23.4","1.1.1-1ubuntu2.fips.2.1~18.04.23.5","1.1.1-1ubuntu2.fips.2.1~18.04.23.6","1.1.1-1ubuntu2.fips.2.1~18.04.23.7","1.1.1-1ubuntu2.fips.2.1~18.04.23.8","1.1.1-1ubuntu2.fips.2.1~18.04.23.9"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS:18.04:LTS","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.1-1ubuntu2.fips.2.1~18.04.3.1","1.1.1-1ubuntu2.fips.2.1~18.04.15.2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1f-1ubuntu2.23"}]}],"versions":["1.1.1c-1ubuntu4","1.1.1d-2ubuntu3","1.1.1d-2ubuntu6","1.1.1f-1ubuntu1","1.1.1f-1ubuntu2","1.1.1f-1ubuntu2.1","1.1.1f-1ubuntu2.2","1.1.1f-1ubuntu2.3","1.1.1f-1ubuntu2.4","1.1.1f-1ubuntu2.5","1.1.1f-1ubuntu2.8","1.1.1f-1ubuntu2.9","1.1.1f-1ubuntu2.10","1.1.1f-1ubuntu2.11","1.1.1f-1ubuntu2.12","1.1.1f-1ubuntu2.13","1.1.1f-1ubuntu2.15","1.1.1f-1ubuntu2.16","1.1.1f-1ubuntu2.17","1.1.1f-1ubuntu2.18","1.1.1f-1ubuntu2.19","1.1.1f-1ubuntu2.20","1.1.1f-1ubuntu2.21","1.1.1f-1ubuntu2.22"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0~20190606.20d2e5a1-2ubuntu1","0~20190828.37eef910-3","0~20190828.37eef910-4","0~20191122.bd85bf54-1","0~20191122.bd85bf54-1ubuntu1","0~20191122.bd85bf54-2","0~20191122.bd85bf54-2ubuntu1","0~20191122.bd85bf54-2ubuntu2","0~20191122.bd85bf54-2ubuntu3","0~20191122.bd85bf54-2ubuntu3.1","0~20191122.bd85bf54-2ubuntu3.2","0~20191122.bd85bf54-2ubuntu3.3","0~20191122.bd85bf54-2ubuntu3.4","0~20191122.bd85bf54-2ubuntu3.5","0~20191122.bd85bf54-2ubuntu3.6","0~20191122.bd85bf54-2ubuntu3.6+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS:20.04:LTS","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.1f-1ubuntu2.fips.2.8","1.1.1f-1ubuntu2.fips.7.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2022.02-3ubuntu0.22.04.4"}]}],"versions":["2021.08~rc0-2","2021.08-3","2021.11~rc1-1","2021.11-1","2021.11-2","2022.02~rc1-1","2022.02~rc1-1ubuntu1","2022.02-1","2022.02-2","2022.02-3","2022.02-3ubuntu0.22.04.1","2022.02-3ubuntu0.22.04.2","2022.02-3ubuntu0.22.04.3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.2-0ubuntu1.17"}]}],"versions":["1.1.1l-1ubuntu1","3.0.0-1ubuntu1","3.0.1-0ubuntu1","3.0.2-0ubuntu1","3.0.2-0ubuntu1.1","3.0.2-0ubuntu1.2","3.0.2-0ubuntu1.4","3.0.2-0ubuntu1.5","3.0.2-0ubuntu1.6","3.0.2-0ubuntu1.7","3.0.2-0ubuntu1.8","3.0.2-0ubuntu1.9","3.0.2-0ubuntu1.10","3.0.2-0ubuntu1.12","3.0.2-0ubuntu1.13","3.0.2-0ubuntu1.14","3.0.2-0ubuntu1.15","3.0.2-0ubuntu1.16"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["12.22.5~dfsg-5ubuntu1","12.22.7~dfsg-2ubuntu1","12.22.7~dfsg-2ubuntu3","12.22.9~dfsg-1ubuntu2","12.22.9~dfsg-1ubuntu3","12.22.9~dfsg-1ubuntu3.1","12.22.9~dfsg-1ubuntu3.2","12.22.9~dfsg-1ubuntu3.3","12.22.9~dfsg-1ubuntu3.4","12.22.9~dfsg-1ubuntu3.5","12.22.9~dfsg-1ubuntu3.6","12.22.9~dfsg-1ubuntu3.6+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-preview:22.04:LTS","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0.2-0ubuntu1.10+Fips1","3.0.2-0ubuntu1.12+Fips1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-preview:22.04:LTS","package":"openssl-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0.5-0ubuntu0.1+Fips2.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:22.04:LTS","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.2-0ubuntu1.17+Fips1"}]}],"versions":["3.0.2-0ubuntu1.10+Fips1","3.0.2-0ubuntu1.12+Fips1","3.0.2-0ubuntu1.14+Fips1","3.0.2-0ubuntu1.15+Fips1","3.0.2-0ubuntu1.16+Fips1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:22.04:LTS","package":"openssl-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0.5-0ubuntu0.1+Fips2.1","3.0.5-0ubuntu0.2+Fips1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2024.02-2ubuntu0.6"}]}],"versions":["2023.05-2","2023.11-2","2023.11-3","2023.11-4","2023.11-5","2023.11-6","2023.11-8","2024.02-1","2024.02-2","2024.02-2ubuntu0.1","2024.02-2ubuntu0.3","2024.02-2ubuntu0.4","2024.02-2ubuntu0.5"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.13-0ubuntu3.2"}]}],"versions":["3.0.10-1ubuntu2","3.0.10-1ubuntu2.1","3.0.10-1ubuntu3","3.0.10-1ubuntu4","3.0.13-0ubuntu2","3.0.13-0ubuntu3","3.0.13-0ubuntu3.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:24.04:LTS","package":"openssl-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.13-0ubuntu3.6+Fips1"}]}],"versions":["3.0.13-0ubuntu3+Fips1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1f-1ubuntu2.23"}]}],"versions":["1.1.1c-1ubuntu4","1.1.1d-2ubuntu3","1.1.1d-2ubuntu6","1.1.1f-1ubuntu1","1.1.1f-1ubuntu2","1.1.1f-1ubuntu2.1","1.1.1f-1ubuntu2.2","1.1.1f-1ubuntu2.3","1.1.1f-1ubuntu2.4","1.1.1f-1ubuntu2.5","1.1.1f-1ubuntu2.8","1.1.1f-1ubuntu2.9","1.1.1f-1ubuntu2.10","1.1.1f-1ubuntu2.11","1.1.1f-1ubuntu2.12","1.1.1f-1ubuntu2.13","1.1.1f-1ubuntu2.15","1.1.1f-1ubuntu2.16","1.1.1f-1ubuntu2.17","1.1.1f-1ubuntu2.18","1.1.1f-1ubuntu2.19","1.1.1f-1ubuntu2.20","1.1.1f-1ubuntu2.21","1.1.1f-1ubuntu2.22"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.2-0ubuntu1.17"}]}],"versions":["1.1.1l-1ubuntu1","3.0.0-1ubuntu1","3.0.1-0ubuntu1","3.0.2-0ubuntu1","3.0.2-0ubuntu1.1","3.0.2-0ubuntu1.2","3.0.2-0ubuntu1.4","3.0.2-0ubuntu1.5","3.0.2-0ubuntu1.6","3.0.2-0ubuntu1.7","3.0.2-0ubuntu1.8","3.0.2-0ubuntu1.9","3.0.2-0ubuntu1.10","3.0.2-0ubuntu1.12","3.0.2-0ubuntu1.13","3.0.2-0ubuntu1.14","3.0.2-0ubuntu1.15","3.0.2-0ubuntu1.16"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.13-0ubuntu3.2"}]}],"versions":["3.0.10-1ubuntu2","3.0.10-1ubuntu2.1","3.0.10-1ubuntu3","3.0.10-1ubuntu4","3.0.13-0ubuntu2","3.0.13-0ubuntu3","3.0.13-0ubuntu3.1"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2022.02-3ubuntu0.22.04.4"}]}],"versions":["2021.08~rc0-2","2021.08-3","2021.11~rc1-1","2021.11-1","2021.11-2","2022.02~rc1-1","2022.02~rc1-1ubuntu1","2022.02-1","2022.02-2","2022.02-3","2022.02-3ubuntu0.22.04.1","2022.02-3ubuntu0.22.04.2","2022.02-3ubuntu0.22.04.3"],"bundled":30},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2024.02-2ubuntu0.6"}]}],"versions":["2023.05-2","2023.11-2","2023.11-3","2023.11-4","2023.11-5","2023.11-6","2023.11-8","2024.02-1","2024.02-2","2024.02-2ubuntu0.1","2024.02-2ubuntu0.3","2024.02-2ubuntu0.4","2024.02-2ubuntu0.5"],"bundled":30},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.1f-1ubuntu2.27+esm16"}]}],"versions":["1.0.1e-3ubuntu1","1.0.1e-4ubuntu1","1.0.1e-4ubuntu2","1.0.1e-4ubuntu3","1.0.1e-4ubuntu4","1.0.1f-1ubuntu1","1.0.1f-1ubuntu2","1.0.1f-1ubuntu2.1","1.0.1f-1ubuntu2.2","1.0.1f-1ubuntu2.3","1.0.1f-1ubuntu2.4","1.0.1f-1ubuntu2.5","1.0.1f-1ubuntu2.7","1.0.1f-1ubuntu2.8","1.0.1f-1ubuntu2.11","1.0.1f-1ubuntu2.12","1.0.1f-1ubuntu2.15","1.0.1f-1ubuntu2.16","1.0.1f-1ubuntu2.17","1.0.1f-1ubuntu2.18","1.0.1f-1ubuntu2.19","1.0.1f-1ubuntu2.20","1.0.1f-1ubuntu2.21","1.0.1f-1ubuntu2.22","1.0.1f-1ubuntu2.23","1.0.1f-1ubuntu2.24","1.0.1f-1ubuntu2.25","1.0.1f-1ubuntu2.26","1.0.1f-1ubuntu2.27","1.0.1f-1ubuntu2.27+esm1","1.0.1f-1ubuntu2.27+esm2","1.0.1f-1ubuntu2.27+esm3","1.0.1f-1ubuntu2.27+esm4","1.0.1f-1ubuntu2.27+esm5","1.0.1f-1ubuntu2.27+esm6","1.0.1f-1ubuntu2.27+esm7","1.0.1f-1ubuntu2.27+esm9","1.0.1f-1ubuntu2.27+esm10","1.0.1f-1ubuntu2.27+esm11","1.0.1f-1ubuntu2.27+esm12","1.0.1f-1ubuntu2.27+esm13","1.0.1f-1ubuntu2.27+esm14"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2g-1ubuntu4.20+esm18"}]}],"versions":["1.0.2d-0ubuntu1","1.0.2d-0ubuntu2","1.0.2e-1ubuntu1","1.0.2f-2ubuntu1","1.0.2g-1ubuntu2","1.0.2g-1ubuntu3","1.0.2g-1ubuntu4","1.0.2g-1ubuntu4.1","1.0.2g-1ubuntu4.2","1.0.2g-1ubuntu4.4","1.0.2g-1ubuntu4.5","1.0.2g-1ubuntu4.6","1.0.2g-1ubuntu4.8","1.0.2g-1ubuntu4.9","1.0.2g-1ubuntu4.10","1.0.2g-1ubuntu4.11","1.0.2g-1ubuntu4.12","1.0.2g-1ubuntu4.13","1.0.2g-1ubuntu4.14","1.0.2g-1ubuntu4.15","1.0.2g-1ubuntu4.16","1.0.2g-1ubuntu4.17","1.0.2g-1ubuntu4.18","1.0.2g-1ubuntu4.19","1.0.2g-1ubuntu4.20","1.0.2g-1ubuntu4.20+esm1","1.0.2g-1ubuntu4.20+esm2","1.0.2g-1ubuntu4.20+esm3","1.0.2g-1ubuntu4.20+esm4","1.0.2g-1ubuntu4.20+esm5","1.0.2g-1ubuntu4.20+esm6","1.0.2g-1ubuntu4.20+esm7","1.0.2g-1ubuntu4.20+esm9","1.0.2g-1ubuntu4.20+esm10","1.0.2g-1ubuntu4.20+esm11","1.0.2g-1ubuntu4.20+esm12","1.0.2g-1ubuntu4.20+esm13","1.0.2g-1ubuntu4.20+esm14","1.0.2g-1ubuntu4.20+esm15","1.0.2g-1ubuntu4.20+esm16"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1-1ubuntu2.1~18.04.23+esm10"}]}],"versions":["1.0.2g-1ubuntu13","1.0.2g-1ubuntu14","1.0.2n-1ubuntu1","1.1.0g-2ubuntu1","1.1.0g-2ubuntu2","1.1.0g-2ubuntu3","1.1.0g-2ubuntu4","1.1.0g-2ubuntu4.1","1.1.0g-2ubuntu4.3","1.1.1-1ubuntu2.1~18.04.1","1.1.1-1ubuntu2.1~18.04.2","1.1.1-1ubuntu2.1~18.04.3","1.1.1-1ubuntu2.1~18.04.4","1.1.1-1ubuntu2.1~18.04.5","1.1.1-1ubuntu2.1~18.04.6","1.1.1-1ubuntu2.1~18.04.7","1.1.1-1ubuntu2.1~18.04.8","1.1.1-1ubuntu2.1~18.04.9","1.1.1-1ubuntu2.1~18.04.10","1.1.1-1ubuntu2.1~18.04.13","1.1.1-1ubuntu2.1~18.04.14","1.1.1-1ubuntu2.1~18.04.15","1.1.1-1ubuntu2.1~18.04.17","1.1.1-1ubuntu2.1~18.04.19","1.1.1-1ubuntu2.1~18.04.20","1.1.1-1ubuntu2.1~18.04.21","1.1.1-1ubuntu2.1~18.04.22","1.1.1-1ubuntu2.1~18.04.23","1.1.1-1ubuntu2.1~18.04.23+esm1","1.1.1-1ubuntu2.1~18.04.23+esm3","1.1.1-1ubuntu2.1~18.04.23+esm4","1.1.1-1ubuntu2.1~18.04.23+esm5","1.1.1-1ubuntu2.1~18.04.23+esm6","1.1.1-1ubuntu2.1~18.04.23+esm7","1.1.1-1ubuntu2.1~18.04.23+esm8","1.1.1-1ubuntu2.1~18.04.23+esm9"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"openssl1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2n-1ubuntu5.13+esm6"}]}],"versions":["1.0.2n-1ubuntu2","1.0.2n-1ubuntu3","1.0.2n-1ubuntu4","1.0.2n-1ubuntu5","1.0.2n-1ubuntu5.1","1.0.2n-1ubuntu5.2","1.0.2n-1ubuntu5.3","1.0.2n-1ubuntu5.4","1.0.2n-1ubuntu5.5","1.0.2n-1ubuntu5.6","1.0.2n-1ubuntu5.7","1.0.2n-1ubuntu5.8","1.0.2n-1ubuntu5.9","1.0.2n-1ubuntu5.10","1.0.2n-1ubuntu5.11","1.0.2n-1ubuntu5.12","1.0.2n-1ubuntu5.13","1.0.2n-1ubuntu5.13+esm1","1.0.2n-1ubuntu5.13+esm2","1.0.2n-1ubuntu5.13+esm3","1.0.2n-1ubuntu5.13+esm4","1.0.2n-1ubuntu5.13+esm5"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1f-1ubuntu2.24+esm5"}]}],"versions":["1.1.1c-1ubuntu4","1.1.1d-2ubuntu3","1.1.1d-2ubuntu6","1.1.1f-1ubuntu1","1.1.1f-1ubuntu2","1.1.1f-1ubuntu2.1","1.1.1f-1ubuntu2.2","1.1.1f-1ubuntu2.3","1.1.1f-1ubuntu2.4","1.1.1f-1ubuntu2.5","1.1.1f-1ubuntu2.8","1.1.1f-1ubuntu2.9","1.1.1f-1ubuntu2.10","1.1.1f-1ubuntu2.11","1.1.1f-1ubuntu2.12","1.1.1f-1ubuntu2.13","1.1.1f-1ubuntu2.15","1.1.1f-1ubuntu2.16","1.1.1f-1ubuntu2.17","1.1.1f-1ubuntu2.18","1.1.1f-1ubuntu2.19","1.1.1f-1ubuntu2.20","1.1.1f-1ubuntu2.21","1.1.1f-1ubuntu2.22","1.1.1f-1ubuntu2.23","1.1.1f-1ubuntu2.24","1.1.1f-1ubuntu2.24+esm1","1.1.1f-1ubuntu2.24+esm2","1.1.1f-1ubuntu2.24+esm3","1.1.1f-1ubuntu2.24+esm4"],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"openssl-1_1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1w-11.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.4-11.1"}]}],"bundled":2}],"products":[{"vendor":"openssl","product":"openssl"},{"vendor":"siemens","product":"ruggedcom rst2428p"},{"vendor":"siemens","product":"scalance xc-300/xr-300/xc-400/xr-500wg/xr-500 family"},{"vendor":"siemens","product":"scalance xcm-/xrm-/xch-/xrh-300 family"},{"vendor":"siemens","product":"sidis prime"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518-4 pn/dp mfp"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518f-4 pn/dp mfp"},{"vendor":"siemens","product":"simatic s7-1500 tm mfp - gnu/linux subsystem"},{"vendor":"siemens","product":"siplus s7-1500 cpu 1518-4 pn/dp mfp"}],"references":[{"url":"https://www.openssl.org/news/secadv/20240627.txt","tags":["vendor-advisory","x_transferred","advisory","web"]},{"url":"https://github.com/openssl/openssl/commit/e86ac436f0bd54d4517745483e2315650fae7b2c","tags":["patch","x_transferred","fix","web"]},{"url":"https://github.com/openssl/openssl/commit/99fb785a5f85315b95288921a321a935ea29a51e","tags":["patch","x_transferred","fix","web"]},{"url":"https://github.com/openssl/openssl/commit/4ada436a1946cbb24db5ab4ca082b69c1bc10f37","tags":["patch","x_transferred","fix","web"]},{"url":"https://github.com/openssl/openssl/commit/cf6f91f6121f4db167405db2f0de410a456f260c","tags":["patch","x_transferred","fix","web"]},{"url":"https://github.openssl.org/openssl/extended-releases/commit/b78ec0824da857223486660177d3b1f255c65d87","tags":["patch","x_transferred","fix","web"]},{"url":"https://github.openssl.org/openssl/extended-releases/commit/9947251413065a05189a63c9b7a6c1d4e224c21c","tags":["patch","x_transferred","fix","web"]},{"url":"http://www.openwall.com/lists/oss-security/2024/06/27/1","tags":["x_transferred","web"]},{"url":"http://www.openwall.com/lists/oss-security/2024/06/28/4","tags":["x_transferred","web"]},{"url":"https://security.netapp.com/advisory/ntap-20240712-0005/","tags":["x_transferred","advisory","web"]},{"url":"http://www.openwall.com/lists/oss-security/2024/08/15/1","tags":["web"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/11/msg00000.html","tags":["web"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/10/msg00033.html","tags":["web"]},{"url":"https://security.netapp.com/advisory/ntap-20241025-0010/","tags":["advisory","web"]},{"url":"https://security.netapp.com/advisory/ntap-20241025-0006/","tags":["advisory","web"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-398330.html","tags":["web"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-265688.html","tags":["web"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-915275.html","tags":["web"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-769027.html","tags":["web"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-277137.html","tags":["web"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-613116.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-5535","tags":["web","advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20240712-0005","tags":["web"]},{"url":"https://security.netapp.com/advisory/ntap-20241025-0006","tags":["web"]},{"url":"https://security.netapp.com/advisory/ntap-20241025-0010","tags":["web"]},{"url":"https://github.com/advisories/GHSA-4fc7-mvrr-wv2c","tags":["web"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2024-5535","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:7848","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-5535","tags":["report"]},{"url":"https://bugzilla.redhat.com/2294581","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2024-7848.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:9333","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-2511","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-4603","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-4741","tags":["report"]},{"url":"https://bugzilla.redhat.com/2274020","tags":["report"]},{"url":"https://bugzilla.redhat.com/2281029","tags":["report"]},{"url":"https://bugzilla.redhat.com/2283757","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2024-9333.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:1671","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-11053","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-21193","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-21194","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-21196","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-21197","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-21198","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-21199","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-21201","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-21203","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-21212","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-21213","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-21218","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-21219","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-21230","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-21231","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-21236","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-21237","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-21238","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-21239","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-21241","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-21247","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-37371","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-7264","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-21490","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-21491","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-21494","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-21497","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-21500","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-21501","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-21503","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-21504","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-21505","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-21518","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-21519","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-21520","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-21521","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-21522","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-21523","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-21525","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-21529","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-21531","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-21534","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-21536","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-21540","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-21543","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-21546","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-21555","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-21559","tags":["report"]},{"url":"https://bugzilla.redhat.com/2294676","tags":["report"]},{"url":"https://bugzilla.redhat.com/2301888","tags":["report"]},{"url":"https://bugzilla.redhat.com/2318857","tags":["report"]},{"url":"https://bugzilla.redhat.com/2318858","tags":["report"]},{"url":"https://bugzilla.redhat.com/2318870","tags":["report"]},{"url":"https://bugzilla.redhat.com/2318873","tags":["report"]},{"url":"https://bugzilla.redhat.com/2318874","tags":["report"]},{"url":"https://bugzilla.redhat.com/2318876","tags":["report"]},{"url":"https://bugzilla.redhat.com/2318882","tags":["report"]},{"url":"https://bugzilla.redhat.com/2318883","tags":["report"]},{"url":"https://bugzilla.redhat.com/2318884","tags":["report"]},{"url":"https://bugzilla.redhat.com/2318885","tags":["report"]},{"url":"https://bugzilla.redhat.com/2318886","tags":["report"]},{"url":"https://bugzilla.redhat.com/2318897","tags":["report"]},{"url":"https://bugzilla.redhat.com/2318900","tags":["report"]},{"url":"https://bugzilla.redhat.com/2318905","tags":["report"]},{"url":"https://bugzilla.redhat.com/2318914","tags":["report"]},{"url":"https://bugzilla.redhat.com/2318922","tags":["report"]},{"url":"https://bugzilla.redhat.com/2318923","tags":["report"]},{"url":"https://bugzilla.redhat.com/2318925","tags":["report"]},{"url":"https://bugzilla.redhat.com/2318926","tags":["report"]},{"url":"https://bugzilla.redhat.com/2318927","tags":["report"]},{"url":"https://bugzilla.redhat.com/2331191","tags":["report"]},{"url":"https://bugzilla.redhat.com/2339218","tags":["report"]},{"url":"https://bugzilla.redhat.com/2339220","tags":["report"]},{"url":"https://bugzilla.redhat.com/2339221","tags":["report"]},{"url":"https://bugzilla.redhat.com/2339226","tags":["report"]},{"url":"https://bugzilla.redhat.com/2339231","tags":["report"]},{"url":"https://bugzilla.redhat.com/2339236","tags":["report"]},{"url":"https://bugzilla.redhat.com/2339238","tags":["report"]},{"url":"https://bugzilla.redhat.com/2339243","tags":["report"]},{"url":"https://bugzilla.redhat.com/2339247","tags":["report"]},{"url":"https://bugzilla.redhat.com/2339252","tags":["report"]},{"url":"https://bugzilla.redhat.com/2339259","tags":["report"]},{"url":"https://bugzilla.redhat.com/2339266","tags":["report"]},{"url":"https://bugzilla.redhat.com/2339270","tags":["report"]},{"url":"https://bugzilla.redhat.com/2339271","tags":["report"]},{"url":"https://bugzilla.redhat.com/2339275","tags":["report"]},{"url":"https://bugzilla.redhat.com/2339277","tags":["report"]},{"url":"https://bugzilla.redhat.com/2339281","tags":["report"]},{"url":"https://bugzilla.redhat.com/2339284","tags":["report"]},{"url":"https://bugzilla.redhat.com/2339291","tags":["report"]},{"url":"https://bugzilla.redhat.com/2339293","tags":["report"]},{"url":"https://bugzilla.redhat.com/2339295","tags":["report"]},{"url":"https://bugzilla.redhat.com/2339299","tags":["report"]},{"url":"https://bugzilla.redhat.com/2339300","tags":["report"]},{"url":"https://bugzilla.redhat.com/2339304","tags":["report"]},{"url":"https://bugzilla.redhat.com/2339305","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2025-1671.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:1673","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2025-1673.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:60329","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2026-60329.html","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2024-5535","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/advisories/BELL-SA-2024-39","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/centos8.4-els/CLSA-2024-1730801286.html","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/centos8.5-els/CLSA-2024-1730801437.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/centos8stream-els/CLSA-2024-1731344946.html","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/centos8.4-els/CLSA-2025-1740823577.html","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/centos8.5-els/CLSA-2025-1740824456.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/centos8stream-els/CLSA-2025-1741074282.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/rhel7els/CLSA-2026-1780682107.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-3711","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-3996","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-0464","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-69419","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-69421","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28387","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28388","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28389","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28390","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/oraclelinux7els/CLSA-2026-1780682108.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos7els/CLSA-2026-1780683040.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/5xxx/CVE-2024-5535.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-5535","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2024-0247.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=33337","tags":["report"]},{"url":"https://openssl.org/news/secadv/20240627.txt","tags":["web","report"]},{"url":"https://advisories.mageia.org/MGASA-2024-0281.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=33468","tags":["report"]},{"url":"https://openssl-library.org/news/vulnerabilities-3.0/","tags":["web"]},{"url":"https://advisories.mageia.org/MGASA-2024-0330.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=33614","tags":["report"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-1879","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-1914","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1288","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-13176","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:7846","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#low","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2294581","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_7846.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-5535","tags":["advisory","report"]},{"url":"https://www.oracle.com/security-alerts/cpuoct2024.html#AppendixMSQL","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2024:7847","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_7847.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_7848.json","tags":["advisory"]},{"url":"https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/9/html/9.5_release_notes/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2274020","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2281029","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2283757","tags":["report"]},{"url":"https://issues.redhat.com/browse/RHEL-26271","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-32123","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-38514","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-40723","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-58662","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_9333.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-2511","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-2511","tags":["advisory"]},{"url":"https://www.openssl.org/news/vulnerabilities.html","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-4603","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-4603","tags":["advisory"]},{"url":"https://www.openssl.org/news/secadv/20240516.txt","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-4741","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-4741","tags":["advisory"]},{"url":"https://www.openssl.org/news/secadv/20240528.txt","tags":["article"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2294676","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2301888","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2318857","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2318858","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2318870","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2318873","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2318874","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2318876","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2318882","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2318883","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2318884","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2318885","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2318886","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2318897","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2318900","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2318905","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2318914","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2318922","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2318923","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2318925","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2318926","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2318927","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2331191","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2339218","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2339220","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2339221","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2339226","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2339231","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2339236","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2339238","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2339243","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2339247","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2339252","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2339259","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2339266","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2339270","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2339271","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2339275","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2339277","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2339281","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2339284","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2339291","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2339293","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2339295","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2339299","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2339300","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2339304","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2339305","tags":["report"]},{"url":"https://issues.redhat.com/browse/RHEL-40867","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-5470","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_1671.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-7264","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-7264","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-11053","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-11053","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2024-11053.html","tags":["article"]},{"url":"https://www.oracle.com/security-alerts/cpujan2025.html#AppendixMSQL","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-21193","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-21193","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-21194","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-21194","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-21196","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-21196","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-21197","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-21197","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-21198","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-21198","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-21199","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-21199","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-21201","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-21201","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-21203","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-21203","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-21212","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-21212","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-21213","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-21213","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-21218","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-21218","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-21219","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-21219","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-21230","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-21230","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-21231","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-21231","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-21236","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-21236","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-21237","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-21237","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-21238","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-21238","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-21239","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-21239","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-21241","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-21241","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-21247","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-21247","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-37371","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-37371","tags":["advisory"]},{"url":"https://web.mit.edu/kerberos/www/krb5-1.21/","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-21490","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-21490","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-21491","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-21491","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-21494","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-21494","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-21497","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-21497","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-21500","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-21500","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-21501","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-21501","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-21503","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-21503","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-21504","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-21504","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-21505","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-21505","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-21518","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-21518","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-21519","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-21519","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-21520","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-21520","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-21521","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-21521","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-21522","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-21522","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-21523","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-21523","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-21525","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-21525","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-21529","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-21529","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-21531","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-21531","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-21534","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-21534","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-21536","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-21536","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-21540","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-21540","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-21543","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-21543","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-21546","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-21546","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-21555","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-21555","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-21559","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-21559","tags":["advisory"]},{"url":"https://issues.redhat.com/browse/RHEL-40866","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_1673.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:3452","tags":["advisory"]},{"url":"https://docs.redhat.com/en/documentation/red_hat_jboss_core_services/2.4.62/html/red_hat_jboss_core_services_apache_http_server_2.4.62_release_notes/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2273499","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2295006","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_3452.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-24795","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-24795","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-24795","tags":["advisory"]},{"url":"https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2024-24795","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-36387","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-36387","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-36387","tags":["advisory"]},{"url":"https://httpd.apache.org/security/vulnerabilities_24.html","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2025:3666","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_3666.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:58563","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2456314","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2481898","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_58563.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-28390","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-28390","tags":["advisory"]},{"url":"https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc","tags":["article"]},{"url":"https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6","tags":["article"]},{"url":"https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4","tags":["article"]},{"url":"https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788","tags":["article"]},{"url":"https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75","tags":["article"]},{"url":"https://openssl-library.org/news/secadv/20260407.txt","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-45447","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-45447","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45447","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_60329.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:66524","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_66524.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2024:7848","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2024:9333","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2025:1671","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2025:1673","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:60329","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20242635-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1222899","tags":["report"]},{"url":"https://bugzilla.suse.com/1223336","tags":["report"]},{"url":"https://bugzilla.suse.com/1226463","tags":["report"]},{"url":"https://bugzilla.suse.com/1227138","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-5535","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20242761-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1227147","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20242891-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20242909-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20242927-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20242931-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20242933-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1225907","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20242953-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1222548","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-2511","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20242989-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1227227","tags":["report"]},{"url":"https://bugzilla.suse.com/1228291","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20242991-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20243019-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20243119-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202520014-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1220523","tags":["report"]},{"url":"https://bugzilla.suse.com/1220690","tags":["report"]},{"url":"https://bugzilla.suse.com/1220693","tags":["report"]},{"url":"https://bugzilla.suse.com/1220696","tags":["report"]},{"url":"https://bugzilla.suse.com/1221365","tags":["report"]},{"url":"https://bugzilla.suse.com/1221751","tags":["report"]},{"url":"https://bugzilla.suse.com/1221752","tags":["report"]},{"url":"https://bugzilla.suse.com/1221753","tags":["report"]},{"url":"https://bugzilla.suse.com/1221760","tags":["report"]},{"url":"https://bugzilla.suse.com/1221763","tags":["report"]},{"url":"https://bugzilla.suse.com/1221786","tags":["report"]},{"url":"https://bugzilla.suse.com/1221787","tags":["report"]},{"url":"https://bugzilla.suse.com/1221821","tags":["report"]},{"url":"https://bugzilla.suse.com/1221822","tags":["report"]},{"url":"https://bugzilla.suse.com/1221824","tags":["report"]},{"url":"https://bugzilla.suse.com/1221827","tags":["report"]},{"url":"https://bugzilla.suse.com/1223306","tags":["report"]},{"url":"https://bugzilla.suse.com/1223428","tags":["report"]},{"url":"https://bugzilla.suse.com/1224388","tags":["report"]},{"url":"https://bugzilla.suse.com/1225291","tags":["report"]},{"url":"https://bugzilla.suse.com/1225551","tags":["report"]},{"url":"https://bugzilla.suse.com/1229465","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-4603","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-4741","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-6119","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2024-5535","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6937-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-7894-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8678-2","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-2511","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-4603","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-4741","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-3712","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-0778","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-4304","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-4450","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-0215","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-0286","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-0464","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-0465","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-0466","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-2650","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-3446","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-3817","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-5678","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-6237","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-45236","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-45237","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-0727","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-1298","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-6119","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-9143","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-13176","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-38796","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-38797","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-38805","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-2295","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-3770","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-9232","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-54874","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-63072","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2024-5535","title":"SSL_select_next_proto buffer overread","description":"Issue summary: Calling the OpenSSL API function SSL_select_next_proto with an\nempty supported client protocols buffer may cause a crash or memory contents to\nbe sent to the peer.\n\nImpact summary: A buffer overread can have a range of potential consequences\nsuch as unexpected application beahviour or a crash. In particular this issue\ncould result in up to 255 bytes of arbitrary private data from memory being sent\nto the peer leading to a loss of confidentiality. However, only applications\nthat directly call the SSL_select_next_proto function with a 0 length list of\nsupported client protocols are affected by this issue. This would normally never\nbe a valid scenario and is typically not under attacker control but may occur by\naccident in the case of a configuration or programming error in the calling\napplication.\n\nThe OpenSSL API function SSL_select_next_proto is typically used by TLS\napplications that support ALPN (Application Layer Protocol Negotiation) or NPN\n(Next Protocol Negotiation). NPN is older, was never standardised and\nis deprecated in favour of ALPN. We believe that ALPN is significantly more\nwidely deployed than NPN. The SSL_select_next_proto function accepts a list of\nprotocols from the server and a list of protocols from the client and returns\nthe first protocol that appears in the server list that also appears in the\nclient list. In the case of no overlap between the two lists it returns the\nfirst item in the client list. In either case it will signal whether an overlap\nbetween the two lists was found. In the case where SSL_select_next_proto is\ncalled with a zero length client list it fails to notice this condition and\nreturns the memory immediately following the client list pointer (and reports\nthat there was no overlap in the lists).\n\nThis function is typically called from a server side application callback for\nALPN or a client side application callback for NPN. In the case of ALPN the list\nof protocols supplied by the client is guaranteed by libssl to never be zero in\nlength. The list of server protocols comes from the application and should never\nnormally be expected to be of zero length. In this case if the\nSSL_select_next_proto function has been called as expected (with the list\nsupplied by the client passed in the client/client_len parameters), then the\napplication will not be vulnerable to this issue. If the application has\naccidentally been configured with a zero length server list, and has\naccidentally passed that zero length server list in the client/client_len\nparameters, and has additionally failed to correctly handle a \"no overlap\"\nresponse (which would normally result in a handshake failure in ALPN) then it\nwill be vulnerable to this problem.\n\nIn the case of NPN, the protocol permits the client to opportunistically select\na protocol when there is no overlap. OpenSSL returns the first client protocol\nin the no overlap case in support of this. The list of client protocols comes\nfrom the application and should never normally be expected to be of zero length.\nHowever if the SSL_select_next_proto function is accidentally called with a\nclient_len of 0 then an invalid memory pointer will be returned instead. If the\napplication uses this output as the opportunistic protocol then the loss of\nconfidentiality will occur.\n\nThis issue has been assessed as Low severity because applications are most\nlikely to be vulnerable if they are using NPN instead of ALPN - but NPN is not\nwidely used. It also requires an application configuration or programming error.\nFinally, this issue would not typically be under attacker control making active\nexploitation unlikely.\n\nThe FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue.\n\nDue to the low severity of this issue we are not issuing new releases of\nOpenSSL at this time. The fix will be included in the next releases when they\nbecome available.","status":"published","published":"2024-06-27T10:30:53.118Z","modified":"2026-10-15T00:29:32.069Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:34:01.630882Z"}],"euvd":[{"id":"EUVD-2024-46737","description":"Issue summary: Calling the OpenSSL API function SSL_select_next_proto with an\nempty supported client protocols buffer may cause a crash or memory contents to\nbe sent to the peer.\n\nImpact summary: A buffer overread can have a range of potential consequences\nsuch as unexpected application beahviour or a crash. In particular this issue\ncould result in up to 255 bytes of arbitrary private data from memory being sent\nto the peer leading to a loss of confidentiality. However, only applications\nthat directly call the SSL_select_next_proto function with a 0 length list of\nsupported client protocols are affected by this issue. This would normally never\nbe a valid scenario and is typically not under attacker control but may occur by\naccident in the case of a configuration or programming error in the calling\napplication.\n\nThe OpenSSL API function SSL_select_next_proto is typically used by TLS\napplications that support ALPN (Application Layer Protocol Negotiation) or NPN\n(Next Protocol Negotiation). NPN is older, was never standardised and\nis deprecated in favour of ALPN. We believe that ALPN is significantly more\nwidely deployed than NPN. The SSL_select_next_proto function accepts a list of\nprotocols from the server and a list of protocols from the client and returns\nthe first protocol that appears in the server list that also appears in the\nclient list. In the case of no overlap between the two lists it returns the\nfirst item in the client list. In either case it will signal whether an overlap\nbetween the two lists was found. In the case where SSL_select_next_proto is\ncalled with a zero length client list it fails to notice this condition and\nreturns the memory immediately following the client list pointer (and reports\nthat there was no overlap in the lists).\n\nThis function is typically called from a server side application callback for\nALPN or a client side application callback for NPN. In the case of ALPN the list\nof protocols supplied by the client is guaranteed by libssl to never be zero in\nlength. The list of server protocols comes from the application and should never\nnormally be expected to be of zero length. In this case if the\nSSL_select_next_proto function has been called as expected (with the list\nsupplied by the client passed in the client/client_len parameters), then the\napplication will not be vulnerable to this issue. If the application has\naccidentally been configured with a zero length server list, and has\naccidentally passed that zero length server list in the client/client_len\nparameters, and has additionally failed to correctly handle a \"no overlap\"\nresponse (which would normally result in a handshake failure in ALPN) then it\nwill be vulnerable to this problem.\n\nIn the case of NPN, the protocol permits the client to opportunistically select\na protocol when there is no overlap. OpenSSL returns the first client protocol\nin the no overlap case in support of this. The list of client protocols comes\nfrom the application and should never normally be expected to be of zero length.\nHowever if the SSL_select_next_proto function is accidentally called with a\nclient_len of 0 then an invalid memory pointer will be returned instead. If the\napplication uses this output as the opportunistic protocol then the loss of\nconfidentiality will occur.\n\nThis issue has been assessed as Low severity because applications are most\nlikely to be vulnerable if they are using NPN instead of ALPN - but NPN is not\nwidely used. It also requires an application configuration or programming error.\nFinally, this issue would not typically be under attacker control making active\nexploitation unlikely.\n\nThe FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue.\n\nDue to the low severity of this issue we are not issuing new releases of\nOpenSSL at this time. The fix will be included in the next releases when they\nbecome available.","status":"published","published":"2024-06-27T10:30:53Z","modified":"2026-10-15T00:29:32Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"updated_at":"2026-11-02T17:27:10.794682Z"}],"ghsa":[{"id":"GHSA-4fc7-mvrr-wv2c","title":"Issue summary: Calling the OpenSSL API function SSL_select_next_proto with an\nempty supported...","description":"Issue summary: Calling the OpenSSL API function SSL_select_next_proto with an\nempty supported client protocols buffer may cause a crash or memory contents to\nbe sent to the peer.\n\nImpact summary: A buffer overread can have a range of potential consequences\nsuch as unexpected application beahviour or a crash. In particular this issue\ncould result in up to 255 bytes of arbitrary private data from memory being sent\nto the peer leading to a loss of confidentiality. However, only applications\nthat directly call the SSL_select_next_proto function with a 0 length list of\nsupported client protocols are affected by this issue. This would normally never\nbe a valid scenario and is typically not under attacker control but may occur by\naccident in the case of a configuration or programming error in the calling\napplication.\n\nThe OpenSSL API function SSL_select_next_proto is typically used by TLS\napplications that support ALPN (Application Layer Protocol Negotiation) or NPN\n(Next Protocol Negotiation). NPN is older, was never standardised and\nis deprecated in favour of ALPN. We believe that ALPN is significantly more\nwidely deployed than NPN. The SSL_select_next_proto function accepts a list of\nprotocols from the server and a list of protocols from the client and returns\nthe first protocol that appears in the server list that also appears in the\nclient list. In the case of no overlap between the two lists it returns the\nfirst item in the client list. In either case it will signal whether an overlap\nbetween the two lists was found. In the case where SSL_select_next_proto is\ncalled with a zero length client list it fails to notice this condition and\nreturns the memory immediately following the client list pointer (and reports\nthat there was no overlap in the lists).\n\nThis function is typically called from a server side application callback for\nALPN or a client side application callback for NPN. In the case of ALPN the list\nof protocols supplied by the client is guaranteed by libssl to never be zero in\nlength. The list of server protocols comes from the application and should never\nnormally be expected to be of zero length. In this case if the\nSSL_select_next_proto function has been called as expected (with the list\nsupplied by the client passed in the client/client_len parameters), then the\napplication will not be vulnerable to this issue. If the application has\naccidentally been configured with a zero length server list, and has\naccidentally passed that zero length server list in the client/client_len\nparameters, and has additionally failed to correctly handle a \"no overlap\"\nresponse (which would normally result in a handshake failure in ALPN) then it\nwill be vulnerable to this problem.\n\nIn the case of NPN, the protocol permits the client to opportunistically select\na protocol when there is no overlap. OpenSSL returns the first client protocol\nin the no overlap case in support of this. The list of client protocols comes\nfrom the application and should never normally be expected to be of zero length.\nHowever if the SSL_select_next_proto function is accidentally called with a\nclient_len of 0 then an invalid memory pointer will be returned instead. If the\napplication uses this output as the opportunistic protocol then the loss of\nconfidentiality will occur.\n\nThis issue has been assessed as Low severity because applications are most\nlikely to be vulnerable if they are using NPN instead of ALPN - but NPN is not\nwidely used. It also requires an application configuration or programming error.\nFinally, this issue would not typically be under attacker control making active\nexploitation unlikely.\n\nThe FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue.\n\nDue to the low severity of this issue we are not issuing new releases of\nOpenSSL at this time. The fix will be included in the next releases when they\nbecome available.","status":"published","published":"2024-06-27T12:30:48Z","modified":"2026-05-12T12:31:57Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"cwes":["CWE-125","CWE-200"],"updated_at":"2026-11-02T15:08:01.307422Z"}],"nvd":[{"id":"CVE-2024-5535","description":"Issue summary: Calling the OpenSSL API function SSL_select_next_proto with an\nempty supported client protocols buffer may cause a crash or memory contents to\nbe sent to the peer.\n\nImpact summary: A buffer overread can have a range of potential consequences\nsuch as unexpected application beahviour or a crash. In particular this issue\ncould result in up to 255 bytes of arbitrary private data from memory being sent\nto the peer leading to a loss of confidentiality. However, only applications\nthat directly call the SSL_select_next_proto function with a 0 length list of\nsupported client protocols are affected by this issue. This would normally never\nbe a valid scenario and is typically not under attacker control but may occur by\naccident in the case of a configuration or programming error in the calling\napplication.\n\nThe OpenSSL API function SSL_select_next_proto is typically used by TLS\napplications that support ALPN (Application Layer Protocol Negotiation) or NPN\n(Next Protocol Negotiation). NPN is older, was never standardised and\nis deprecated in favour of ALPN. We believe that ALPN is significantly more\nwidely deployed than NPN. The SSL_select_next_proto function accepts a list of\nprotocols from the server and a list of protocols from the client and returns\nthe first protocol that appears in the server list that also appears in the\nclient list. In the case of no overlap between the two lists it returns the\nfirst item in the client list. In either case it will signal whether an overlap\nbetween the two lists was found. In the case where SSL_select_next_proto is\ncalled with a zero length client list it fails to notice this condition and\nreturns the memory immediately following the client list pointer (and reports\nthat there was no overlap in the lists).\n\nThis function is typically called from a server side application callback for\nALPN or a client side application callback for NPN. In the case of ALPN the list\nof protocols supplied by the client is guaranteed by libssl to never be zero in\nlength. The list of server protocols comes from the application and should never\nnormally be expected to be of zero length. In this case if the\nSSL_select_next_proto function has been called as expected (with the list\nsupplied by the client passed in the client/client_len parameters), then the\napplication will not be vulnerable to this issue. If the application has\naccidentally been configured with a zero length server list, and has\naccidentally passed that zero length server list in the client/client_len\nparameters, and has additionally failed to correctly handle a \"no overlap\"\nresponse (which would normally result in a handshake failure in ALPN) then it\nwill be vulnerable to this problem.\n\nIn the case of NPN, the protocol permits the client to opportunistically select\na protocol when there is no overlap. OpenSSL returns the first client protocol\nin the no overlap case in support of this. The list of client protocols comes\nfrom the application and should never normally be expected to be of zero length.\nHowever if the SSL_select_next_proto function is accidentally called with a\nclient_len of 0 then an invalid memory pointer will be returned instead. If the\napplication uses this output as the opportunistic protocol then the loss of\nconfidentiality will occur.\n\nThis issue has been assessed as Low severity because applications are most\nlikely to be vulnerable if they are using NPN instead of ALPN - but NPN is not\nwidely used. It also requires an application configuration or programming error.\nFinally, this issue would not typically be under attacker control making active\nexploitation unlikely.\n\nThe FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue.\n\nDue to the low severity of this issue we are not issuing new releases of\nOpenSSL at this time. The fix will be included in the next releases when they\nbecome available.","status":"published","published":"2024-06-27T11:15:24.447Z","modified":"2026-11-06T17:39:09.78Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-125"],"updated_at":"2026-11-09T20:15:28.020446Z"}],"osv":[{"id":"ALPINE-CVE-2024-5535","description":"Issue summary: Calling the OpenSSL API function SSL_select_next_proto with an\nempty supported client protocols buffer may cause a crash or memory contents to\nbe sent to the peer.\n\nImpact summary: A buffer overread can have a range of potential consequences\nsuch as unexpected application beahviour or a crash. In particular this issue\ncould result in up to 255 bytes of arbitrary private data from memory being sent\nto the peer leading to a loss of confidentiality. However, only applications\nthat directly call the SSL_select_next_proto function with a 0 length list of\nsupported client protocols are affected by this issue. This would normally never\nbe a valid scenario and is typically not under attacker control but may occur by\naccident in the case of a configuration or programming error in the calling\napplication.\n\nThe OpenSSL API function SSL_select_next_proto is typically used by TLS\napplications that support ALPN (Application Layer Protocol Negotiation) or NPN\n(Next Protocol Negotiation). NPN is older, was never standardised and\nis deprecated in favour of ALPN. We believe that ALPN is significantly more\nwidely deployed than NPN. The SSL_select_next_proto function accepts a list of\nprotocols from the server and a list of protocols from the client and returns\nthe first protocol that appears in the server list that also appears in the\nclient list. In the case of no overlap between the two lists it returns the\nfirst item in the client list. In either case it will signal whether an overlap\nbetween the two lists was found. In the case where SSL_select_next_proto is\ncalled with a zero length client list it fails to notice this condition and\nreturns the memory immediately following the client list pointer (and reports\nthat there was no overlap in the lists).\n\nThis function is typically called from a server side application callback for\nALPN or a client side application callback for NPN. In the case of ALPN the list\nof protocols supplied by the client is guaranteed by libssl to never be zero in\nlength. The list of server protocols comes from the application and should never\nnormally be expected to be of zero length. In this case if the\nSSL_select_next_proto function has been called as expected (with the list\nsupplied by the client passed in the client/client_len parameters), then the\napplication will not be vulnerable to this issue. If the application has\naccidentally been configured with a zero length server list, and has\naccidentally passed that zero length server list in the client/client_len\nparameters, and has additionally failed to correctly handle a \"no overlap\"\nresponse (which would normally result in a handshake failure in ALPN) then it\nwill be vulnerable to this problem.\n\nIn the case of NPN, the protocol permits the client to opportunistically select\na protocol when there is no overlap. OpenSSL returns the first client protocol\nin the no overlap case in support of this. The list of client protocols comes\nfrom the application and should never normally be expected to be of zero length.\nHowever if the SSL_select_next_proto function is accidentally called with a\nclient_len of 0 then an invalid memory pointer will be returned instead. If the\napplication uses this output as the opportunistic protocol then the loss of\nconfidentiality will occur.\n\nThis issue has been assessed as Low severity because applications are most\nlikely to be vulnerable if they are using NPN instead of ALPN - but NPN is not\nwidely used. It also requires an application configuration or programming error.\nFinally, this issue would not typically be under attacker control making active\nexploitation unlikely.\n\nThe FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue.\n\nDue to the low severity of this issue we are not issuing new releases of\nOpenSSL at this time. The fix will be included in the next releases when they\nbecome available.","status":"published","published":"2024-06-27T11:15:24.447Z","modified":"2026-11-02T11:17:50.1281098Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"updated_at":"2026-11-02T15:27:49.709457Z"},{"id":"BELL-CVE-2024-5535","status":"published","published":"2024-06-28T05:58:16.592477Z","modified":"2026-01-26T09:38:07.622496Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"updated_at":"2026-11-02T15:28:20.963569Z"},{"id":"CVE-2024-5535","title":"SSL_select_next_proto buffer overread","description":"Issue summary: Calling the OpenSSL API function SSL_select_next_proto with an\nempty supported client protocols buffer may cause a crash or memory contents to\nbe sent to the peer.\n\nImpact summary: A buffer overread can have a range of potential consequences\nsuch as unexpected application beahviour or a crash. In particular this issue\ncould result in up to 255 bytes of arbitrary private data from memory being sent\nto the peer leading to a loss of confidentiality. However, only applications\nthat directly call the SSL_select_next_proto function with a 0 length list of\nsupported client protocols are affected by this issue. This would normally never\nbe a valid scenario and is typically not under attacker control but may occur by\naccident in the case of a configuration or programming error in the calling\napplication.\n\nThe OpenSSL API function SSL_select_next_proto is typically used by TLS\napplications that support ALPN (Application Layer Protocol Negotiation) or NPN\n(Next Protocol Negotiation). NPN is older, was never standardised and\nis deprecated in favour of ALPN. We believe that ALPN is significantly more\nwidely deployed than NPN. The SSL_select_next_proto function accepts a list of\nprotocols from the server and a list of protocols from the client and returns\nthe first protocol that appears in the server list that also appears in the\nclient list. In the case of no overlap between the two lists it returns the\nfirst item in the client list. In either case it will signal whether an overlap\nbetween the two lists was found. In the case where SSL_select_next_proto is\ncalled with a zero length client list it fails to notice this condition and\nreturns the memory immediately following the client list pointer (and reports\nthat there was no overlap in the lists).\n\nThis function is typically called from a server side application callback for\nALPN or a client side application callback for NPN. In the case of ALPN the list\nof protocols supplied by the client is guaranteed by libssl to never be zero in\nlength. The list of server protocols comes from the application and should never\nnormally be expected to be of zero length. In this case if the\nSSL_select_next_proto function has been called as expected (with the list\nsupplied by the client passed in the client/client_len parameters), then the\napplication will not be vulnerable to this issue. If the application has\naccidentally been configured with a zero length server list, and has\naccidentally passed that zero length server list in the client/client_len\nparameters, and has additionally failed to correctly handle a \"no overlap\"\nresponse (which would normally result in a handshake failure in ALPN) then it\nwill be vulnerable to this problem.\n\nIn the case of NPN, the protocol permits the client to opportunistically select\na protocol when there is no overlap. OpenSSL returns the first client protocol\nin the no overlap case in support of this. The list of client protocols comes\nfrom the application and should never normally be expected to be of zero length.\nHowever if the SSL_select_next_proto function is accidentally called with a\nclient_len of 0 then an invalid memory pointer will be returned instead. If the\napplication uses this output as the opportunistic protocol then the loss of\nconfidentiality will occur.\n\nThis issue has been assessed as Low severity because applications are most\nlikely to be vulnerable if they are using NPN instead of ALPN - but NPN is not\nwidely used. It also requires an application configuration or programming error.\nFinally, this issue would not typically be under attacker control making active\nexploitation unlikely.\n\nThe FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue.\n\nDue to the low severity of this issue we are not issuing new releases of\nOpenSSL at this time. The fix will be included in the next releases when they\nbecome available.","status":"published","published":"2024-06-27T10:30:53.118Z","modified":"2026-11-08T07:05:53.839504861Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"cwes":["CWE-125"],"updated_at":"2026-11-08T02:57:30.447698Z"},{"id":"DEBIAN-CVE-2024-5535","description":"Issue summary: Calling the OpenSSL API function SSL_select_next_proto with an empty supported client protocols buffer may cause a crash or memory contents to be sent to the peer.  Impact summary: A buffer overread can have a range of potential consequences such as unexpected application beahviour or a crash. In particular this issue could result in up to 255 bytes of arbitrary private data from memory being sent to the peer leading to a loss of confidentiality. However, only applications that directly call the SSL_select_next_proto function with a 0 length list of supported client protocols are affected by this issue. This would normally never be a valid scenario and is typically not under attacker control but may occur by accident in the case of a configuration or programming error in the calling application.  The OpenSSL API function SSL_select_next_proto is typically used by TLS applications that support ALPN (Application Layer Protocol Negotiation) or NPN (Next Protocol Negotiation). NPN is older, was never standardised and is deprecated in favour of ALPN. We believe that ALPN is significantly more widely deployed than NPN. The SSL_select_next_proto function accepts a list of protocols from the server and a list of protocols from the client and returns the first protocol that appears in the server list that also appears in the client list. In the case of no overlap between the two lists it returns the first item in the client list. In either case it will signal whether an overlap between the two lists was found. In the case where SSL_select_next_proto is called with a zero length client list it fails to notice this condition and returns the memory immediately following the client list pointer (and reports that there was no overlap in the lists).  This function is typically called from a server side application callback for ALPN or a client side application callback for NPN. In the case of ALPN the list of protocols supplied by the client is guaranteed by libssl to never be zero in length. The list of server protocols comes from the application and should never normally be expected to be of zero length. In this case if the SSL_select_next_proto function has been called as expected (with the list supplied by the client passed in the client/client_len parameters), then the application will not be vulnerable to this issue. If the application has accidentally been configured with a zero length server list, and has accidentally passed that zero length server list in the client/client_len parameters, and has additionally failed to correctly handle a \"no overlap\" response (which would normally result in a handshake failure in ALPN) then it will be vulnerable to this problem.  In the case of NPN, the protocol permits the client to opportunistically select a protocol when there is no overlap. OpenSSL returns the first client protocol in the no overlap case in support of this. The list of client protocols comes from the application and should never normally be expected to be of zero length. However if the SSL_select_next_proto function is accidentally called with a client_len of 0 then an invalid memory pointer will be returned instead. If the application uses this output as the opportunistic protocol then the loss of confidentiality will occur.  This issue has been assessed as Low severity because applications are most likely to be vulnerable if they are using NPN instead of ALPN - but NPN is not widely used. It also requires an application configuration or programming error. Finally, this issue would not typically be under attacker control making active exploitation unlikely.  The FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue.  Due to the low severity of this issue we are not issuing new releases of OpenSSL at this time. The fix will be included in the next releases when they become available.","status":"published","published":"2024-06-27T11:15:24.447Z","modified":"2026-11-07T09:47:34.478043122Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"updated_at":"2026-11-07T10:14:39.995311Z"},{"id":"JLSEC-2026-252","title":"Issue summary: Calling the OpenSSL API function `SSL_select_next_proto` with an empty supported...","description":"Issue summary: Calling the OpenSSL API function `SSL_select_next_proto` with an\nempty supported client protocols buffer may cause a crash or memory contents to\nbe sent to the peer.\n\nImpact summary: A buffer overread can have a range of potential consequences\nsuch as unexpected application beahviour or a crash. In particular this issue\ncould result in up to 255 bytes of arbitrary private data from memory being sent\nto the peer leading to a loss of confidentiality. However, only applications\nthat directly call the `SSL_select_next_proto` function with a 0 length list of\nsupported client protocols are affected by this issue. This would normally never\nbe a valid scenario and is typically not under attacker control but may occur by\naccident in the case of a configuration or programming error in the calling\napplication.\n\nThe OpenSSL API function `SSL_select_next_proto` is typically used by TLS\napplications that support ALPN (Application Layer Protocol Negotiation) or NPN\n(Next Protocol Negotiation). NPN is older, was never standardised and\nis deprecated in favour of ALPN. We believe that ALPN is significantly more\nwidely deployed than NPN. The `SSL_select_next_proto` function accepts a list of\nprotocols from the server and a list of protocols from the client and returns\nthe first protocol that appears in the server list that also appears in the\nclient list. In the case of no overlap between the two lists it returns the\nfirst item in the client list. In either case it will signal whether an overlap\nbetween the two lists was found. In the case where `SSL_select_next_proto` is\ncalled with a zero length client list it fails to notice this condition and\nreturns the memory immediately following the client list pointer (and reports\nthat there was no overlap in the lists).\n\nThis function is typically called from a server side application callback for\nALPN or a client side application callback for NPN. In the case of ALPN the list\nof protocols supplied by the client is guaranteed by libssl to never be zero in\nlength. The list of server protocols comes from the application and should never\nnormally be expected to be of zero length. In this case if the\n`SSL_select_next_proto` function has been called as expected (with the list\nsupplied by the client passed in the `client/client_len` parameters), then the\napplication will not be vulnerable to this issue. If the application has\naccidentally been configured with a zero length server list, and has\naccidentally passed that zero length server list in the `client/client_len`\nparameters, and has additionally failed to correctly handle a \"no overlap\"\nresponse (which would normally result in a handshake failure in ALPN) then it\nwill be vulnerable to this problem.\n\nIn the case of NPN, the protocol permits the client to opportunistically select\na protocol when there is no overlap. OpenSSL returns the first client protocol\nin the no overlap case in support of this. The list of client protocols comes\nfrom the application and should never normally be expected to be of zero length.\nHowever if the `SSL_select_next_proto` function is accidentally called with a\n`client_len` of 0 then an invalid memory pointer will be returned instead. If the\napplication uses this output as the opportunistic protocol then the loss of\nconfidentiality will occur.\n\nThis issue has been assessed as Low severity because applications are most\nlikely to be vulnerable if they are using NPN instead of ALPN - but NPN is not\nwidely used. It also requires an application configuration or programming error.\nFinally, this issue would not typically be under attacker control making active\nexploitation unlikely.\n\nThe FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue.\n\nDue to the low severity of this issue we are not issuing new releases of\nOpenSSL at this time. The fix will be included in the next releases when they\nbecome available.","status":"published","published":"2026-04-27T18:33:55.942Z","modified":"2026-07-25T18:24:09.741757409Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"updated_at":"2026-11-02T15:47:18.573531Z"},{"id":"OESA-2024-1879","title":"openssl security update","description":"The OpenSSL Project is a collaborative effort to develop a robust, commercial-grade, fully featured, and Open Source toolkit implementing the Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1) protocols as well as a full-strength general purpose cryptography library. The project is managed by a worldwide community of volunteers that use the Internet to communicate, plan, and develop the OpenSSL tookit and its related documentation.\n\nSecurity Fix(es):\n\nIssue summary: Calling the OpenSSL API function SSL_select_next_proto with an\nempty supported client protocols buffer may cause a crash or memory contents to\nbe sent to the peer.\n\nImpact summary: A buffer overread can have a range of potential consequences\nsuch as unexpected application beahviour or a crash. In particular this issue\ncould result in up to 255 bytes of arbitrary private data from memory being sent\nto the peer leading to a loss of confidentiality. However, only applications\nthat directly call the SSL_select_next_proto function with a 0 length list of\nsupported client protocols are affected by this issue. This would normally never\nbe a valid scenario and is typically not under attacker control but may occur by\naccident in the case of a configuration or programming error in the calling\napplication.\n\nThe OpenSSL API function SSL_select_next_proto is typically used by TLS\napplications that support ALPN (Application Layer Protocol Negotiation) or NPN\n(Next Protocol Negotiation). NPN is older, was never standardised and\nis deprecated in favour of ALPN. We believe that ALPN is significantly more\nwidely deployed than NPN. The SSL_select_next_proto function accepts a list of\nprotocols from the server and a list of protocols from the client and returns\nthe first protocol that appears in the server list that also appears in the\nclient list. In the case of no overlap between the two lists it returns the\nfirst item in the client list. In either case it will signal whether an overlap\nbetween the two lists was found. In the case where SSL_select_next_proto is\ncalled with a zero length client list it fails to notice this condition and\nreturns the memory immediately following the client list pointer (and reports\nthat there was no overlap in the lists).\n\nThis function is typically called from a server side application callback for\nALPN or a client side application callback for NPN. In the case of ALPN the list\nof protocols supplied by the client is guaranteed by libssl to never be zero in\nlength. The list of server protocols comes from the application and should never\nnormally be expected to be of zero length. In this case if the\nSSL_select_next_proto function has been called as expected (with the list\nsupplied by the client passed in the client/client_len parameters), then the\napplication will not be vulnerable to this issue. If the application has\naccidentally been configured with a zero length server list, and has\naccidentally passed that zero length server list in the client/client_len\nparameters, and has additionally failed to correctly handle a \u0026quot;no overlap\u0026quot;\nresponse (which would normally result in a handshake failure in ALPN) then it\nwill be vulnerable to this problem.\n\nIn the case of NPN, the protocol permits the client to opportunistically select\na protocol when there is no overlap. OpenSSL returns the first client protocol\nin the no overlap case in support of this. The list of client protocols comes\nfrom the application and should never normally be expected to be of zero length.\nHowever if the SSL_select_next_proto function is accidentally called with a\nclient_len of 0 then an invalid memory pointer will be returned instead. If the\napplication uses this output as the opportunistic protocol then the loss of\nconfidentiality will occur.\n\nThis issue has been assessed as Low severity because applications are most\nlikely to be vulnerable if they are using NPN instead of ALPN - but NPN is not\nwidely used. It also requires an application configuration or programming error.\nFinally, this issue would not typically be under attacker control making active\nexploitation unlikely.\n\nThe FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue.\n\nDue to the low severity of this issue we are not issuing new releases of\nOpenSSL at this time. The fix will be included in the next releases when they\nbecome available.(CVE-2024-5535)","status":"published","published":"2024-07-19T11:07:20Z","modified":"2026-08-18T01:18:29.934674029Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:41.595342Z"},{"id":"OESA-2024-1914","title":"edk2 security update","description":"EDK II is a modern, feature-rich, cross-platform firmware development environment for the UEFI and PI specifications.\n\nSecurity Fix(es):\n\nIssue summary: Calling the OpenSSL API function SSL_select_next_proto with an\nempty supported client protocols buffer may cause a crash or memory contents to\nbe sent to the peer.\n\nImpact summary: A buffer overread can have a range of potential consequences\nsuch as unexpected application beahviour or a crash. In particular this issue\ncould result in up to 255 bytes of arbitrary private data from memory being sent\nto the peer leading to a loss of confidentiality. However, only applications\nthat directly call the SSL_select_next_proto function with a 0 length list of\nsupported client protocols are affected by this issue. This would normally never\nbe a valid scenario and is typically not under attacker control but may occur by\naccident in the case of a configuration or programming error in the calling\napplication.\n\nThe OpenSSL API function SSL_select_next_proto is typically used by TLS\napplications that support ALPN (Application Layer Protocol Negotiation) or NPN\n(Next Protocol Negotiation). NPN is older, was never standardised and\nis deprecated in favour of ALPN. We believe that ALPN is significantly more\nwidely deployed than NPN. The SSL_select_next_proto function accepts a list of\nprotocols from the server and a list of protocols from the client and returns\nthe first protocol that appears in the server list that also appears in the\nclient list. In the case of no overlap between the two lists it returns the\nfirst item in the client list. In either case it will signal whether an overlap\nbetween the two lists was found. In the case where SSL_select_next_proto is\ncalled with a zero length client list it fails to notice this condition and\nreturns the memory immediately following the client list pointer (and reports\nthat there was no overlap in the lists).\n\nThis function is typically called from a server side application callback for\nALPN or a client side application callback for NPN. In the case of ALPN the list\nof protocols supplied by the client is guaranteed by libssl to never be zero in\nlength. The list of server protocols comes from the application and should never\nnormally be expected to be of zero length. In this case if the\nSSL_select_next_proto function has been called as expected (with the list\nsupplied by the client passed in the client/client_len parameters), then the\napplication will not be vulnerable to this issue. If the application has\naccidentally been configured with a zero length server list, and has\naccidentally passed that zero length server list in the client/client_len\nparameters, and has additionally failed to correctly handle a \u0026quot;no overlap\u0026quot;\nresponse (which would normally result in a handshake failure in ALPN) then it\nwill be vulnerable to this problem.\n\nIn the case of NPN, the protocol permits the client to opportunistically select\na protocol when there is no overlap. OpenSSL returns the first client protocol\nin the no overlap case in support of this. The list of client protocols comes\nfrom the application and should never normally be expected to be of zero length.\nHowever if the SSL_select_next_proto function is accidentally called with a\nclient_len of 0 then an invalid memory pointer will be returned instead. If the\napplication uses this output as the opportunistic protocol then the loss of\nconfidentiality will occur.\n\nThis issue has been assessed as Low severity because applications are most\nlikely to be vulnerable if they are using NPN instead of ALPN - but NPN is not\nwidely used. It also requires an application configuration or programming error.\nFinally, this issue would not typically be under attacker control making active\nexploitation unlikely.\n\nThe FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue.\n\nDue to the low severity of this issue we are not issuing new releases of\nOpenSSL at this time. The fix will be included in the next releases when they\nbecome available.(CVE-2024-5535)","status":"published","published":"2024-07-26T11:07:22Z","modified":"2026-08-18T01:18:31.365201921Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:41.595342Z"},{"id":"OESA-2025-1288","title":"compat-openssl11 security update","description":"OpenSSL is a robust, commercial-grade, and full-featured toolkit for the Transport Layer Security (TLS) and Secure Sockets Layer (SSL) protocols.\r\n\r\nSecurity Fix(es):\n\nIssue summary: A timing side-channel which could potentially allow recovering\nthe private key exists in the ECDSA signature computation.\n\nImpact summary: A timing side-channel in ECDSA signature computations\ncould allow recovering the private key by an attacker. However, measuring\nthe timing would require either local access to the signing application or\na very fast network connection with low latency.\n\nThere is a timing signal of around 300 nanoseconds when the top word of\nthe inverted ECDSA nonce value is zero. This can happen with significant\nprobability only for some of the supported elliptic curves. In particular\nthe NIST P-521 curve is affected. To be able to measure this leak, the attacker\nprocess must either be located in the same physical computer or must\nhave a very fast network connection with low latency. For that reason\nthe severity of this vulnerability is Low.(CVE-2024-13176)\n\nIssue summary: Calling the OpenSSL API function SSL_select_next_proto with an\nempty supported client protocols buffer may cause a crash or memory contents to\nbe sent to the peer.\n\nImpact summary: A buffer overread can have a range of potential consequences\nsuch as unexpected application beahviour or a crash. In particular this issue\ncould result in up to 255 bytes of arbitrary private data from memory being sent\nto the peer leading to a loss of confidentiality. However, only applications\nthat directly call the SSL_select_next_proto function with a 0 length list of\nsupported client protocols are affected by this issue. This would normally never\nbe a valid scenario and is typically not under attacker control but may occur by\naccident in the case of a configuration or programming error in the calling\napplication.\n\nThe OpenSSL API function SSL_select_next_proto is typically used by TLS\napplications that support ALPN (Application Layer Protocol Negotiation) or NPN\n(Next Protocol Negotiation). NPN is older, was never standardised and\nis deprecated in favour of ALPN. We believe that ALPN is significantly more\nwidely deployed than NPN. The SSL_select_next_proto function accepts a list of\nprotocols from the server and a list of protocols from the client and returns\nthe first protocol that appears in the server list that also appears in the\nclient list. In the case of no overlap between the two lists it returns the\nfirst item in the client list. In either case it will signal whether an overlap\nbetween the two lists was found. In the case where SSL_select_next_proto is\ncalled with a zero length client list it fails to notice this condition and\nreturns the memory immediately following the client list pointer (and reports\nthat there was no overlap in the lists).\n\nThis function is typically called from a server side application callback for\nALPN or a client side application callback for NPN. In the case of ALPN the list\nof protocols supplied by the client is guaranteed by libssl to never be zero in\nlength. The list of server protocols comes from the application and should never\nnormally be expected to be of zero length. In this case if the\nSSL_select_next_proto function has been called as expected (with the list\nsupplied by the client passed in the client/client_len parameters), then the\napplication will not be vulnerable to this issue. If the application has\naccidentally been configured with a zero length server list, and has\naccidentally passed that zero length server list in the client/client_len\nparameters, and has additionally failed to correctly handle a \u0026quot;no overlap\u0026quot;\nresponse (which would normally result in a handshake failure in ALPN) then it\nwill be vulnerable to this problem.\n\nIn the case of NPN, the protocol permits the client to opportunistically select\na protocol when there is no overlap. OpenSSL returns the first client protocol\nin the no overlap case in support of this. The list of client protocols comes\nfrom the application and should never normally be expected to be of zero length.\nHowever if the SSL_select_next_proto function is accidentally called with a\nclient_len of 0 then an invalid memory pointer will be returned instead. If the\napplication uses this output as the opportunistic protocol then the loss of\nconfidentiality will occur.\n\nThis issue has been assessed as Low severity because applications are most\nlikely to be vulnerable if they are using NPN instead of ALPN - but NPN is not\nwidely used. It also requires an application configuration or programming error.\nFinally, this issue would not typically be under attacker control making active\nexploitation unlikely.\n\nThe FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue.\n\nDue to the low severity of this issue we are not issuing new releases of\nOpenSSL at this time. The fix will be included in the next releases when they\nbecome available.(CVE-2024-5535)","status":"published","published":"2025-03-14T11:08:23Z","modified":"2026-08-18T01:17:49.88493993Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:42.714349Z"},{"id":"RHSA-2024:7846","title":"Red Hat Security Advisory: openssl security update","status":"published","published":"2024-10-09T12:20:45Z","modified":"2026-10-09T10:12:15Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:14.610978Z"},{"id":"RHSA-2024:7847","title":"Red Hat Security Advisory: openssl security update","status":"published","published":"2024-10-09T12:20:35Z","modified":"2026-10-09T10:12:16Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:14.610978Z"},{"id":"RHSA-2024:7848","title":"Red Hat Security Advisory: openssl security update","status":"published","published":"2024-10-09T18:16:26Z","modified":"2026-10-09T10:12:16Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:14.610978Z"},{"id":"RHSA-2024:9333","title":"Red Hat Security Advisory: openssl and openssl-fips-provider security update","status":"published","published":"2024-11-12T17:57:00Z","modified":"2026-10-09T10:12:54Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:14.610978Z"},{"id":"RHSA-2025:1671","title":"Red Hat Security Advisory: mysql security update","status":"published","published":"2025-02-20T10:02:51Z","modified":"2026-10-17T10:05:14Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:16.096024Z"},{"id":"RHSA-2025:1673","title":"Red Hat Security Advisory: mysql:8.0 security update","status":"published","published":"2025-02-20T10:02:51Z","modified":"2026-10-17T10:05:15Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:16.096024Z"},{"id":"RHSA-2025:3452","title":"Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.62 security update","status":"published","published":"2025-04-03T10:06:55Z","modified":"2026-10-09T10:16:32Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:17.133041Z"},{"id":"RHSA-2025:3666","title":"Red Hat Security Advisory: openssl security update","status":"published","published":"2025-04-08T10:04:17Z","modified":"2026-10-09T10:16:38Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:17.133041Z"},{"id":"RHSA-2026:58563","title":"Red Hat Security Advisory: openssl security update","status":"published","published":"2026-08-24T10:18:42Z","modified":"2026-10-20T10:11:46Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.457353Z"},{"id":"RHSA-2026:60329","title":"Red Hat Security Advisory: mingw-openssl security update","status":"published","published":"2026-08-27T10:16:10Z","modified":"2026-10-10T10:15:48Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:21.91255Z"},{"id":"RHSA-2026:66524","title":"Red Hat Security Advisory: openssl security, bug fix, and enhancement update","status":"published","published":"2026-09-11T10:15:16Z","modified":"2026-10-20T10:13:33Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"RLSA-2025:1671","title":"Important: mysql security update","description":"MySQL is a multi-user, multi-threaded SQL database server. It consists of the MySQL server daemon (mysqld) and many client programs and libraries.\n\nSecurity Fix(es):\n\n* openssl: SSL_select_next_proto buffer overread (CVE-2024-5535)\n\n* krb5: GSS message token handling (CVE-2024-37371)\n\n* curl: libcurl: ASN.1 date parser overread (CVE-2024-7264)\n\n* mysql: Thread Pooling unspecified vulnerability (CPU Oct 2024) (CVE-2024-21238)\n\n* mysql: X Plugin unspecified vulnerability (CPU Oct 2024) (CVE-2024-21196)\n\n* mysql: Optimizer unspecified vulnerability (CPU Oct 2024) (CVE-2024-21241)\n\n* mysql: Client programs unspecified vulnerability (CPU Oct 2024) (CVE-2024-21231)\n\n* mysql: Information Schema unspecified vulnerability (CPU Oct 2024) (CVE-2024-21197)\n\n* mysql: InnoDB unspecified vulnerability (CPU Oct 2024) (CVE-2024-21218)\n\n* mysql: Optimizer unspecified vulnerability (CPU Oct 2024) (CVE-2024-21201)\n\n* mysql: InnoDB unspecified vulnerability (CPU Oct 2024) (CVE-2024-21236)\n\n* mysql: Group Replication GCS unspecified vulnerability (CPU Oct 2024) (CVE-2024-21237)\n\n* mysql: FTS unspecified vulnerability (CPU Oct 2024) (CVE-2024-21203)\n\n* mysql: Health Monitor unspecified vulnerability (CPU Oct 2024) (CVE-2024-21212)\n\n* mysql: DML unspecified vulnerability (CPU Oct 2024) (CVE-2024-21219)\n\n* mysql: Optimizer unspecified vulnerability (CPU Oct 2024) (CVE-2024-21230)\n\n* mysql: InnoDB unspecified vulnerability (CPU Oct 2024) (CVE-2024-21213)\n\n* mysql: InnoDB unspecified vulnerability (CPU Oct 2024) (CVE-2024-21194)\n\n* mysql: InnoDB unspecified vulnerability (CPU Oct 2024) (CVE-2024-21199)\n\n* mysql: PS unspecified vulnerability (CPU Oct 2024) (CVE-2024-21193)\n\n* mysql: DDL unspecified vulnerability (CPU Oct 2024) (CVE-2024-21198)\n\n* mysql: mysqldump unspecified vulnerability (CPU Oct 2024) (CVE-2024-21247)\n\n* mysql: InnoDB unspecified vulnerability (CPU Oct 2024) (CVE-2024-21239)\n\n* curl: curl netrc password leak (CVE-2024-11053)\n\n* mysql: InnoDB unspecified vulnerability (CPU Jan 2025) (CVE-2025-21497)\n\n* mysql: MySQL Server Options Vulnerability (CVE-2025-21520)\n\n* mysql: High Privilege Denial of Service Vulnerability in MySQL Server (CVE-2025-21490)\n\n* mysql: Information Schema unspecified vulnerability (CPU Jan 2025) (CVE-2025-21529)\n\n* mysql: InnoDB unspecified vulnerability (CPU Jan 2025) (CVE-2025-21531)\n\n* mysql: Optimizer unspecified vulnerability (CPU Jan 2025) (CVE-2025-21504)\n\n* mysql: Privileges unspecified vulnerability (CPU Jan 2025) (CVE-2025-21540)\n\n* mysql: MySQL Server InnoDB Denial of Service and Unauthorized Data Modification Vulnerability (CVE-2025-21555)\n\n* mysql: Packaging unspecified vulnerability (CPU Jan 2025) (CVE-2025-21543)\n\n* mysql: MySQL Server InnoDB Denial of Service and Unauthorized Data Modification Vulnerability (CVE-2025-21491)\n\n* mysql: DDL unspecified vulnerability (CPU Jan 2025) (CVE-2025-21525)\n\n* mysql: Optimizer unspecified vulnerability (CPU Jan 2025) (CVE-2025-21536)\n\n* mysql: Thread Pooling unspecified vulnerability (CPU Jan 2025) (CVE-2025-21521)\n\n* mysql: Optimizer unspecified vulnerability (CPU Jan 2025) (CVE-2025-21501)\n\n* mysql: Performance Schema unspecified vulnerability (CPU Jan 2025) (CVE-2025-21534)\n\n* mysql: Privileges unspecified vulnerability (CPU Jan 2025) (CVE-2025-21494)\n\n* mysql: Privileges unspecified vulnerability (CPU Jan 2025) (CVE-2025-21519)\n\n* mysql: Parser unspecified vulnerability (CPU Jan 2025) (CVE-2025-21522)\n\n* mysql: InnoDB unspecified vulnerability (CPU Jan 2025) (CVE-2025-21503)\n\n* mysql: Optimizer unspecified vulnerability (CPU Jan 2025) (CVE-2025-21518)\n\n* mysql: MySQL Server InnoDB Denial of Service and Unauthorized Data Modification Vulnerability (CVE-2025-21559)\n\n* mysql: Privilege Misuse in MySQL Server Security Component (CVE-2025-21546)\n\n* mysql: Optimizer unspecified vulnerability (CPU Jan 2025) (CVE-2025-21500)\n\n* mysql: InnoDB unspecified vulnerability (CPU Jan 2025) (CVE-2025-21523)\n\n* mysql: Components Services unspecified vulnerability (CPU Jan 2025) (CVE-2025-21505)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2025-03-17T20:16:45.510776Z","modified":"2025-10-09T06:18:53.285992Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:25.216873Z"},{"id":"RLSA-2026:60329","title":"Low: mingw-openssl security update","description":"The OpenSSL toolkit provides support for secure communications between machines. OpenSSL includes a certificate management tool and shared libraries which provide various cryptographic algorithms and protocols.  This package contains Windows (MinGW) libraries and development tools.\n\nSecurity Fix(es):\n\n* openssl: SSL_select_next_proto buffer overread (CVE-2024-5535)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-08-27T06:02:14.339232Z","modified":"2026-08-27T06:30:03.411055996Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:26.111232Z"},{"id":"ROOT-OS-ALPINE-315-CVE-2024-5535","title":"CVE-2024-5535 in openssl - Patched by Root","description":"Root has patched CVE-2024-5535 in the openssl package for Root:Alpine:3.15. Multiple fixed versions available.","status":"published","published":"2026-10-13T15:12:42Z","modified":"2026-10-13T16:15:37.787314768Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:28.259095Z"},{"id":"UBUNTU-CVE-2024-5535","description":"Issue summary: Calling the OpenSSL API function SSL_select_next_proto with an empty supported client protocols buffer may cause a crash or memory contents to be sent to the peer. Impact summary: A buffer overread can have a range of potential consequences such as unexpected application beahviour or a crash. In particular this issue could result in up to 255 bytes of arbitrary private data from memory being sent to the peer leading to a loss of confidentiality. However, only applications that directly call the SSL_select_next_proto function with a 0 length list of supported client protocols are affected by this issue. This would normally never be a valid scenario and is typically not under attacker control but may occur by accident in the case of a configuration or programming error in the calling application. The OpenSSL API function SSL_select_next_proto is typically used by TLS applications that support ALPN (Application Layer Protocol Negotiation) or NPN (Next Protocol Negotiation). NPN is older, was never standardised and is deprecated in favour of ALPN. We believe that ALPN is significantly more widely deployed than NPN. The SSL_select_next_proto function accepts a list of protocols from the server and a list of protocols from the client and returns the first protocol that appears in the server list that also appears in the client list. In the case of no overlap between the two lists it returns the first item in the client list. In either case it will signal whether an overlap between the two lists was found. In the case where SSL_select_next_proto is called with a zero length client list it fails to notice this condition and returns the memory immediately following the client list pointer (and reports that there was no overlap in the lists). This function is typically called from a server side application callback for ALPN or a client side application callback for NPN. In the case of ALPN the list of protocols supplied by the client is guaranteed by libssl to never be zero in length. The list of server protocols comes from the application and should never normally be expected to be of zero length. In this case if the SSL_select_next_proto function has been called as expected (with the list supplied by the client passed in the client/client_len parameters), then the application will not be vulnerable to this issue. If the application has accidentally been configured with a zero length server list, and has accidentally passed that zero length server list in the client/client_len parameters, and has additionally failed to correctly handle a \"no overlap\" response (which would normally result in a handshake failure in ALPN) then it will be vulnerable to this problem. In the case of NPN, the protocol permits the client to opportunistically select a protocol when there is no overlap. OpenSSL returns the first client protocol in the no overlap case in support of this. The list of client protocols comes from the application and should never normally be expected to be of zero length. However if the SSL_select_next_proto function is accidentally called with a client_len of 0 then an invalid memory pointer will be returned instead. If the application uses this output as the opportunistic protocol then the loss of confidentiality will occur. This issue has been assessed as Low severity because applications are most likely to be vulnerable if they are using NPN instead of ALPN - but NPN is not widely used. It also requires an application configuration or programming error. Finally, this issue would not typically be under attacker control making active exploitation unlikely. The FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue. Due to the low severity of this issue we are not issuing new releases of OpenSSL at this time. The fix will be included in the next releases when they become available.","status":"published","published":"2024-06-27T11:15:00Z","modified":"2026-11-04T20:02:44.414002424Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"updated_at":"2026-11-06T14:23:15.378787Z"},{"id":"ALSA-2024:7848","title":"Low: openssl security update","description":"OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library.\n\nSecurity Fix(es):\n\n* openssl: SSL_select_next_proto buffer overread (CVE-2024-5535)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2024-10-09T00:00:00Z","modified":"2026-10-29T11:02:21.954490804Z","updated_at":"2026-11-02T15:27:53.030731Z"},{"id":"ALSA-2024:9333","title":"Low: openssl security update","description":"OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library.  \n\nSecurity Fix(es):  \n\n  * openssl: Unbounded memory growth with session handling in TLSv1.3 (CVE-2024-2511)\n  * openssl: Excessive time spent checking DSA keys and parameters (CVE-2024-4603)\n  * openssl: Use After Free with SSL_free_buffers (CVE-2024-4741)\n  * openssl: SSL_select_next_proto buffer overread (CVE-2024-5535)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.  \n\nAdditional Changes:  \n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.\n","status":"published","published":"2024-11-12T00:00:00Z","modified":"2026-10-29T11:31:27.28460828Z","updated_at":"2026-11-02T15:27:53.030731Z"},{"id":"ALSA-2025:1671","title":"Important: mysql security update","description":"MySQL is a multi-user, multi-threaded SQL database server. It consists of the MySQL server daemon (mysqld) and many client programs and libraries.  \n\nSecurity Fix(es):  \n\n  * openssl: SSL_select_next_proto buffer overread (CVE-2024-5535)\n  * krb5: GSS message token handling (CVE-2024-37371)\n  * curl: libcurl: ASN.1 date parser overread (CVE-2024-7264)\n  * mysql: Thread Pooling unspecified vulnerability (CPU Oct 2024) (CVE-2024-21238)\n  * mysql: X Plugin unspecified vulnerability (CPU Oct 2024) (CVE-2024-21196)\n  * mysql: Optimizer unspecified vulnerability (CPU Oct 2024) (CVE-2024-21241)\n  * mysql: Client programs unspecified vulnerability (CPU Oct 2024) (CVE-2024-21231)\n  * mysql: Information Schema unspecified vulnerability (CPU Oct 2024) (CVE-2024-21197)\n  * mysql: InnoDB unspecified vulnerability (CPU Oct 2024) (CVE-2024-21218)\n  * mysql: Optimizer unspecified vulnerability (CPU Oct 2024) (CVE-2024-21201)\n  * mysql: InnoDB unspecified vulnerability (CPU Oct 2024) (CVE-2024-21236)\n  * mysql: Group Replication GCS unspecified vulnerability (CPU Oct 2024) (CVE-2024-21237)\n  * mysql: FTS unspecified vulnerability (CPU Oct 2024) (CVE-2024-21203)\n  * mysql: Health Monitor unspecified vulnerability (CPU Oct 2024) (CVE-2024-21212)\n  * mysql: DML unspecified vulnerability (CPU Oct 2024) (CVE-2024-21219)\n  * mysql: Optimizer unspecified vulnerability (CPU Oct 2024) (CVE-2024-21230)\n  * mysql: InnoDB unspecified vulnerability (CPU Oct 2024) (CVE-2024-21213)\n  * mysql: InnoDB unspecified vulnerability (CPU Oct 2024) (CVE-2024-21194)\n  * mysql: InnoDB unspecified vulnerability (CPU Oct 2024) (CVE-2024-21199)\n  * mysql: PS unspecified vulnerability (CPU Oct 2024) (CVE-2024-21193)\n  * mysql: DDL unspecified vulnerability (CPU Oct 2024) (CVE-2024-21198)\n  * mysql: mysqldump unspecified vulnerability (CPU Oct 2024) (CVE-2024-21247)\n  * mysql: InnoDB unspecified vulnerability (CPU Oct 2024) (CVE-2024-21239)\n  * curl: curl netrc password leak (CVE-2024-11053)\n  * mysql: InnoDB unspecified vulnerability (CPU Jan 2025) (CVE-2025-21497)\n  * mysql: MySQL Server Options Vulnerability (CVE-2025-21520)\n  * mysql: High Privilege Denial of Service Vulnerability in MySQL Server (CVE-2025-21490)\n  * mysql: Information Schema unspecified vulnerability (CPU Jan 2025) (CVE-2025-21529)\n  * mysql: InnoDB unspecified vulnerability (CPU Jan 2025) (CVE-2025-21531)\n  * mysql: Optimizer unspecified vulnerability (CPU Jan 2025) (CVE-2025-21504)\n  * mysql: Privileges unspecified vulnerability (CPU Jan 2025) (CVE-2025-21540)\n  * mysql: MySQL Server InnoDB Denial of Service and Unauthorized Data Modification Vulnerability (CVE-2025-21555)\n  * mysql: Packaging unspecified vulnerability (CPU Jan 2025) (CVE-2025-21543)\n  * mysql: MySQL Server InnoDB Denial of Service and Unauthorized Data Modification Vulnerability (CVE-2025-21491)\n  * mysql: DDL unspecified vulnerability (CPU Jan 2025) (CVE-2025-21525)\n  * mysql: Optimizer unspecified vulnerability (CPU Jan 2025) (CVE-2025-21536)\n  * mysql: Thread Pooling unspecified vulnerability (CPU Jan 2025) (CVE-2025-21521)\n  * mysql: Optimizer unspecified vulnerability (CPU Jan 2025) (CVE-2025-21501)\n  * mysql: Performance Schema unspecified vulnerability (CPU Jan 2025) (CVE-2025-21534)\n  * mysql: Privileges unspecified vulnerability (CPU Jan 2025) (CVE-2025-21494)\n  * mysql: Privileges unspecified vulnerability (CPU Jan 2025) (CVE-2025-21519)\n  * mysql: Parser unspecified vulnerability (CPU Jan 2025) (CVE-2025-21522)\n  * mysql: InnoDB unspecified vulnerability (CPU Jan 2025) (CVE-2025-21503)\n  * mysql: Optimizer unspecified vulnerability (CPU Jan 2025) (CVE-2025-21518)\n  * mysql: MySQL Server InnoDB Denial of Service and Unauthorized Data Modification Vulnerability (CVE-2025-21559)\n  * mysql: Privilege Misuse in MySQL Server Security Component (CVE-2025-21546)\n  * mysql: Optimizer unspecified vulnerability (CPU Jan 2025) (CVE-2025-21500)\n  * mysql: InnoDB unspecified vulnerability (CPU Jan 2025) (CVE-2025-21523)\n  * mysql: Components Services unspecified vulnerability (CPU Jan 2025) (CVE-2025-21505)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2025-02-19T00:00:00Z","modified":"2026-10-29T11:32:28.219181801Z","updated_at":"2026-11-02T15:27:53.448565Z"},{"id":"ALSA-2025:1673","title":"Important: mysql:8.0 security update","description":"MySQL is a multi-user, multi-threaded SQL database server. It consists of the MySQL server daemon (mysqld) and many client programs and libraries.  \n\nSecurity Fix(es):  \n\n  * openssl: SSL_select_next_proto buffer overread (CVE-2024-5535)\n  * krb5: GSS message token handling (CVE-2024-37371)\n  * curl: libcurl: ASN.1 date parser overread (CVE-2024-7264)\n  * mysql: Thread Pooling unspecified vulnerability (CPU Oct 2024) (CVE-2024-21238)\n  * mysql: X Plugin unspecified vulnerability (CPU Oct 2024) (CVE-2024-21196)\n  * mysql: Optimizer unspecified vulnerability (CPU Oct 2024) (CVE-2024-21241)\n  * mysql: Client programs unspecified vulnerability (CPU Oct 2024) (CVE-2024-21231)\n  * mysql: Information Schema unspecified vulnerability (CPU Oct 2024) (CVE-2024-21197)\n  * mysql: InnoDB unspecified vulnerability (CPU Oct 2024) (CVE-2024-21218)\n  * mysql: Optimizer unspecified vulnerability (CPU Oct 2024) (CVE-2024-21201)\n  * mysql: InnoDB unspecified vulnerability (CPU Oct 2024) (CVE-2024-21236)\n  * mysql: Group Replication GCS unspecified vulnerability (CPU Oct 2024) (CVE-2024-21237)\n  * mysql: FTS unspecified vulnerability (CPU Oct 2024) (CVE-2024-21203)\n  * mysql: Health Monitor unspecified vulnerability (CPU Oct 2024) (CVE-2024-21212)\n  * mysql: DML unspecified vulnerability (CPU Oct 2024) (CVE-2024-21219)\n  * mysql: Optimizer unspecified vulnerability (CPU Oct 2024) (CVE-2024-21230)\n  * mysql: InnoDB unspecified vulnerability (CPU Oct 2024) (CVE-2024-21213)\n  * mysql: InnoDB unspecified vulnerability (CPU Oct 2024) (CVE-2024-21194)\n  * mysql: InnoDB unspecified vulnerability (CPU Oct 2024) (CVE-2024-21199)\n  * mysql: PS unspecified vulnerability (CPU Oct 2024) (CVE-2024-21193)\n  * mysql: DDL unspecified vulnerability (CPU Oct 2024) (CVE-2024-21198)\n  * mysql: mysqldump unspecified vulnerability (CPU Oct 2024) (CVE-2024-21247)\n  * mysql: InnoDB unspecified vulnerability (CPU Oct 2024) (CVE-2024-21239)\n  * curl: curl netrc password leak (CVE-2024-11053)\n  * mysql: InnoDB unspecified vulnerability (CPU Jan 2025) (CVE-2025-21497)\n  * mysql: MySQL Server Options Vulnerability (CVE-2025-21520)\n  * mysql: High Privilege Denial of Service Vulnerability in MySQL Server (CVE-2025-21490)\n  * mysql: Information Schema unspecified vulnerability (CPU Jan 2025) (CVE-2025-21529)\n  * mysql: InnoDB unspecified vulnerability (CPU Jan 2025) (CVE-2025-21531)\n  * mysql: Optimizer unspecified vulnerability (CPU Jan 2025) (CVE-2025-21504)\n  * mysql: Privileges unspecified vulnerability (CPU Jan 2025) (CVE-2025-21540)\n  * mysql: MySQL Server InnoDB Denial of Service and Unauthorized Data Modification Vulnerability (CVE-2025-21555)\n  * mysql: Packaging unspecified vulnerability (CPU Jan 2025) (CVE-2025-21543)\n  * mysql: MySQL Server InnoDB Denial of Service and Unauthorized Data Modification Vulnerability (CVE-2025-21491)\n  * mysql: DDL unspecified vulnerability (CPU Jan 2025) (CVE-2025-21525)\n  * mysql: Optimizer unspecified vulnerability (CPU Jan 2025) (CVE-2025-21536)\n  * mysql: Thread Pooling unspecified vulnerability (CPU Jan 2025) (CVE-2025-21521)\n  * mysql: Optimizer unspecified vulnerability (CPU Jan 2025) (CVE-2025-21501)\n  * mysql: Performance Schema unspecified vulnerability (CPU Jan 2025) (CVE-2025-21534)\n  * mysql: Privileges unspecified vulnerability (CPU Jan 2025) (CVE-2025-21494)\n  * mysql: Privileges unspecified vulnerability (CPU Jan 2025) (CVE-2025-21519)\n  * mysql: Parser unspecified vulnerability (CPU Jan 2025) (CVE-2025-21522)\n  * mysql: InnoDB unspecified vulnerability (CPU Jan 2025) (CVE-2025-21503)\n  * mysql: Optimizer unspecified vulnerability (CPU Jan 2025) (CVE-2025-21518)\n  * mysql: MySQL Server InnoDB Denial of Service and Unauthorized Data Modification Vulnerability (CVE-2025-21559)\n  * mysql: Privilege Misuse in MySQL Server Security Component (CVE-2025-21546)\n  * mysql: Optimizer unspecified vulnerability (CPU Jan 2025) (CVE-2025-21500)\n  * mysql: InnoDB unspecified vulnerability (CPU Jan 2025) (CVE-2025-21523)\n  * mysql: Components Services unspecified vulnerability (CPU Jan 2025) (CVE-2025-21505)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2025-02-19T00:00:00Z","modified":"2026-10-29T11:02:22.53965828Z","updated_at":"2026-11-02T15:27:53.448565Z"},{"id":"ALSA-2026:60329","title":"Low: mingw-openssl security update","description":"The OpenSSL toolkit provides support for secure communications between machines. OpenSSL includes a certificate management tool and shared libraries which provide various cryptographic algorithms and protocols. This package contains Windows (MinGW) libraries and development tools.  \n\nSecurity Fix(es):  \n\n  * openssl: SSL_select_next_proto buffer overread (CVE-2024-5535)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-08-26T00:00:00Z","modified":"2026-10-29T11:02:24.988698252Z","updated_at":"2026-11-02T15:27:54.753319Z"},{"id":"AZL-42975","title":"CVE-2024-5535 affecting package openssl for versions less than 3.3.0-2","description":"Issue summary: Calling the OpenSSL API function SSL_select_next_proto with an\nempty supported client protocols buffer may cause a crash or memory contents to\nbe sent to the peer.\n\nImpact summary: A buffer overread can have a range of potential consequences\nsuch as unexpected application beahviour or a crash. In particular this issue\ncould result in up to 255 bytes of arbitrary private data from memory being sent\nto the peer leading to a loss of confidentiality. However, only applications\nthat directly call the SSL_select_next_proto function with a 0 length list of\nsupported client protocols are affected by this issue. This would normally never\nbe a valid scenario and is typically not under attacker control but may occur by\naccident in the case of a configuration or programming error in the calling\napplication.\n\nThe OpenSSL API function SSL_select_next_proto is typically used by TLS\napplications that support ALPN (Application Layer Protocol Negotiation) or NPN\n(Next Protocol Negotiation). NPN is older, was never standardised and\nis deprecated in favour of ALPN. We believe that ALPN is significantly more\nwidely deployed than NPN. The SSL_select_next_proto function accepts a list of\nprotocols from the server and a list of protocols from the client and returns\nthe first protocol that appears in the server list that also appears in the\nclient list. In the case of no overlap between the two lists it returns the\nfirst item in the client list. In either case it will signal whether an overlap\nbetween the two lists was found. In the case where SSL_select_next_proto is\ncalled with a zero length client list it fails to notice this condition and\nreturns the memory immediately following the client list pointer (and reports\nthat there was no overlap in the lists).\n\nThis function is typically called from a server side application callback for\nALPN or a client side application callback for NPN. In the case of ALPN the list\nof protocols supplied by the client is guaranteed by libssl to never be zero in\nlength. The list of server protocols comes from the application and should never\nnormally be expected to be of zero length. In this case if the\nSSL_select_next_proto function has been called as expected (with the list\nsupplied by the client passed in the client/client_len parameters), then the\napplication will not be vulnerable to this issue. If the application has\naccidentally been configured with a zero length server list, and has\naccidentally passed that zero length server list in the client/client_len\nparameters, and has additionally failed to correctly handle a \"no overlap\"\nresponse (which would normally result in a handshake failure in ALPN) then it\nwill be vulnerable to this problem.\n\nIn the case of NPN, the protocol permits the client to opportunistically select\na protocol when there is no overlap. OpenSSL returns the first client protocol\nin the no overlap case in support of this. The list of client protocols comes\nfrom the application and should never normally be expected to be of zero length.\nHowever if the SSL_select_next_proto function is accidentally called with a\nclient_len of 0 then an invalid memory pointer will be returned instead. If the\napplication uses this output as the opportunistic protocol then the loss of\nconfidentiality will occur.\n\nThis issue has been assessed as Low severity because applications are most\nlikely to be vulnerable if they are using NPN instead of ALPN - but NPN is not\nwidely used. It also requires an application configuration or programming error.\nFinally, this issue would not typically be under attacker control making active\nexploitation unlikely.\n\nThe FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue.\n\nDue to the low severity of this issue we are not issuing new releases of\nOpenSSL at this time. The fix will be included in the next releases when they\nbecome available.","status":"published","published":"2024-06-27T11:15:24Z","modified":"2026-04-21T04:56:38.283102Z","updated_at":"2026-11-02T15:28:04.893995Z"},{"id":"AZL-42988","title":"CVE-2024-5535 affecting package cloud-hypervisor-cvm for versions less than 38.0.72.2-3","description":"Issue summary: Calling the OpenSSL API function SSL_select_next_proto with an\nempty supported client protocols buffer may cause a crash or memory contents to\nbe sent to the peer.\n\nImpact summary: A buffer overread can have a range of potential consequences\nsuch as unexpected application beahviour or a crash. In particular this issue\ncould result in up to 255 bytes of arbitrary private data from memory being sent\nto the peer leading to a loss of confidentiality. However, only applications\nthat directly call the SSL_select_next_proto function with a 0 length list of\nsupported client protocols are affected by this issue. This would normally never\nbe a valid scenario and is typically not under attacker control but may occur by\naccident in the case of a configuration or programming error in the calling\napplication.\n\nThe OpenSSL API function SSL_select_next_proto is typically used by TLS\napplications that support ALPN (Application Layer Protocol Negotiation) or NPN\n(Next Protocol Negotiation). NPN is older, was never standardised and\nis deprecated in favour of ALPN. We believe that ALPN is significantly more\nwidely deployed than NPN. The SSL_select_next_proto function accepts a list of\nprotocols from the server and a list of protocols from the client and returns\nthe first protocol that appears in the server list that also appears in the\nclient list. In the case of no overlap between the two lists it returns the\nfirst item in the client list. In either case it will signal whether an overlap\nbetween the two lists was found. In the case where SSL_select_next_proto is\ncalled with a zero length client list it fails to notice this condition and\nreturns the memory immediately following the client list pointer (and reports\nthat there was no overlap in the lists).\n\nThis function is typically called from a server side application callback for\nALPN or a client side application callback for NPN. In the case of ALPN the list\nof protocols supplied by the client is guaranteed by libssl to never be zero in\nlength. The list of server protocols comes from the application and should never\nnormally be expected to be of zero length. In this case if the\nSSL_select_next_proto function has been called as expected (with the list\nsupplied by the client passed in the client/client_len parameters), then the\napplication will not be vulnerable to this issue. If the application has\naccidentally been configured with a zero length server list, and has\naccidentally passed that zero length server list in the client/client_len\nparameters, and has additionally failed to correctly handle a \"no overlap\"\nresponse (which would normally result in a handshake failure in ALPN) then it\nwill be vulnerable to this problem.\n\nIn the case of NPN, the protocol permits the client to opportunistically select\na protocol when there is no overlap. OpenSSL returns the first client protocol\nin the no overlap case in support of this. The list of client protocols comes\nfrom the application and should never normally be expected to be of zero length.\nHowever if the SSL_select_next_proto function is accidentally called with a\nclient_len of 0 then an invalid memory pointer will be returned instead. If the\napplication uses this output as the opportunistic protocol then the loss of\nconfidentiality will occur.\n\nThis issue has been assessed as Low severity because applications are most\nlikely to be vulnerable if they are using NPN instead of ALPN - but NPN is not\nwidely used. It also requires an application configuration or programming error.\nFinally, this issue would not typically be under attacker control making active\nexploitation unlikely.\n\nThe FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue.\n\nDue to the low severity of this issue we are not issuing new releases of\nOpenSSL at this time. The fix will be included in the next releases when they\nbecome available.","status":"published","published":"2024-06-27T11:15:24Z","modified":"2026-04-21T04:30:50.898285Z","updated_at":"2026-11-02T15:28:04.893995Z"},{"id":"AZL-43309","title":"CVE-2024-5535 affecting package openssl for versions less than 1.1.1k-33","description":"Issue summary: Calling the OpenSSL API function SSL_select_next_proto with an\nempty supported client protocols buffer may cause a crash or memory contents to\nbe sent to the peer.\n\nImpact summary: A buffer overread can have a range of potential consequences\nsuch as unexpected application beahviour or a crash. In particular this issue\ncould result in up to 255 bytes of arbitrary private data from memory being sent\nto the peer leading to a loss of confidentiality. However, only applications\nthat directly call the SSL_select_next_proto function with a 0 length list of\nsupported client protocols are affected by this issue. This would normally never\nbe a valid scenario and is typically not under attacker control but may occur by\naccident in the case of a configuration or programming error in the calling\napplication.\n\nThe OpenSSL API function SSL_select_next_proto is typically used by TLS\napplications that support ALPN (Application Layer Protocol Negotiation) or NPN\n(Next Protocol Negotiation). NPN is older, was never standardised and\nis deprecated in favour of ALPN. We believe that ALPN is significantly more\nwidely deployed than NPN. The SSL_select_next_proto function accepts a list of\nprotocols from the server and a list of protocols from the client and returns\nthe first protocol that appears in the server list that also appears in the\nclient list. In the case of no overlap between the two lists it returns the\nfirst item in the client list. In either case it will signal whether an overlap\nbetween the two lists was found. In the case where SSL_select_next_proto is\ncalled with a zero length client list it fails to notice this condition and\nreturns the memory immediately following the client list pointer (and reports\nthat there was no overlap in the lists).\n\nThis function is typically called from a server side application callback for\nALPN or a client side application callback for NPN. In the case of ALPN the list\nof protocols supplied by the client is guaranteed by libssl to never be zero in\nlength. The list of server protocols comes from the application and should never\nnormally be expected to be of zero length. In this case if the\nSSL_select_next_proto function has been called as expected (with the list\nsupplied by the client passed in the client/client_len parameters), then the\napplication will not be vulnerable to this issue. If the application has\naccidentally been configured with a zero length server list, and has\naccidentally passed that zero length server list in the client/client_len\nparameters, and has additionally failed to correctly handle a \"no overlap\"\nresponse (which would normally result in a handshake failure in ALPN) then it\nwill be vulnerable to this problem.\n\nIn the case of NPN, the protocol permits the client to opportunistically select\na protocol when there is no overlap. OpenSSL returns the first client protocol\nin the no overlap case in support of this. The list of client protocols comes\nfrom the application and should never normally be expected to be of zero length.\nHowever if the SSL_select_next_proto function is accidentally called with a\nclient_len of 0 then an invalid memory pointer will be returned instead. If the\napplication uses this output as the opportunistic protocol then the loss of\nconfidentiality will occur.\n\nThis issue has been assessed as Low severity because applications are most\nlikely to be vulnerable if they are using NPN instead of ALPN - but NPN is not\nwidely used. It also requires an application configuration or programming error.\nFinally, this issue would not typically be under attacker control making active\nexploitation unlikely.\n\nThe FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue.\n\nDue to the low severity of this issue we are not issuing new releases of\nOpenSSL at this time. The fix will be included in the next releases when they\nbecome available.","status":"published","published":"2024-06-27T11:15:24Z","modified":"2026-04-21T04:30:57.020303Z","updated_at":"2026-11-02T15:28:05.284713Z"},{"id":"AZL-47733","title":"CVE-2024-5535 affecting package hvloader for versions less than 1.0.1-6","description":"Issue summary: Calling the OpenSSL API function SSL_select_next_proto with an\nempty supported client protocols buffer may cause a crash or memory contents to\nbe sent to the peer.\n\nImpact summary: A buffer overread can have a range of potential consequences\nsuch as unexpected application beahviour or a crash. In particular this issue\ncould result in up to 255 bytes of arbitrary private data from memory being sent\nto the peer leading to a loss of confidentiality. However, only applications\nthat directly call the SSL_select_next_proto function with a 0 length list of\nsupported client protocols are affected by this issue. This would normally never\nbe a valid scenario and is typically not under attacker control but may occur by\naccident in the case of a configuration or programming error in the calling\napplication.\n\nThe OpenSSL API function SSL_select_next_proto is typically used by TLS\napplications that support ALPN (Application Layer Protocol Negotiation) or NPN\n(Next Protocol Negotiation). NPN is older, was never standardised and\nis deprecated in favour of ALPN. We believe that ALPN is significantly more\nwidely deployed than NPN. The SSL_select_next_proto function accepts a list of\nprotocols from the server and a list of protocols from the client and returns\nthe first protocol that appears in the server list that also appears in the\nclient list. In the case of no overlap between the two lists it returns the\nfirst item in the client list. In either case it will signal whether an overlap\nbetween the two lists was found. In the case where SSL_select_next_proto is\ncalled with a zero length client list it fails to notice this condition and\nreturns the memory immediately following the client list pointer (and reports\nthat there was no overlap in the lists).\n\nThis function is typically called from a server side application callback for\nALPN or a client side application callback for NPN. In the case of ALPN the list\nof protocols supplied by the client is guaranteed by libssl to never be zero in\nlength. The list of server protocols comes from the application and should never\nnormally be expected to be of zero length. In this case if the\nSSL_select_next_proto function has been called as expected (with the list\nsupplied by the client passed in the client/client_len parameters), then the\napplication will not be vulnerable to this issue. If the application has\naccidentally been configured with a zero length server list, and has\naccidentally passed that zero length server list in the client/client_len\nparameters, and has additionally failed to correctly handle a \"no overlap\"\nresponse (which would normally result in a handshake failure in ALPN) then it\nwill be vulnerable to this problem.\n\nIn the case of NPN, the protocol permits the client to opportunistically select\na protocol when there is no overlap. OpenSSL returns the first client protocol\nin the no overlap case in support of this. The list of client protocols comes\nfrom the application and should never normally be expected to be of zero length.\nHowever if the SSL_select_next_proto function is accidentally called with a\nclient_len of 0 then an invalid memory pointer will be returned instead. If the\napplication uses this output as the opportunistic protocol then the loss of\nconfidentiality will occur.\n\nThis issue has been assessed as Low severity because applications are most\nlikely to be vulnerable if they are using NPN instead of ALPN - but NPN is not\nwidely used. It also requires an application configuration or programming error.\nFinally, this issue would not typically be under attacker control making active\nexploitation unlikely.\n\nThe FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue.\n\nDue to the low severity of this issue we are not issuing new releases of\nOpenSSL at this time. The fix will be included in the next releases when they\nbecome available.","status":"published","published":"2024-06-27T11:15:24Z","modified":"2026-04-21T04:32:59.015674Z","updated_at":"2026-11-02T15:28:05.694722Z"},{"id":"AZL-78567","title":"CVE-2024-5535 affecting package openssl-fips-provider 3.1.2-2","description":"Issue summary: Calling the OpenSSL API function SSL_select_next_proto with an\nempty supported client protocols buffer may cause a crash or memory contents to\nbe sent to the peer.\n\nImpact summary: A buffer overread can have a range of potential consequences\nsuch as unexpected application beahviour or a crash. In particular this issue\ncould result in up to 255 bytes of arbitrary private data from memory being sent\nto the peer leading to a loss of confidentiality. However, only applications\nthat directly call the SSL_select_next_proto function with a 0 length list of\nsupported client protocols are affected by this issue. This would normally never\nbe a valid scenario and is typically not under attacker control but may occur by\naccident in the case of a configuration or programming error in the calling\napplication.\n\nThe OpenSSL API function SSL_select_next_proto is typically used by TLS\napplications that support ALPN (Application Layer Protocol Negotiation) or NPN\n(Next Protocol Negotiation). NPN is older, was never standardised and\nis deprecated in favour of ALPN. We believe that ALPN is significantly more\nwidely deployed than NPN. The SSL_select_next_proto function accepts a list of\nprotocols from the server and a list of protocols from the client and returns\nthe first protocol that appears in the server list that also appears in the\nclient list. In the case of no overlap between the two lists it returns the\nfirst item in the client list. In either case it will signal whether an overlap\nbetween the two lists was found. In the case where SSL_select_next_proto is\ncalled with a zero length client list it fails to notice this condition and\nreturns the memory immediately following the client list pointer (and reports\nthat there was no overlap in the lists).\n\nThis function is typically called from a server side application callback for\nALPN or a client side application callback for NPN. In the case of ALPN the list\nof protocols supplied by the client is guaranteed by libssl to never be zero in\nlength. The list of server protocols comes from the application and should never\nnormally be expected to be of zero length. In this case if the\nSSL_select_next_proto function has been called as expected (with the list\nsupplied by the client passed in the client/client_len parameters), then the\napplication will not be vulnerable to this issue. If the application has\naccidentally been configured with a zero length server list, and has\naccidentally passed that zero length server list in the client/client_len\nparameters, and has additionally failed to correctly handle a \"no overlap\"\nresponse (which would normally result in a handshake failure in ALPN) then it\nwill be vulnerable to this problem.\n\nIn the case of NPN, the protocol permits the client to opportunistically select\na protocol when there is no overlap. OpenSSL returns the first client protocol\nin the no overlap case in support of this. The list of client protocols comes\nfrom the application and should never normally be expected to be of zero length.\nHowever if the SSL_select_next_proto function is accidentally called with a\nclient_len of 0 then an invalid memory pointer will be returned instead. If the\napplication uses this output as the opportunistic protocol then the loss of\nconfidentiality will occur.\n\nThis issue has been assessed as Low severity because applications are most\nlikely to be vulnerable if they are using NPN instead of ALPN - but NPN is not\nwidely used. It also requires an application configuration or programming error.\nFinally, this issue would not typically be under attacker control making active\nexploitation unlikely.\n\nThe FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue.\n\nDue to the low severity of this issue we are not issuing new releases of\nOpenSSL at this time. The fix will be included in the next releases when they\nbecome available.","status":"published","published":"2024-06-27T11:15:24Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:24.626116Z"},{"id":"CLSA-2024-1730801286","title":"openssl: Fix of CVE-2024-5535","description":"- CVE-2024-5535: Validate provided client list in ssl/ssl_lib.c. Clarify\n  SSL_select_next_proto documentation","status":"published","published":"2024-11-05T10:08:11Z","modified":"2026-06-01T00:33:11.926814717Z","updated_at":"2026-11-02T15:43:41.281406Z"},{"id":"CLSA-2024-1730801437","title":"openssl: Fix of CVE-2024-5535","description":"- CVE-2024-5535: Validate provided client list in ssl/ssl_lib.c. Clarify\n  SSL_select_next_proto documentation","status":"published","published":"2024-11-05T10:10:43Z","modified":"2026-06-01T00:33:22.769369309Z","updated_at":"2026-11-02T15:43:41.281406Z"},{"id":"CLSA-2024-1731344946","title":"openssl: Fix of CVE-2024-5535","description":"- CVE-2024-5535: Validate provided client list in ssl/ssl_lib.c. Clarify\n  SSL_select_next_proto documentation","status":"published","published":"2024-11-11T17:09:12Z","modified":"2026-06-01T00:32:56.81955655Z","updated_at":"2026-11-02T15:43:41.281406Z"},{"id":"CLSA-2025-1740823577","title":"mysql: Fix of 49 CVEs","description":"- Update to MySQL 8.0.41\n- CVEs fixed:\n  CVE-2024-5535  CVE-2024-7264  CVE-2024-11053 CVE-2024-21193 CVE-2024-21194\n  CVE-2024-21196 CVE-2024-21197 CVE-2024-21198 CVE-2024-21199 CVE-2024-21201\n  CVE-2024-21203 CVE-2024-21212 CVE-2024-21213 CVE-2024-21218 CVE-2024-21219\n  CVE-2024-21230 CVE-2024-21231 CVE-2024-21236 CVE-2024-21237 CVE-2024-21238\n  CVE-2024-21239 CVE-2024-21241 CVE-2024-21247 CVE-2024-37371 CVE-2025-21490\n  CVE-2025-21491 CVE-2025-21494 CVE-2025-21497 CVE-2025-21500 CVE-2025-21501\n  CVE-2025-21503 CVE-2025-21504 CVE-2025-21505 CVE-2025-21518 CVE-2025-21519\n  CVE-2025-21520 CVE-2025-21521 CVE-2025-21522 CVE-2025-21523 CVE-2025-21525\n  CVE-2025-21529 CVE-2025-21531 CVE-2025-21534 CVE-2025-21536 CVE-2025-21540\n  CVE-2025-21543 CVE-2025-21546 CVE-2025-21555 CVE-2025-21559\n- Rebase mysql-mtr.patch\n- Remove mysql-fix-includes-robin-hood.patch\n- Rebase mysql-increase-wait-until-connect-timeout.patch","status":"published","published":"2025-03-01T10:06:22Z","modified":"2026-10-21T10:46:37.056054892Z","updated_at":"2026-11-02T15:43:41.66212Z"},{"id":"CLSA-2025-1740824456","title":"mysql: Fix of 49 CVEs","description":"- Update to MySQL 8.0.41\n- CVEs fixed:\n  CVE-2024-5535  CVE-2024-7264  CVE-2024-11053 CVE-2024-21193 CVE-2024-21194\n  CVE-2024-21196 CVE-2024-21197 CVE-2024-21198 CVE-2024-21199 CVE-2024-21201\n  CVE-2024-21203 CVE-2024-21212 CVE-2024-21213 CVE-2024-21218 CVE-2024-21219\n  CVE-2024-21230 CVE-2024-21231 CVE-2024-21236 CVE-2024-21237 CVE-2024-21238\n  CVE-2024-21239 CVE-2024-21241 CVE-2024-21247 CVE-2024-37371 CVE-2025-21490\n  CVE-2025-21491 CVE-2025-21494 CVE-2025-21497 CVE-2025-21500 CVE-2025-21501\n  CVE-2025-21503 CVE-2025-21504 CVE-2025-21505 CVE-2025-21518 CVE-2025-21519\n  CVE-2025-21520 CVE-2025-21521 CVE-2025-21522 CVE-2025-21523 CVE-2025-21525\n  CVE-2025-21529 CVE-2025-21531 CVE-2025-21534 CVE-2025-21536 CVE-2025-21540\n  CVE-2025-21543 CVE-2025-21546 CVE-2025-21555 CVE-2025-21559\n- Rebase mysql-mtr.patch\n- Remove mysql-fix-includes-robin-hood.patch\n- Rebase mysql-increase-wait-until-connect-timeout.patch","status":"published","published":"2025-03-01T10:21:01Z","modified":"2026-10-21T10:48:07.933249858Z","updated_at":"2026-11-02T15:43:41.66212Z"},{"id":"CLSA-2025-1741074282","title":"mysql: Fix of 49 CVEs","description":"- Update to MySQL 8.0.41\n- CVEs fixed:\n  CVE-2024-5535  CVE-2024-7264  CVE-2024-11053 CVE-2024-21193 CVE-2024-21194\n  CVE-2024-21196 CVE-2024-21197 CVE-2024-21198 CVE-2024-21199 CVE-2024-21201\n  CVE-2024-21203 CVE-2024-21212 CVE-2024-21213 CVE-2024-21218 CVE-2024-21219\n  CVE-2024-21230 CVE-2024-21231 CVE-2024-21236 CVE-2024-21237 CVE-2024-21238\n  CVE-2024-21239 CVE-2024-21241 CVE-2024-21247 CVE-2024-37371 CVE-2025-21490\n  CVE-2025-21491 CVE-2025-21494 CVE-2025-21497 CVE-2025-21500 CVE-2025-21501\n  CVE-2025-21503 CVE-2025-21504 CVE-2025-21505 CVE-2025-21518 CVE-2025-21519\n  CVE-2025-21520 CVE-2025-21521 CVE-2025-21522 CVE-2025-21523 CVE-2025-21525\n  CVE-2025-21529 CVE-2025-21531 CVE-2025-21534 CVE-2025-21536 CVE-2025-21540\n  CVE-2025-21543 CVE-2025-21546 CVE-2025-21555 CVE-2025-21559\n- Rebase mysql-mtr.patch\n- Remove mysql-fix-includes-robin-hood.patch\n- Rebase mysql-increase-wait-until-connect-timeout.patch","status":"published","published":"2025-03-04T08:12:55Z","modified":"2026-10-21T10:45:47.716605506Z","updated_at":"2026-11-02T15:43:41.66212Z"},{"id":"CLSA-2026-1780682107","title":"openssl11: Fix of 10 CVEs","description":"- CVE-2021-3711: fix SM2 decryption buffer overflow; check the plaintext buffer\n  is large enough when decrypting SM2; add extended tests for SM2\n- CVE-2022-3996: fix X.509 policy constraints double-locking denial of service\n- CVE-2023-0464: fix excessive resource use verifying X.509 policy constraints\n- CVE-2023-0466: fix X509_VERIFY_PARAM_add0_policy() does not enable policy check\n- CVE-2023-2650: restrict the size of OBJECT IDENTIFIERs that OBJ_obj2txt translates\n- CVE-2024-13176: fix timing side-channel in ECDSA signature computation\n- CVE-2024-5535: validate provided client list in SSL_select_next_proto\n- CVE-2025-9230: fix out-of-bounds read and write in RFC 3211 KEK unwrap\n- CVE-2025-69419: fix one-byte write-before-buffer in PKCS#12 BMPString conversion\n- CVE-2025-69421: fix NULL dereference in PKCS12_item_decrypt_d2i_ex()\n- CVE-2026-28387: fix use-after-free / double-free in dane_match()\n- CVE-2026-28388: fix NULL dereference in check_delta_base()\n- CVE-2026-28389: fix NULL dereference in dh/ecdh_cms_set_shared_info()\n- CVE-2026-28390: fix NULL dereference in rsa_cms_decrypt()","status":"published","published":"2026-10-19T20:44:42Z","modified":"2026-10-26T09:43:19.372450535Z","updated_at":"2026-11-02T15:43:45.445699Z"},{"id":"CLSA-2026-1780682108","title":"openssl11: Fix of 10 CVEs","description":"- CVE-2021-3711: fix SM2 decryption buffer overflow; check the plaintext buffer\n  is large enough when decrypting SM2; add extended tests for SM2\n- CVE-2022-3996: fix X.509 policy constraints double-locking denial of service\n- CVE-2023-0464: fix excessive resource use verifying X.509 policy constraints\n- CVE-2023-0466: fix X509_VERIFY_PARAM_add0_policy() does not enable policy check\n- CVE-2023-2650: restrict the size of OBJECT IDENTIFIERs that OBJ_obj2txt translates\n- CVE-2024-13176: fix timing side-channel in ECDSA signature computation\n- CVE-2024-5535: validate provided client list in SSL_select_next_proto\n- CVE-2025-9230: fix out-of-bounds read and write in RFC 3211 KEK unwrap\n- CVE-2025-69419: fix one-byte write-before-buffer in PKCS#12 BMPString conversion\n- CVE-2025-69421: fix NULL dereference in PKCS12_item_decrypt_d2i_ex()\n- CVE-2026-28387: fix use-after-free / double-free in dane_match()\n- CVE-2026-28388: fix NULL dereference in check_delta_base()\n- CVE-2026-28389: fix NULL dereference in dh/ecdh_cms_set_shared_info()\n- CVE-2026-28390: fix NULL dereference in rsa_cms_decrypt()","status":"published","published":"2026-10-19T20:30:57Z","modified":"2026-10-26T09:43:24.553701582Z","updated_at":"2026-11-02T15:43:45.445699Z"},{"id":"CLSA-2026-1780683040","title":"openssl11: Fix of 10 CVEs","description":"- CVE-2021-3711: fix SM2 decryption buffer overflow; check the plaintext buffer\n  is large enough when decrypting SM2; add extended tests for SM2\n- CVE-2022-3996: fix X.509 policy constraints double-locking denial of service\n- CVE-2023-0464: fix excessive resource use verifying X.509 policy constraints\n- CVE-2023-0466: fix X509_VERIFY_PARAM_add0_policy() does not enable policy check\n- CVE-2023-2650: restrict the size of OBJECT IDENTIFIERs that OBJ_obj2txt translates\n- CVE-2024-13176: fix timing side-channel in ECDSA signature computation\n- CVE-2024-5535: validate provided client list in SSL_select_next_proto\n- CVE-2025-9230: fix out-of-bounds read and write in RFC 3211 KEK unwrap\n- CVE-2025-69419: fix one-byte write-before-buffer in PKCS#12 BMPString conversion\n- CVE-2025-69421: fix NULL dereference in PKCS12_item_decrypt_d2i_ex()\n- CVE-2026-28387: fix use-after-free / double-free in dane_match()\n- CVE-2026-28388: fix NULL dereference in check_delta_base()\n- CVE-2026-28389: fix NULL dereference in dh/ecdh_cms_set_shared_info()\n- CVE-2026-28390: fix NULL dereference in rsa_cms_decrypt()","status":"published","published":"2026-10-19T20:23:13Z","modified":"2026-10-26T09:43:24.002329629Z","updated_at":"2026-11-02T15:43:45.445699Z"},{"id":"DLA-3942-1","title":"openssl - security update","status":"published","published":"2024-10-31T00:00:00Z","modified":"2026-03-09T01:22:40.686044Z","updated_at":"2026-11-02T15:46:12.203458Z"},{"id":"DLA-3942-2","title":"openssl - regression update","status":"published","published":"2024-11-03T00:00:00Z","modified":"2026-03-09T01:21:01.72873Z","updated_at":"2026-11-02T15:46:12.203458Z"},{"id":"MGASA-2024-0247","title":"Updated openssl packages fix security vulnerability","description":"SSL_select_next_proto buffer overread. (CVE-2024-5535)\n","status":"published","published":"2024-07-01T17:53:27Z","modified":"2026-04-16T04:43:46.726279154Z","updated_at":"2026-11-02T15:49:42.684501Z"},{"id":"MGASA-2024-0281","title":"Updated quictls packages fix security vulnerabilities","description":"The updated packages fix security vulnerabilities\n","status":"published","published":"2024-08-19T19:12:14Z","modified":"2026-04-16T04:44:06.33061675Z","updated_at":"2026-11-02T15:49:42.684501Z"},{"id":"MGASA-2024-0330","title":"Updated quictls packages fix security vulnerabilities","description":"The updated packages fix security vulnerabilities\n","status":"published","published":"2024-10-11T00:59:30Z","modified":"2026-04-16T04:42:27.21166108Z","updated_at":"2026-11-02T15:49:42.684501Z"},{"id":"openSUSE-SU-2024:14219-1","title":"libopenssl-1_1-devel-1.1.1w-11.1 on GA media","description":"These are all security issues fixed in the libopenssl-1_1-devel-1.1.1w-11.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-07-26T00:00:00Z","modified":"2026-02-04T03:28:41.413304Z","updated_at":"2026-11-02T16:58:36.662953Z"},{"id":"openSUSE-SU-2024:14220-1","title":"libopenssl-3-devel-3.1.4-11.1 on GA media","description":"These are all security issues fixed in the libopenssl-3-devel-3.1.4-11.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-07-26T00:00:00Z","modified":"2026-02-04T02:44:51.835928Z","updated_at":"2026-11-02T16:58:36.662953Z"},{"id":"RLSA-2024:7848","title":"Low: openssl security update","description":"OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library.\n\nSecurity Fix(es):\n\n* openssl: SSL_select_next_proto buffer overread (CVE-2024-5535)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2024-10-25T17:16:09.329776Z","modified":"2026-02-04T10:15:06.633585Z","updated_at":"2026-11-02T15:53:24.923365Z"}]},"sources_more":{"osv":18}}