{"id":"CVE-2026-28390","aliases":["ALPINE-CVE-2026-28390","ALSA-2026:22312","ALSA-2026:22313","ALSA-2026:22314","ALSA-2026:22315","ALSA-2026:38503","ALSA-2026:39297","AZL-82070","AZL-82106","AZL-82208","BELL-CVE-2026-28390","CLSA-2026-1777297012","CLSA-2026-1777393624","CLSA-2026-1777396609","CLSA-2026-1777397374","CLSA-2026-1777541792","CLSA-2026-1777566580","CLSA-2026-1777567181","CLSA-2026-1777567430","CLSA-2026-1777999127","CLSA-2026-1780682107","CLSA-2026-1780682108","CLSA-2026-1780683040","CLSA-2026-1780710220","CLSA-2026-1781165688","DEBIAN-CVE-2026-28390","EUVD-2026-19966","GHSA-fgpp-q3px-3xhc","JLSEC-2026-275","MGASA-2026-0091","OESA-2026-2041","OESA-2026-2042","OESA-2026-2043","OESA-2026-2044","OESA-2026-2045","OESA-2026-2189","OESA-2026-2190","OESA-2026-2191","OESA-2026-2619","OESA-2026-2622","RHSA-2026:14217","RHSA-2026:22312","RHSA-2026:22313","RHSA-2026:22314","RHSA-2026:22315","RHSA-2026:35869","RHSA-2026:36217","RHSA-2026:38503","RHSA-2026:38804","RHSA-2026:38805","RHSA-2026:39009","RHSA-2026:39012","RHSA-2026:39297","RHSA-2026:43513","RHSA-2026:44480","RHSA-2026:47096","RHSA-2026:58563","RHSA-2026:71542","RHSA-2026:7261","RHSA-2026:83617","RHSA-2026:84572","RHSA-2026:84573","RLSA-2026:22312","RLSA-2026:22313","RLSA-2026:22314","RLSA-2026:22315","RLSA-2026:38503","RLSA-2026:39297","ROOT-OS-ALPINE-315-CVE-2026-28390","ROOT-OS-ALPINE-317-CVE-2026-28390","SUSE-SU-2026:1375-1","SUSE-SU-2026:1386-1","SUSE-SU-2026:1429-1","SUSE-SU-2026:1549-1","SUSE-SU-2026:1550-1","SUSE-SU-2026:1562-1","SUSE-SU-2026:1577-1","SUSE-SU-2026:1605-1","SUSE-SU-2026:1711-1","SUSE-SU-2026:21107-1","SUSE-SU-2026:21186-1","SUSE-SU-2026:21244-1","SUSE-SU-2026:22132-1","SUSE-SU-2026:3272-1","SUSE-SU-2026:3443-1","UBUNTU-CVE-2026-28390","openSUSE-SU-2026:10533-1","openSUSE-SU-2026:20525-1"],"status":"published","title":"Possible NULL Dereference When Processing CMS KeyTransportRecipientInfo","description":"Issue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyTransportRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyTransportRecipientInfo with\nRSA-OAEP encryption is processed, the optional parameters field of\nRSA-OAEP SourceFunc algorithm identifier is examined without checking\nfor its presence. This results in a NULL pointer dereference if the field\nis missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.00836,"percentile":0.58159,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-476"],"published":"2026-04-07T00:00:00Z","modified":"2026-11-05T05:40:51Z","fixes":[{"ecosystem":"Alpine:v3.20","package":"openssl","fixed_in":["3.3.7-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"openssl","fixed_in":["3.3.7-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"openssl","fixed_in":["3.5.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"openssl","fixed_in":["3.5.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"openssl","fixed_in":["3.5.6-r0"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"compat-openssl11","fixed_in":["1:1.1.1k-5.el9_8.3"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"openssl","fixed_in":["1:3.5.5-3.el10_2.alma.1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"openssl-devel","fixed_in":["1:3.5.5-3.el10_2.alma.1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"openssl-libs","fixed_in":["1:3.5.5-3.el10_2.alma.1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"openssl-perl","fixed_in":["1:3.5.5-3.el10_2.alma.1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"compat-openssl10","fixed_in":["1:1.0.2o-4.el8_10.2"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"openssl","fixed_in":["1:1.1.1k-17.el8_6"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"openssl-devel","fixed_in":["1:1.1.1k-17.el8_6"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"openssl-libs","fixed_in":["1:1.1.1k-17.el8_6"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"openssl-perl","fixed_in":["1:1.1.1k-17.el8_6"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"openssl","fixed_in":["3.3.5-5"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"edk2","fixed_in":["20240524git3e722403cd16-16"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"openssl","fixed_in":["3.0.20-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"openssl","fixed_in":["3.5.6-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"openssl","fixed_in":["3.5.6-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:23","package":"openssl","fixed_in":["3.0.20-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:25","package":"openssl","fixed_in":["3.5.6-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:stream","package":"openssl","fixed_in":["3.5.6-r0"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"libssl-dev","fixed_in":["1.0.2g-1ubuntu4.21+tuxcare.els14"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"libssl-doc","fixed_in":["1.0.2g-1ubuntu4.21+tuxcare.els14"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"libssl1.0.0","fixed_in":["1.0.2g-1ubuntu4.21+tuxcare.els14"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"openssl","fixed_in":["1.0.2g-1ubuntu4.21+tuxcare.els14"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:20.04","package":"libssl-dev","fixed_in":["1.1.1f-1ubuntu2.24+tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:20.04","package":"libssl-doc","fixed_in":["1.1.1f-1ubuntu2.24+tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:20.04","package":"libssl1.1","fixed_in":["1.1.1f-1ubuntu2.24+tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:20.04","package":"openssl","fixed_in":["1.1.1f-1ubuntu2.24+tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"libssl-dev","fixed_in":["1.1.1-1ubuntu2.1~18.04.23+tuxcare.els8"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"libssl-doc","fixed_in":["1.1.1-1ubuntu2.1~18.04.23+tuxcare.els8"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"libssl1.1","fixed_in":["1.1.1-1ubuntu2.1~18.04.23+tuxcare.els8"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"openssl","fixed_in":["1.1.1-1ubuntu2.1~18.04.23+tuxcare.els8"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:7","package":"openssl","fixed_in":["1:1.0.2k-26.el7_9.tuxcare.els9"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:7","package":"openssl-devel","fixed_in":["1:1.0.2k-26.el7_9.tuxcare.els9"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:7","package":"openssl-libs","fixed_in":["1:1.0.2k-26.el7_9.tuxcare.els9"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:7","package":"openssl-perl","fixed_in":["1:1.0.2k-26.el7_9.tuxcare.els9"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:7","package":"openssl-static","fixed_in":["1:1.0.2k-26.el7_9.tuxcare.els9"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:7","package":"openssl","fixed_in":["1:1.0.2k-26.el7_9.tuxcare.els9"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:7","package":"openssl-devel","fixed_in":["1:1.0.2k-26.el7_9.tuxcare.els9"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:7","package":"openssl-libs","fixed_in":["1:1.0.2k-26.el7_9.tuxcare.els9"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:7","package":"openssl-perl","fixed_in":["1:1.0.2k-26.el7_9.tuxcare.els9"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:7","package":"openssl-static","fixed_in":["1:1.0.2k-26.el7_9.tuxcare.els9"],"sources":["osv"]},{"ecosystem":"TuxCare:RHEL:7","package":"openssl","fixed_in":["1:1.0.2k-26.el7_9.tuxcare.els9"],"sources":["osv"]},{"ecosystem":"TuxCare:RHEL:7","package":"openssl-devel","fixed_in":["1:1.0.2k-26.el7_9.tuxcare.els9"],"sources":["osv"]},{"ecosystem":"TuxCare:RHEL:7","package":"openssl-libs","fixed_in":["1:1.0.2k-26.el7_9.tuxcare.els9"],"sources":["osv"]},{"ecosystem":"TuxCare:RHEL:7","package":"openssl-perl","fixed_in":["1:1.0.2k-26.el7_9.tuxcare.els9"],"sources":["osv"]},{"ecosystem":"TuxCare:RHEL:7","package":"openssl-static","fixed_in":["1:1.0.2k-26.el7_9.tuxcare.els9"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"compat-openssl11","fixed_in":["1:1.1.1k-5.el9_6.1.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"compat-openssl11","fixed_in":["1:1.1.1k-4.el9_0.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"openssl","fixed_in":["3.0.19-1~deb12u2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"openssl","fixed_in":["3.5.5-1~deb13u2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"openssl","fixed_in":["3.6.2-1"],"sources":["osv"]},{"ecosystem":"Julia","package":"AppBundler","fixed_in":["1.0.1"],"sources":["osv"]},{"ecosystem":"Julia","package":"OpenSSL_jll","fixed_in":["3.0.20+0","3.5.6+0"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"openssl","fixed_in":["0:3.5.6-0.3.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"openssl-config-fips","fixed_in":["0:3.5.6-0.3.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"openssl-devel","fixed_in":["0:3.5.6-0.3.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"openssl-devel-engine","fixed_in":["0:3.5.6-0.3.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"openssl-fips-provider-upstream","fixed_in":["0:3.5.6-0.3.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"openssl-libs","fixed_in":["0:3.5.6-0.3.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"openssl-perl","fixed_in":["0:3.5.6-0.3.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"compat-openssl11","fixed_in":["1:1.1.1k-5.el9_8.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"compat-openssl11-debuginfo","fixed_in":["1:1.1.1k-5.el9_8.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"compat-openssl11-debugsource","fixed_in":["1:1.1.1k-5.el9_8.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"openssl-debuginfo","fixed_in":["1:3.5.5-3.el10_2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"openssl-debugsource","fixed_in":["1:3.5.5-3.el10_2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"openssl-devel","fixed_in":["1:3.5.5-3.el10_2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"openssl-libs-debuginfo","fixed_in":["1:3.5.5-3.el10_2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"openssl-perl","fixed_in":["1:3.5.5-3.el10_2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"openssl","fixed_in":["1:3.5.5-3.el10_2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"openssl-libs","fixed_in":["1:3.5.5-3.el10_2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"compat-openssl10","fixed_in":["1:1.0.2o-4.el8_10.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"compat-openssl10-debuginfo","fixed_in":["1:1.0.2o-4.el8_10.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"compat-openssl10-debugsource","fixed_in":["1:1.0.2o-4.el8_10.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"openssl","fixed_in":["1:1.1.1k-17.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"openssl-debuginfo","fixed_in":["1:1.1.1k-17.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"openssl-debugsource","fixed_in":["1:1.1.1k-17.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"openssl-devel","fixed_in":["1:1.1.1k-17.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"openssl-libs","fixed_in":["1:1.1.1k-17.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"openssl-perl","fixed_in":["1:1.1.1k-17.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.6::baseos","package":"openssl","fixed_in":["1:1.1.1k-17.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.6::baseos","package":"openssl-debuginfo","fixed_in":["1:1.1.1k-17.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.6::baseos","package":"openssl-debugsource","fixed_in":["1:1.1.1k-17.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.6::baseos","package":"openssl-devel","fixed_in":["1:1.1.1k-17.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.6::baseos","package":"openssl-libs","fixed_in":["1:1.1.1k-17.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.6::baseos","package":"openssl-perl","fixed_in":["1:1.1.1k-17.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus_long_life:8.6::baseos","package":"openssl","fixed_in":["1:1.1.1k-17.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus_long_life:8.6::baseos","package":"openssl-debuginfo","fixed_in":["1:1.1.1k-17.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus_long_life:8.6::baseos","package":"openssl-debugsource","fixed_in":["1:1.1.1k-17.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus_long_life:8.6::baseos","package":"openssl-devel","fixed_in":["1:1.1.1k-17.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus_long_life:8.6::baseos","package":"openssl-libs","fixed_in":["1:1.1.1k-17.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus_long_life:8.6::baseos","package":"openssl-perl","fixed_in":["1:1.1.1k-17.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.8::baseos","package":"openssl","fixed_in":["1:1.1.1k-17.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.8::baseos","package":"openssl-debuginfo","fixed_in":["1:1.1.1k-17.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.8::baseos","package":"openssl-debugsource","fixed_in":["1:1.1.1k-17.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.8::baseos","package":"openssl-devel","fixed_in":["1:1.1.1k-17.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.8::baseos","package":"openssl-libs","fixed_in":["1:1.1.1k-17.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.8::baseos","package":"openssl-perl","fixed_in":["1:1.1.1k-17.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.8::baseos","package":"openssl","fixed_in":["1:1.1.1k-17.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.8::baseos","package":"openssl-debuginfo","fixed_in":["1:1.1.1k-17.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.8::baseos","package":"openssl-debugsource","fixed_in":["1:1.1.1k-17.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.8::baseos","package":"openssl-devel","fixed_in":["1:1.1.1k-17.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.8::baseos","package":"openssl-libs","fixed_in":["1:1.1.1k-17.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.8::baseos","package":"openssl-perl","fixed_in":["1:1.1.1k-17.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.4::baseos","package":"openssl","fixed_in":["1:1.1.1g-18.el8_4.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.4::baseos","package":"openssl-debuginfo","fixed_in":["1:1.1.1g-18.el8_4.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.4::baseos","package":"openssl-devel","fixed_in":["1:1.1.1g-18.el8_4.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.4::baseos","package":"openssl-libs","fixed_in":["1:1.1.1g-18.el8_4.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.4::baseos","package":"openssl-libs-debuginfo","fixed_in":["1:1.1.1g-18.el8_4.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.4::baseos","package":"openssl-perl","fixed_in":["1:1.1.1g-18.el8_4.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus_long_life:8.4::baseos","package":"openssl","fixed_in":["1:1.1.1g-18.el8_4.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus_long_life:8.4::baseos","package":"openssl-debuginfo","fixed_in":["1:1.1.1g-18.el8_4.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus_long_life:8.4::baseos","package":"openssl-devel","fixed_in":["1:1.1.1g-18.el8_4.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus_long_life:8.4::baseos","package":"openssl-libs","fixed_in":["1:1.1.1g-18.el8_4.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus_long_life:8.4::baseos","package":"openssl-libs-debuginfo","fixed_in":["1:1.1.1g-18.el8_4.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus_long_life:8.4::baseos","package":"openssl-perl","fixed_in":["1:1.1.1g-18.el8_4.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"compat-openssl10","fixed_in":["1:1.0.2o-4.el8_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus_long_life:8.6::appstream","package":"compat-openssl10","fixed_in":["1:1.0.2o-4.el8_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"compat-openssl10","fixed_in":["1:1.0.2o-3.el8_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"compat-openssl10-debuginfo","fixed_in":["1:1.0.2o-3.el8_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"compat-openssl10-debugsource","fixed_in":["1:1.0.2o-3.el8_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus_long_life:8.4::appstream","package":"compat-openssl10","fixed_in":["1:1.0.2o-3.el8_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus_long_life:8.4::appstream","package":"compat-openssl10-debuginfo","fixed_in":["1:1.0.2o-3.el8_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus_long_life:8.4::appstream","package":"compat-openssl10-debugsource","fixed_in":["1:1.0.2o-3.el8_4.1"],"sources":["osv"]},{"ecosystem":"Rocky Linux:9","package":"openssl","fixed_in":["1:3.5.5-3.el9_8"],"sources":["osv"]},{"ecosystem":"Rocky Linux:9","package":"compat-openssl11","fixed_in":["1:1.1.1k-5.el9_8.3"],"sources":["osv"]},{"ecosystem":"Rocky Linux:10","package":"openssl","fixed_in":["1:3.5.5-3.el10_2"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"compat-openssl10","fixed_in":["1:1.0.2o-4.el8_10.2"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"openssl","fixed_in":["1:1.1.1k-17.el8_10"],"sources":["osv"]},{"ecosystem":"Root:Alpine:3.15","package":"openssl","fixed_in":["1.1.1w-r10073","1.1.1w-r10076","1.1.1w-r10074","1.1.1w-r10075"],"sources":["osv"]},{"ecosystem":"Root:Alpine:3.15","package":"rootio-openssl","fixed_in":["1.1.1w-r10073","1.1.1w-r10076","1.1.1w-r10074","1.1.1w-r10075"],"sources":["osv"]},{"ecosystem":"Root:Alpine:3.17","package":"openssl","fixed_in":["3.0.19-r00079","3.0.19-r00077","3.0.19-r00078"],"sources":["osv"]},{"ecosystem":"Root:Alpine:3.17","package":"rootio-openssl","fixed_in":["3.0.19-r00079","3.0.19-r00077","3.0.19-r00078"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"openssl-3","fixed_in":["3.0.8-150400.4.84.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"openssl-3","fixed_in":["3.0.8-150400.4.84.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"openssl-3","fixed_in":["3.0.8-150400.4.84.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"openssl-3","fixed_in":["3.0.8-150400.4.84.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"openssl-3","fixed_in":["3.0.8-150400.4.84.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"openssl-3","fixed_in":["3.0.8-150400.4.84.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"openssl-1_1","fixed_in":["1.1.1d-2.128.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"openssl-1_1","fixed_in":["1.1.1d-2.128.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"openssl-1_1","fixed_in":["1.1.1l-150500.17.54.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"openssl-1_1","fixed_in":["1.1.1l-150500.17.54.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"openssl-1_1","fixed_in":["1.1.1l-150500.17.54.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"openssl-1_1","fixed_in":["1.1.1l-150500.17.54.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"openssl-1_1","fixed_in":["1.1.1l-150500.17.54.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"openssl-1_1","fixed_in":["1.1.1l-150400.7.93.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"openssl-1_1","fixed_in":["1.1.1l-150400.7.93.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"openssl-1_1","fixed_in":["1.1.1l-150400.7.93.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"openssl-1_1","fixed_in":["1.1.1l-150400.7.93.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"openssl-1_1","fixed_in":["1.1.1l-150400.7.93.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"openssl-1_1","fixed_in":["1.1.1l-150400.7.93.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"openssl-3","fixed_in":["3.1.4-150600.5.50.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"openssl-3","fixed_in":["3.1.4-150600.5.50.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.0","package":"openssl-3","fixed_in":["3.1.4-13.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"openssl-1_0_0","fixed_in":["1.0.2p-3.112.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"openssl-1_0_0","fixed_in":["1.0.2p-3.112.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Legacy 15 SP7","package":"openssl-1_0_0","fixed_in":["1.0.2p-150000.3.111.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"openssl-1_0_0","fixed_in":["1.0.2p-150000.3.111.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"openssl-1_0_0","fixed_in":["1.0.2p-150000.3.111.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"openssl-1_0_0","fixed_in":["1.0.2p-150000.3.111.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"openssl-1_0_0","fixed_in":["1.0.2p-150000.3.111.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"openssl-1_0_0","fixed_in":["1.0.2p-150000.3.111.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"openssl-1_0_0","fixed_in":["1.0.2p-150000.3.111.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"openssl-1_0_0","fixed_in":["1.0.2p-150000.3.111.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"openssl-1_0_0","fixed_in":["1.0.2p-150000.3.111.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"openssl","fixed_in":["1.0.2g-1ubuntu4.20+esm15"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:FIPS-updates:16.04:LTS","package":"openssl","fixed_in":["1.0.2g-1ubuntu4.fips.4.20.15"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"openssl","fixed_in":["1.1.1-1ubuntu2.1~18.04.23+esm8"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"openssl1.0","fixed_in":["1.0.2n-1ubuntu5.13+esm4"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:FIPS-updates:18.04:LTS","package":"openssl","fixed_in":["1.1.1-1ubuntu2.fips.2.1~18.04.23.8"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"openssl","fixed_in":["1.1.1f-1ubuntu2.24+esm3"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:FIPS-updates:20.04:LTS","package":"openssl","fixed_in":["1.1.1f-1ubuntu2.fips.24.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"openssl","fixed_in":["3.0.2-0ubuntu1.23"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:FIPS-updates:22.04:LTS","package":"openssl","fixed_in":["3.0.2-0ubuntu1.23+Fips1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"openssl","fixed_in":["3.0.13-0ubuntu3.9"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:FIPS-updates:24.04:LTS","package":"openssl-fips","fixed_in":["3.0.13-0ubuntu3.12+Fips1"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"openssl","fixed_in":["3.5.3-1ubuntu3.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.10","package":"openssl","fixed_in":["3.5.5-1ubuntu3"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"openssl","fixed_in":["3.5.5-1ubuntu3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.20","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.2"},{"fixed":"3.3.7-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.2"},{"fixed":"3.3.7-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.2"},{"fixed":"3.5.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.2"},{"fixed":"3.5.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.2"},{"fixed":"3.5.6-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.5-3.el9_8"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"openssl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.5-3.el9_8"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"openssl-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.5-3.el9_8"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"openssl-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.5-3.el9_8"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"compat-openssl11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-5.el9_8.3"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.5-3.el10_2.alma.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"openssl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.5-3.el10_2.alma.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"openssl-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.5-3.el10_2.alma.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"openssl-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.5-3.el10_2.alma.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"compat-openssl10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.0.2o-4.el8_10.2"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-17.el8_6"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"openssl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-17.el8_6"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"openssl-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-17.el8_6"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"openssl-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-17.el8_6"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"edk2-aarch64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20251114-5.el10_2.2"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:10","package":"edk2-ovmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20251114-5.el10_2.2"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:10","package":"edk2-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20251114-5.el10_2.2"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:10","package":"edk2-tools-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20251114-5.el10_2.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Azure Linux:3","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.5-5"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"openssl-fips-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.1.2-2"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20240524git3e722403cd16-16"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.8-r4"},{"fixed":"3.0.20-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.5.0-r0"},{"fixed":"3.5.6-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.1-r1"},{"fixed":"3.5.6-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:23","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.8-r4"},{"fixed":"3.0.20-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:25","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.5.0-r0"},{"fixed":"3.5.6-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:stream","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.1-r1"},{"fixed":"3.5.6-r0"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1g-15.el8.4.tuxcare.els18"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"openssl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1g-15.el8.4.tuxcare.els18"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"openssl-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1g-15.el8.4.tuxcare.els18"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"openssl-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1g-15.el8.4.tuxcare.els18"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"openssl-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1g-15.el8.4.tuxcare.els18"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libssl-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2g-1ubuntu4.21+tuxcare.els14"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libssl-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2g-1ubuntu4.21+tuxcare.els14"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libssl1.0.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2g-1ubuntu4.21+tuxcare.els14"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2g-1ubuntu4.21+tuxcare.els14"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-5.el8.5.tuxcare.els17"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"openssl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-5.el8.5.tuxcare.els17"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"openssl-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-5.el8.5.tuxcare.els17"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"openssl-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-5.el8.5.tuxcare.els17"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"openssl-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-5.el8.5.tuxcare.els17"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"libssl-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1f-1ubuntu2.24+tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"libssl-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1f-1ubuntu2.24+tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"libssl1.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1f-1ubuntu2.24+tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1f-1ubuntu2.24+tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libssl-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1-1ubuntu2.1~18.04.23+tuxcare.els8"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libssl-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1-1ubuntu2.1~18.04.23+tuxcare.els8"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libssl1.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1-1ubuntu2.1~18.04.23+tuxcare.els8"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1-1ubuntu2.1~18.04.23+tuxcare.els8"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.0.2k-26.el7_9.tuxcare.els9"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"openssl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.0.2k-26.el7_9.tuxcare.els9"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"openssl-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.0.2k-26.el7_9.tuxcare.els9"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"openssl-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.0.2k-26.el7_9.tuxcare.els9"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"openssl-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.0.2k-26.el7_9.tuxcare.els9"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.0.2k-26.el7_9.tuxcare.els9"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"openssl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.0.2k-26.el7_9.tuxcare.els9"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"openssl-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.0.2k-26.el7_9.tuxcare.els9"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"openssl-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.0.2k-26.el7_9.tuxcare.els9"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"openssl-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.0.2k-26.el7_9.tuxcare.els9"}]}]},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.0.2k-26.el7_9.tuxcare.els9"}]}]},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"openssl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.0.2k-26.el7_9.tuxcare.els9"}]}]},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"openssl-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.0.2k-26.el7_9.tuxcare.els9"}]}]},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"openssl-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.0.2k-26.el7_9.tuxcare.els9"}]}]},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"openssl-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.0.2k-26.el7_9.tuxcare.els9"}]}]},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"libssl-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1n-0+deb10u6+tuxcare.els3"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"libssl-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1n-0+deb10u6+tuxcare.els3"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"libssl1.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1n-0+deb10u6+tuxcare.els3"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1n-0+deb10u6+tuxcare.els3"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"openssl11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-7.el7.tuxcare.els1"}]}],"bundled":14},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"openssl11-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-7.el7.tuxcare.els1"}]}],"bundled":14},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"openssl11-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-7.el7.tuxcare.els1"}]}],"bundled":14},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"openssl11-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-7.el7.tuxcare.els1"}]}],"bundled":14},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"openssl11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-7.el7.tuxcare.els1"}]}],"bundled":14},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"openssl11-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-7.el7.tuxcare.els1"}]}],"bundled":14},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"openssl11-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-7.el7.tuxcare.els1"}]}],"bundled":14},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"openssl11-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-7.el7.tuxcare.els1"}]}],"bundled":14},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"openssl11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-7.el7.tuxcare.els1"}]}],"bundled":14},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"openssl11-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-7.el7.tuxcare.els1"}]}],"bundled":14},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"openssl11-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-7.el7.tuxcare.els1"}]}],"bundled":14},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"openssl11-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-7.el7.tuxcare.els1"}]}],"bundled":14},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"compat-openssl11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-5.el9_6.1.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"compat-openssl11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-4.el9_0.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.19-1~deb12u2"}]}],"versions":["3.0.10-1","3.0.10-1~deb12u1","3.0.11-1","3.0.11-1~deb12u1","3.0.11-1~deb12u2","3.0.12-1","3.0.12-2","3.0.13-1~deb12u1","3.0.13-1~deb12u2","3.0.14-1~deb12u1","3.0.14-1~deb12u2","3.0.15-1~deb12u1","3.0.16-1~deb12u1","3.0.17-1~deb12u1","3.0.17-1~deb12u2","3.0.17-1~deb12u3","3.0.18-1~deb12u1","3.0.18-1~deb12u2","3.0.19-1~deb12u1","3.0.9-1"]},{"source":"osv","ecosystem":"Debian:13","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.5-1~deb13u2"}]}],"versions":["3.5.1-1","3.5.1-1+deb13u1","3.5.2-1","3.5.3-1","3.5.4-1","3.5.4-1~deb13u1","3.5.4-1~deb13u2","3.5.5-1~deb13u1"]},{"source":"osv","ecosystem":"Debian:14","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.2-1"}]}],"versions":["3.5.1-1","3.5.2-1","3.5.3-1","3.5.4-1","3.5.4-1~deb13u1","3.5.4-1~deb13u2","3.5.5-1","3.5.5-1~deb13u1","3.5.5-1~deb13u2","3.5.6-1~deb13u1","3.5.6-1~deb13u2","3.5.7-1~deb13u1","3.5.7-1~deb13u2","3.5.7-1~deb13u3","3.6.0-1","3.6.0-2","3.6.0~~alpha1-1","3.6.0~~beta1-1","3.6.1-1","3.6.1-2","3.6.1-3"]},{"source":"osv","ecosystem":"Julia","package":"AppBundler","ranges":[{"type":"SEMVER","events":[{"introduced":"1.0.0"},{"fixed":"1.0.1"}]}]},{"source":"osv","ecosystem":"Julia","package":"OpenSSL_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.0.20+0"},{"introduced":"3.5.0+0"},{"fixed":"3.5.6+0"}]}]},{"source":"osv","ecosystem":"Julia","package":"Openresty_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}]},{"source":"osv","ecosystem":"Mageia:9","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.20-1.mga9"}]}],"bundled":6},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.12-47.oe2403"}]}],"bundled":6},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.12-47.oe2403sp1"}]}],"bundled":6},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.12-47.oe2403sp3"}]}],"bundled":6},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1f-42.oe2003sp4"}]}],"bundled":4},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1wa-16.oe2203sp4"}]}],"bundled":4},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"compat-openssl11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1m-18.oe2403"}]}],"bundled":5},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"compat-openssl11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1m-18.oe2403sp1"}]}],"bundled":5},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"compat-openssl11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1m-18.oe2403sp3"}]}],"bundled":5},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"202308-40.oe2403sp3"}]}],"bundled":5},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"202308-34.oe2403sp1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.6-0.3.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"openssl-config-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.6-0.3.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"openssl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.6-0.3.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"openssl-devel-engine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.6-0.3.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"openssl-fips-provider-upstream","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.6-0.3.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"openssl-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.6-0.3.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"openssl-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.6-0.3.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"openssl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.5-3.el9_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"openssl-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.5-3.el9_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"openssl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.5-3.el9_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"openssl-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.5-3.el9_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"openssl-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.5-3.el9_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.5-3.el9_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"openssl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.5-3.el9_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"openssl-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.5-3.el9_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"openssl-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.5-3.el9_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"openssl-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.5-3.el9_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"compat-openssl11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-5.el9_8.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"compat-openssl11-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-5.el9_8.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"compat-openssl11-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-5.el9_8.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"openssl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.5-3.el10_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"openssl-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.5-3.el10_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"openssl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.5-3.el10_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"openssl-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.5-3.el10_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"openssl-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.5-3.el10_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.5-3.el10_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"openssl-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.5-3.el10_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"compat-openssl10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.0.2o-4.el8_10.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"compat-openssl10-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.0.2o-4.el8_10.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"compat-openssl10-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.0.2o-4.el8_10.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"compat-openssl11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-5.el9_6.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"compat-openssl11-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-5.el9_6.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"compat-openssl11-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-5.el9_6.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"compat-openssl10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.0.2o-4.el8_8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"compat-openssl10-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.0.2o-4.el8_8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"compat-openssl10-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.0.2o-4.el8_8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"compat-openssl10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.0.2o-4.el8_8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"compat-openssl10-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.0.2o-4.el8_8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"compat-openssl10-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.0.2o-4.el8_8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-17.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"openssl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-17.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"openssl-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-17.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"openssl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-17.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"openssl-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-17.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"openssl-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-17.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::baseos","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-17.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::baseos","package":"openssl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-17.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::baseos","package":"openssl-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-17.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::baseos","package":"openssl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-17.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::baseos","package":"openssl-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-17.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::baseos","package":"openssl-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-17.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.6::baseos","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-17.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.6::baseos","package":"openssl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-17.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.6::baseos","package":"openssl-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-17.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.6::baseos","package":"openssl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-17.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.6::baseos","package":"openssl-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-17.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.6::baseos","package":"openssl-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-17.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::baseos","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-17.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::baseos","package":"openssl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-17.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::baseos","package":"openssl-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-17.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::baseos","package":"openssl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-17.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::baseos","package":"openssl-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-17.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::baseos","package":"openssl-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-17.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::baseos","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-17.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::baseos","package":"openssl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-17.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::baseos","package":"openssl-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-17.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::baseos","package":"openssl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-17.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::baseos","package":"openssl-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-17.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::baseos","package":"openssl-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-17.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"compat-openssl11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-5.el9_4.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"compat-openssl11-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-5.el9_4.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"compat-openssl11-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-5.el9_4.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"compat-openssl11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-4.el9_2.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"compat-openssl11-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-4.el9_2.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"compat-openssl11-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-4.el9_2.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20251114-5.el10_2.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"edk2-aarch64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20251114-5.el10_2.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"edk2-ovmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20251114-5.el10_2.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"edk2-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20251114-5.el10_2.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"edk2-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20251114-5.el10_2.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"edk2-tools-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20251114-5.el10_2.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"edk2-tools-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20251114-5.el10_2.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::baseos","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1g-18.el8_4.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::baseos","package":"openssl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1g-18.el8_4.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::baseos","package":"openssl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1g-18.el8_4.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::baseos","package":"openssl-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1g-18.el8_4.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::baseos","package":"openssl-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1g-18.el8_4.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::baseos","package":"openssl-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1g-18.el8_4.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.4::baseos","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1g-18.el8_4.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.4::baseos","package":"openssl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1g-18.el8_4.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.4::baseos","package":"openssl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1g-18.el8_4.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.4::baseos","package":"openssl-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1g-18.el8_4.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.4::baseos","package":"openssl-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1g-18.el8_4.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.4::baseos","package":"openssl-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1g-18.el8_4.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"compat-openssl10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.0.2o-4.el8_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.6::appstream","package":"compat-openssl10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.0.2o-4.el8_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"compat-openssl10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.0.2o-3.el8_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"compat-openssl10-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.0.2o-3.el8_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"compat-openssl10-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.0.2o-3.el8_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.4::appstream","package":"compat-openssl10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.0.2o-3.el8_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.4::appstream","package":"compat-openssl10-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.0.2o-3.el8_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.4::appstream","package":"compat-openssl10-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.0.2o-3.el8_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_els:7","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.0.2k-26.el7_9.2"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_els:7","package":"openssl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.0.2k-26.el7_9.2"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_els:7","package":"openssl-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.0.2k-26.el7_9.2"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_els:7","package":"openssl-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.0.2k-26.el7_9.2"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_els:7","package":"openssl-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.0.2k-26.el7_9.2"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"openssl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.2.2-16.el10_0.7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"openssl-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.2.2-16.el10_0.7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"openssl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.2.2-16.el10_0.7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"openssl-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.2.2-16.el10_0.7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.2.2-16.el10_0.7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"openssl-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.2.2-16.el10_0.7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.6-0.1.hum1"}]}],"bundled":23},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"openssl-config-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.6-0.1.hum1"}]}],"bundled":23},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"openssl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.6-0.1.hum1"}]}],"bundled":23},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"openssl-devel-engine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.6-0.1.hum1"}]}],"bundled":23},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"openssl-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.6-0.1.hum1"}]}],"bundled":23},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"openssl-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.6-0.1.hum1"}]}],"bundled":23},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"openssl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.2.2-7.el9_6.4"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"openssl-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.2.2-7.el9_6.4"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"openssl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.2.2-7.el9_6.4"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"openssl-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.2.2-7.el9_6.4"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::baseos","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.2.2-7.el9_6.4"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::baseos","package":"openssl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.2.2-7.el9_6.4"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::baseos","package":"openssl-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.2.2-7.el9_6.4"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::baseos","package":"openssl-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.2.2-7.el9_6.4"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"openssl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.0.7-18.el9_2.4"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"openssl-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.0.7-18.el9_2.4"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::baseos","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.0.7-18.el9_2.4"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::baseos","package":"openssl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.0.7-18.el9_2.4"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::baseos","package":"openssl-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.0.7-18.el9_2.4"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::baseos","package":"openssl-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.0.7-18.el9_2.4"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"openssl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.0.7-29.el9_4.3"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"openssl-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.0.7-29.el9_4.3"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"openssl-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.0.7-29.el9_4.3"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::baseos","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.0.7-29.el9_4.3"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::baseos","package":"openssl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.0.7-29.el9_4.3"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::baseos","package":"openssl-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.0.7-29.el9_4.3"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::baseos","package":"openssl-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.0.7-29.el9_4.3"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::baseos","package":"openssl-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.0.7-29.el9_4.3"}]}],"bundled":6},{"source":"osv","ecosystem":"Rocky Linux:9","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.5-3.el9_8"}]}]},{"source":"osv","ecosystem":"Rocky Linux:9","package":"compat-openssl11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-5.el9_8.3"}]}]},{"source":"osv","ecosystem":"Rocky Linux:10","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.5.5-3.el10_2"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"compat-openssl10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.0.2o-4.el8_10.2"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-17.el8_10"}]}]},{"source":"osv","ecosystem":"Rocky Linux:10","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20251114-5.el10_2.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Root:Alpine:3.15","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1w-r10073"},{"fixed":"1.1.1w-r10076"},{"fixed":"1.1.1w-r10074"},{"fixed":"1.1.1w-r10075"}]}]},{"source":"osv","ecosystem":"Root:Alpine:3.15","package":"rootio-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1w-r10073"},{"fixed":"1.1.1w-r10076"},{"fixed":"1.1.1w-r10074"},{"fixed":"1.1.1w-r10075"}]}]},{"source":"osv","ecosystem":"Root:Alpine:3.17","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.19-r00079"},{"fixed":"3.0.19-r00077"},{"fixed":"3.0.19-r00078"}]}]},{"source":"osv","ecosystem":"Root:Alpine:3.17","package":"rootio-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.19-r00079"},{"fixed":"3.0.19-r00077"},{"fixed":"3.0.19-r00078"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-150700.5.31.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"openssl-1_1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1w-150700.11.16.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"openssl-1_1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1w-150700.11.16.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Legacy 15 SP7","package":"openssl-1_1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1w-150700.11.16.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.8-150400.4.84.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.8-150400.4.84.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.8-150400.4.84.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.8-150400.4.84.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.8-150400.4.84.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.8-150400.4.84.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"openssl-1_1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1d-2.128.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"openssl-1_1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1d-2.128.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"openssl-1_1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1l-150500.17.54.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"openssl-1_1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1l-150500.17.54.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"openssl-1_1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1l-150500.17.54.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"openssl-1_1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1l-150500.17.54.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"openssl-1_1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1l-150500.17.54.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"openssl-1_1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1l-150400.7.93.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"openssl-1_1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1l-150400.7.93.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"openssl-1_1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1l-150400.7.93.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"openssl-1_1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1l-150400.7.93.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"openssl-1_1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1l-150400.7.93.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"openssl-1_1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1l-150400.7.93.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"openssl-1_1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1w-150600.5.26.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"openssl-1_1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1w-150600.5.26.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.4-150600.5.50.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.4-150600.5.50.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.0-160000.7.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.0-160000.7.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.0-160000.7.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.4-13.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.4-slfo.1.1_10.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"openssl-1_0_0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2p-3.112.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"openssl-1_0_0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2p-3.112.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Legacy 15 SP7","package":"openssl-1_0_0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2p-150000.3.111.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"openssl-1_0_0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2p-150000.3.111.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"openssl-1_0_0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2p-150000.3.111.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"openssl-1_0_0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2p-150000.3.111.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"openssl-1_0_0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2p-150000.3.111.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"openssl-1_0_0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2p-150000.3.111.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"openssl-1_0_0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2p-150000.3.111.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"openssl-1_0_0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2p-150000.3.111.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"openssl-1_0_0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2p-150000.3.111.2"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2g-1ubuntu4.20+esm15"}]}],"versions":["1.0.2d-0ubuntu1","1.0.2d-0ubuntu2","1.0.2e-1ubuntu1","1.0.2f-2ubuntu1","1.0.2g-1ubuntu2","1.0.2g-1ubuntu3","1.0.2g-1ubuntu4","1.0.2g-1ubuntu4.1","1.0.2g-1ubuntu4.2","1.0.2g-1ubuntu4.4","1.0.2g-1ubuntu4.5","1.0.2g-1ubuntu4.6","1.0.2g-1ubuntu4.8","1.0.2g-1ubuntu4.9","1.0.2g-1ubuntu4.10","1.0.2g-1ubuntu4.11","1.0.2g-1ubuntu4.12","1.0.2g-1ubuntu4.13","1.0.2g-1ubuntu4.14","1.0.2g-1ubuntu4.15","1.0.2g-1ubuntu4.16","1.0.2g-1ubuntu4.17","1.0.2g-1ubuntu4.18","1.0.2g-1ubuntu4.19","1.0.2g-1ubuntu4.20","1.0.2g-1ubuntu4.20+esm1","1.0.2g-1ubuntu4.20+esm2","1.0.2g-1ubuntu4.20+esm3","1.0.2g-1ubuntu4.20+esm4","1.0.2g-1ubuntu4.20+esm5","1.0.2g-1ubuntu4.20+esm6","1.0.2g-1ubuntu4.20+esm7","1.0.2g-1ubuntu4.20+esm9","1.0.2g-1ubuntu4.20+esm10","1.0.2g-1ubuntu4.20+esm11","1.0.2g-1ubuntu4.20+esm12","1.0.2g-1ubuntu4.20+esm13","1.0.2g-1ubuntu4.20+esm14"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0~20150106.5c2d456b-2","0~20160104.c2a892d7-1","0~20160408.ffea0a2c-2","0~20160408.ffea0a2c-2ubuntu0.1","0~20160408.ffea0a2c-2ubuntu0.2","0~20160408.ffea0a2c-2ubuntu0.2+esm1","0~20160408.ffea0a2c-2ubuntu0.2+esm3","0~20160408.ffea0a2c-2ubuntu0.2+esm4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.10.25~dfsg2-2ubuntu1","4.2.2~dfsg-1","4.2.3~dfsg-1","4.2.4~dfsg-1ubuntu1","4.2.4~dfsg-2","4.2.6~dfsg-1ubuntu1","4.2.6~dfsg-1ubuntu4","4.2.6~dfsg-1ubuntu4.1","4.2.6~dfsg-1ubuntu4.2","4.2.6~dfsg-1ubuntu4.2+esm1","4.2.6~dfsg-1ubuntu4.2+esm2","4.2.6~dfsg-1ubuntu4.2+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:16.04:LTS","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2g-1ubuntu4.fips.4.20.15"}]}],"versions":["1.0.2g-1ubuntu4.fips.4.9.1","1.0.2g-1ubuntu4.fips.4.13.1","1.0.2g-1ubuntu4.fips.4.15.1","1.0.2g-1ubuntu4.fips.4.16.1","1.0.2g-1ubuntu4.fips.4.17.1","1.0.2g-1ubuntu4.fips.4.18.1","1.0.2g-1ubuntu4.fips.4.19.3","1.0.2g-1ubuntu4.fips.4.20.1","1.0.2g-1ubuntu4.fips.4.20.2","1.0.2g-1ubuntu4.fips.4.20.3","1.0.2g-1ubuntu4.fips.4.20.6","1.0.2g-1ubuntu4.fips.4.20.7","1.0.2g-1ubuntu4.fips.4.20.9","1.0.2g-1ubuntu4.fips.4.20.10","1.0.2g-1ubuntu4.fips.4.20.11","1.0.2g-1ubuntu4.fips.4.20.12","1.0.2g-1ubuntu4.fips.4.20.13","1.0.2g-1ubuntu4.fips.4.20.14"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS:16.04:LTS","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.2g-1ubuntu4.fips.4.6~ppa1","1.0.2g-1ubuntu4.fips.4.6~ppa2","1.0.2g-1ubuntu4.fips.4.6~ppa3","1.0.2g-1ubuntu4.fips.4.6","1.0.2g-1ubuntu4.fips.4.6.1","1.0.2g-1ubuntu4.fips.4.6.2","1.0.2g-1ubuntu4.fips.4.6.3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1-1ubuntu2.1~18.04.23+esm8"}]}],"versions":["1.0.2g-1ubuntu13","1.0.2g-1ubuntu14","1.0.2n-1ubuntu1","1.1.0g-2ubuntu1","1.1.0g-2ubuntu2","1.1.0g-2ubuntu3","1.1.0g-2ubuntu4","1.1.0g-2ubuntu4.1","1.1.0g-2ubuntu4.3","1.1.1-1ubuntu2.1~18.04.1","1.1.1-1ubuntu2.1~18.04.2","1.1.1-1ubuntu2.1~18.04.3","1.1.1-1ubuntu2.1~18.04.4","1.1.1-1ubuntu2.1~18.04.5","1.1.1-1ubuntu2.1~18.04.6","1.1.1-1ubuntu2.1~18.04.7","1.1.1-1ubuntu2.1~18.04.8","1.1.1-1ubuntu2.1~18.04.9","1.1.1-1ubuntu2.1~18.04.10","1.1.1-1ubuntu2.1~18.04.13","1.1.1-1ubuntu2.1~18.04.14","1.1.1-1ubuntu2.1~18.04.15","1.1.1-1ubuntu2.1~18.04.17","1.1.1-1ubuntu2.1~18.04.19","1.1.1-1ubuntu2.1~18.04.20","1.1.1-1ubuntu2.1~18.04.21","1.1.1-1ubuntu2.1~18.04.22","1.1.1-1ubuntu2.1~18.04.23","1.1.1-1ubuntu2.1~18.04.23+esm1","1.1.1-1ubuntu2.1~18.04.23+esm3","1.1.1-1ubuntu2.1~18.04.23+esm4","1.1.1-1ubuntu2.1~18.04.23+esm5","1.1.1-1ubuntu2.1~18.04.23+esm6","1.1.1-1ubuntu2.1~18.04.23+esm7"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"openssl1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2n-1ubuntu5.13+esm4"}]}],"versions":["1.0.2n-1ubuntu2","1.0.2n-1ubuntu3","1.0.2n-1ubuntu4","1.0.2n-1ubuntu5","1.0.2n-1ubuntu5.1","1.0.2n-1ubuntu5.2","1.0.2n-1ubuntu5.3","1.0.2n-1ubuntu5.4","1.0.2n-1ubuntu5.5","1.0.2n-1ubuntu5.6","1.0.2n-1ubuntu5.7","1.0.2n-1ubuntu5.8","1.0.2n-1ubuntu5.9","1.0.2n-1ubuntu5.10","1.0.2n-1ubuntu5.11","1.0.2n-1ubuntu5.12","1.0.2n-1ubuntu5.13","1.0.2n-1ubuntu5.13+esm1","1.0.2n-1ubuntu5.13+esm2","1.0.2n-1ubuntu5.13+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0~20170911.5dfba97c-1","0~20171010.234dbcef-1","0~20171027.76fd5a66-1","0~20171205.a9212288-1","0~20180105.0bc94c74-1","0~20180205.c0d9813c-1","0~20180205.c0d9813c-2","0~20180205.c0d9813c-2ubuntu0.1","0~20180205.c0d9813c-2ubuntu0.2","0~20180205.c0d9813c-2ubuntu0.3","0~20180205.c0d9813c-2ubuntu0.3+esm1","0~20180205.c0d9813c-2ubuntu0.3+esm2","0~20180205.c0d9813c-2ubuntu0.3+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.11.4~dfsg-1ubuntu1","6.11.4~dfsg-1ubuntu2","6.12.0~dfsg-1ubuntu1","6.12.0~dfsg-2ubuntu1","6.12.0~dfsg-2ubuntu2","8.10.0~dfsg-2","8.10.0~dfsg-2ubuntu0.2","8.10.0~dfsg-2ubuntu0.3","8.10.0~dfsg-2ubuntu0.4","8.10.0~dfsg-2ubuntu0.4+esm1","8.10.0~dfsg-2ubuntu0.4+esm2","8.10.0~dfsg-2ubuntu0.4+esm3","8.10.0~dfsg-2ubuntu0.4+esm4","8.10.0~dfsg-2ubuntu0.4+esm5","8.10.0~dfsg-2ubuntu0.4+esm6"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:18.04:LTS","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1-1ubuntu2.fips.2.1~18.04.23.8"}]}],"versions":["1.1.1-1ubuntu2.fips.2.1~18.04.5.1","1.1.1-1ubuntu2.fips.2.1~18.04.6.1","1.1.1-1ubuntu2.fips.2.1~18.04.7.1","1.1.1-1ubuntu2.fips.2.1~18.04.9.1","1.1.1-1ubuntu2.fips.2.1~18.04.9.2","1.1.1-1ubuntu2.fips.2.1~18.04.9.3","1.1.1-1ubuntu2.fips.2.1~18.04.13.2","1.1.1-1ubuntu2.fips.2.1~18.04.15","1.1.1-1ubuntu2.fips.2.1~18.04.15.1","1.1.1-1ubuntu2.fips.2.1~18.04.15.2","1.1.1-1ubuntu2.fips.2.1~18.04.17","1.1.1-1ubuntu2.fips.2.1~18.04.20","1.1.1-1ubuntu2.fips.2.1~18.04.21","1.1.1-1ubuntu2.fips.2.1~18.04.22","1.1.1-1ubuntu2.fips.2.1~18.04.23","1.1.1-1ubuntu2.fips.2.1~18.04.23.3","1.1.1-1ubuntu2.fips.2.1~18.04.23.4","1.1.1-1ubuntu2.fips.2.1~18.04.23.5","1.1.1-1ubuntu2.fips.2.1~18.04.23.6","1.1.1-1ubuntu2.fips.2.1~18.04.23.7"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS:18.04:LTS","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.1-1ubuntu2.fips.2.1~18.04.3.1","1.1.1-1ubuntu2.fips.2.1~18.04.15.2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0~20190606.20d2e5a1-2ubuntu1","0~20190828.37eef910-3","0~20190828.37eef910-4","0~20191122.bd85bf54-1","0~20191122.bd85bf54-1ubuntu1","0~20191122.bd85bf54-2","0~20191122.bd85bf54-2ubuntu1","0~20191122.bd85bf54-2ubuntu2","0~20191122.bd85bf54-2ubuntu3","0~20191122.bd85bf54-2ubuntu3.1","0~20191122.bd85bf54-2ubuntu3.2","0~20191122.bd85bf54-2ubuntu3.3","0~20191122.bd85bf54-2ubuntu3.4","0~20191122.bd85bf54-2ubuntu3.5","0~20191122.bd85bf54-2ubuntu3.6","0~20191122.bd85bf54-2ubuntu3.6+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1f-1ubuntu2.24+esm3"}]}],"versions":["1.1.1c-1ubuntu4","1.1.1d-2ubuntu3","1.1.1d-2ubuntu6","1.1.1f-1ubuntu1","1.1.1f-1ubuntu2","1.1.1f-1ubuntu2.1","1.1.1f-1ubuntu2.2","1.1.1f-1ubuntu2.3","1.1.1f-1ubuntu2.4","1.1.1f-1ubuntu2.5","1.1.1f-1ubuntu2.8","1.1.1f-1ubuntu2.9","1.1.1f-1ubuntu2.10","1.1.1f-1ubuntu2.11","1.1.1f-1ubuntu2.12","1.1.1f-1ubuntu2.13","1.1.1f-1ubuntu2.15","1.1.1f-1ubuntu2.16","1.1.1f-1ubuntu2.17","1.1.1f-1ubuntu2.18","1.1.1f-1ubuntu2.19","1.1.1f-1ubuntu2.20","1.1.1f-1ubuntu2.21","1.1.1f-1ubuntu2.22","1.1.1f-1ubuntu2.23","1.1.1f-1ubuntu2.24","1.1.1f-1ubuntu2.24+esm1","1.1.1f-1ubuntu2.24+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:20.04:LTS","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1f-1ubuntu2.fips.24.3"}]}],"versions":["1.1.1f-1ubuntu2.fips.7","1.1.1f-1ubuntu2.fips.7.2","1.1.1f-1ubuntu2.fips.12","1.1.1f-1ubuntu2.fips.13","1.1.1f-1ubuntu2.fips.13.1","1.1.1f-1ubuntu2.fips.16","1.1.1f-1ubuntu2.fips.17","1.1.1f-1ubuntu2.fips.18","1.1.1f-1ubuntu2.fips.19","1.1.1f-1ubuntu2.fips.20","1.1.1f-1ubuntu2.fips.21","1.1.1f-1ubuntu2.fips.22","1.1.1f-1ubuntu2.fips.24","1.1.1f-1ubuntu2.fips.24.1","1.1.1f-1ubuntu2.fips.24.2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS:20.04:LTS","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.1f-1ubuntu2.fips.2.8","1.1.1f-1ubuntu2.fips.7.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2021.08~rc0-2","2021.08-3","2021.11~rc1-1","2021.11-1","2021.11-2","2022.02~rc1-1","2022.02~rc1-1ubuntu1","2022.02-1","2022.02-2","2022.02-3","2022.02-3ubuntu0.22.04.1","2022.02-3ubuntu0.22.04.2","2022.02-3ubuntu0.22.04.3","2022.02-3ubuntu0.22.04.4","2022.02-3ubuntu0.22.04.5","2022.02-3ubuntu0.22.04.6","2022.02-3ubuntu0.22.04.7"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.2-0ubuntu1.23"}]}],"versions":["1.1.1l-1ubuntu1","3.0.0-1ubuntu1","3.0.1-0ubuntu1","3.0.2-0ubuntu1","3.0.2-0ubuntu1.1","3.0.2-0ubuntu1.2","3.0.2-0ubuntu1.4","3.0.2-0ubuntu1.5","3.0.2-0ubuntu1.6","3.0.2-0ubuntu1.7","3.0.2-0ubuntu1.8","3.0.2-0ubuntu1.9","3.0.2-0ubuntu1.10","3.0.2-0ubuntu1.12","3.0.2-0ubuntu1.13","3.0.2-0ubuntu1.14","3.0.2-0ubuntu1.15","3.0.2-0ubuntu1.16","3.0.2-0ubuntu1.17","3.0.2-0ubuntu1.18","3.0.2-0ubuntu1.19","3.0.2-0ubuntu1.20","3.0.2-0ubuntu1.21"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["12.22.5~dfsg-5ubuntu1","12.22.7~dfsg-2ubuntu1","12.22.7~dfsg-2ubuntu3","12.22.9~dfsg-1ubuntu2","12.22.9~dfsg-1ubuntu3","12.22.9~dfsg-1ubuntu3.1","12.22.9~dfsg-1ubuntu3.2","12.22.9~dfsg-1ubuntu3.3","12.22.9~dfsg-1ubuntu3.4","12.22.9~dfsg-1ubuntu3.5","12.22.9~dfsg-1ubuntu3.6","12.22.9~dfsg-1ubuntu3.6+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-preview:22.04:LTS","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0.2-0ubuntu1.10+Fips1","3.0.2-0ubuntu1.12+Fips1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-preview:22.04:LTS","package":"openssl-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0.5-0ubuntu0.1+Fips2.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:22.04:LTS","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.2-0ubuntu1.23+Fips1"}]}],"versions":["3.0.2-0ubuntu1.10+Fips1","3.0.2-0ubuntu1.12+Fips1","3.0.2-0ubuntu1.14+Fips1","3.0.2-0ubuntu1.15+Fips1","3.0.2-0ubuntu1.16+Fips1","3.0.2-0ubuntu1.17+Fips1","3.0.2-0ubuntu1.18+Fips1","3.0.2-0ubuntu1.19+Fips1","3.0.2-0ubuntu1.20+Fips1","3.0.2-0ubuntu1.21+Fips1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:22.04:LTS","package":"openssl-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0.5-0ubuntu0.1+Fips2.1","3.0.5-0ubuntu0.2+Fips1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2023.05-2","2023.11-2","2023.11-3","2023.11-4","2023.11-5","2023.11-6","2023.11-8","2024.02-1","2024.02-2","2024.02-2ubuntu0.1","2024.02-2ubuntu0.3","2024.02-2ubuntu0.4","2024.02-2ubuntu0.5","2024.02-2ubuntu0.6","2024.02-2ubuntu0.7","2024.02-2ubuntu0.8","2024.02-2ubuntu0.9","2024.02-2ubuntu0.10"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.13-0ubuntu3.9"}]}],"versions":["3.0.10-1ubuntu2","3.0.10-1ubuntu2.1","3.0.10-1ubuntu3","3.0.10-1ubuntu4","3.0.13-0ubuntu2","3.0.13-0ubuntu3","3.0.13-0ubuntu3.1","3.0.13-0ubuntu3.2","3.0.13-0ubuntu3.3","3.0.13-0ubuntu3.4","3.0.13-0ubuntu3.5","3.0.13-0ubuntu3.6","3.0.13-0ubuntu3.7"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:24.04:LTS","package":"openssl-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.13-0ubuntu3.12+Fips1"}]}],"versions":["3.0.13-0ubuntu3+Fips1","3.0.13-0ubuntu3.6+Fips1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2025.02-3ubuntu2","2025.02-8","2025.02-8ubuntu1","2025.02-8ubuntu2","2025.02-8ubuntu3","2025.02-8ubuntu3.1","2025.02-8ubuntu3.2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.3-1ubuntu3.3"}]}],"versions":["3.4.1-1ubuntu3","3.5.0-2ubuntu1","3.5.2-1ubuntu1","3.5.3-1ubuntu2","3.5.3-1ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2025.11-3ubuntu7","2025.11-3ubuntu8","2026.05-2ubuntu1","2026.05-2ubuntu2","2026.05-2ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"edk2-hwe","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2025.11-3ubuntu8","2025.11-3ubuntu9","2026.05-2ubuntu1","2026.05-2ubuntu2","2026.05-2ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.5-1ubuntu3"}]}]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2025.02-8ubuntu3","2025.11-3ubuntu6","2025.11-3ubuntu7","2025.11-3ubuntu7.2","2025.11-3ubuntu7.3"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"edk2-hwe","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2025.11-3ubuntu6","2025.11-3ubuntu8","2025.11-3ubuntu8.2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.5-1ubuntu3"}]}],"versions":["3.5.3-1ubuntu2","3.5.5-1ubuntu1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.3-4.1"}]}],"bundled":7},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.0-160000.7.1"}]}],"bundled":7}],"products":[{"vendor":"openssl","product":"openssl"},{"vendor":"siemens","product":"simatic cn 4100"},{"vendor":"siemens","product":"simatic s7-1500 tm mfp - gnu/linux subsystem"}],"references":[{"url":"https://openssl-library.org/news/secadv/20260407.txt","tags":["vendor-advisory","Vendor Advisory","advisory","web","article"]},{"url":"https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc","tags":["patch","Patch","fix","web","article"]},{"url":"https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6","tags":["patch","Patch","fix","web","article"]},{"url":"https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788","tags":["patch","Patch","fix","web","article"]},{"url":"https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75","tags":["patch","Patch","fix","web","article"]},{"url":"https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4","tags":["patch","Patch","fix","web","article"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-265688.html","tags":["web"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-032379.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28390","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-fgpp-q3px-3xhc"},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-28390","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:22312","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-28390","tags":["report"]},{"url":"https://bugzilla.redhat.com/2456314","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-22312.html","tags":["advisory"]},{"url":"https://www.redhat.com/security/data/cve/CVE-2026-2673.html","tags":["report"]},{"url":"https://access.redhat.com/errata/RHSA-2026:22313","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-22313.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:22314","tags":["advisory"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-22314.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:22315","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2026-22315.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:38503","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2026-38503.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:39297","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-31790","tags":["report"]},{"url":"https://bugzilla.redhat.com/2451094","tags":["report"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-39297.html","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-28390","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos8.4els/CLSA-2026-1777297012.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/ubuntu16.04els/CLSA-2026-1777393624.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos8.5els/CLSA-2026-1777396609.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/ubuntu20.04els/CLSA-2026-1777397374.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/ubuntu18.04els/CLSA-2026-1777541792.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos7els/CLSA-2026-1777566580.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/oraclelinux7els/CLSA-2026-1777567181.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/rhel7els/CLSA-2026-1777567430.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/debian10els/CLSA-2026-1777999127.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/rhel7els/CLSA-2026-1780682107.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-3711","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-3996","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-0464","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-5535","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-69419","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-69421","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28387","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28388","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28389","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/oraclelinux7els/CLSA-2026-1780682108.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos7els/CLSA-2026-1780683040.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1780710220.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1781165688.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28390.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-28390","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0091.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35331","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2026/04/07/11","tags":["web","report"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2041","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31789","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31790","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2042","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2043","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2044","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2045","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2189","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-22795","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2190","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2191","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2619","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2622","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:14217","tags":["advisory"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_14217.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2456314","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-28390","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_22312.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-2673","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2447327","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-2673","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-2673","tags":["advisory"]},{"url":"https://github.com/openssl/openssl/commit/2157c9d81f7b0bd7dfa25b960e928ec28e8dd63f","tags":["article"]},{"url":"https://github.com/openssl/openssl/commit/85977e013f32ceb96aa034c0e741adddc1a05e34","tags":["article"]},{"url":"https://openssl-library.org/news/secadv/20260313.txt","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_22313.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_22314.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_22315.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:35869","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2481898","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_35869.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-45447","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-45447","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45447","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:36217","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_36217.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_38503.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:38804","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_38804.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:38805","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_38805.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:39009","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_39009.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:39012","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_39012.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2451094","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_39297.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-31790","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:43513","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_43513.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:44480","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_44480.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:47096","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_47096.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:58563","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2294581","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_58563.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-5535","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-5535","tags":["advisory"]},{"url":"https://www.oracle.com/security-alerts/cpuoct2024.html#AppendixMSQL","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2026:71542","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2430381","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2481884","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2481885","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2481896","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_71542.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-69418","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-69418","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-69418","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-34182","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-34182","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34182","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-34183","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-34183","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34183","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-45445","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-45445","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45445","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:7261","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-9232","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-9231","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-9230","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-11187","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-69421","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-69420","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-69419","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-68160","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-66199","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-15469","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-15468","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-15467","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-31789","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-28389","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-28388","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-28387","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-28386","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-22795","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-22796","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_7261.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2396054","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-9230","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-9230","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2396055","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-9231","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-9231","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2396056","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-9232","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-9232","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2430375","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-11187","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-11187","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2430376","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-15467","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-15467","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2430377","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-15468","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-15468","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2430378","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-15469","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-15469","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2430379","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-66199","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-66199","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2430380","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-68160","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68160","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2430386","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-69419","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2430388","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-69420","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-69420","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2430387","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-69421","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2430389","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-22795","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2430390","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-22796","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-22796","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2451099","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-28386","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28386","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2451098","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-28387","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2451097","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-28388","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2451096","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-28389","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2451095","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-31789","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:83617","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_83617.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:84572","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_84572.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:84573","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_84573.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:22312","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:22313","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:22314","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:22315","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:38503","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:39297","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20261375-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1260441","tags":["report"]},{"url":"https://bugzilla.suse.com/1260442","tags":["report"]},{"url":"https://bugzilla.suse.com/1260443","tags":["report"]},{"url":"https://bugzilla.suse.com/1260444","tags":["report"]},{"url":"https://bugzilla.suse.com/1260445","tags":["report"]},{"url":"https://bugzilla.suse.com/1261678","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-28387","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-28388","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-28389","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-28390","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31789","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-31790","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20261386-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20261429-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20261549-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20261550-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20261562-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20261577-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20261605-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20261711-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621107-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1259652","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-2673","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621186-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621244-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622132-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1230698","tags":["report"]},{"url":"https://bugzilla.suse.com/1260446","tags":["report"]},{"url":"https://bugzilla.suse.com/1266340","tags":["report"]},{"url":"https://bugzilla.suse.com/1266341","tags":["report"]},{"url":"https://bugzilla.suse.com/1266342","tags":["report"]},{"url":"https://bugzilla.suse.com/1266344","tags":["report"]},{"url":"https://bugzilla.suse.com/1266349","tags":["report"]},{"url":"https://bugzilla.suse.com/1266353","tags":["report"]},{"url":"https://bugzilla.suse.com/1266355","tags":["report"]},{"url":"https://bugzilla.suse.com/1266356","tags":["report"]},{"url":"https://bugzilla.suse.com/1266357","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-41996","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34180","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34182","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42766","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42770","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45445","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45446","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45447","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-7383","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-9076","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263272-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263443-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-28390","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8155-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8155-2","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-28390","title":"Possible NULL Dereference When Processing CMS KeyTransportRecipientInfo","description":"Issue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyTransportRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyTransportRecipientInfo with\nRSA-OAEP encryption is processed, the optional parameters field of\nRSA-OAEP SourceFunc algorithm identifier is examined without checking\nfor its presence. This results in a NULL pointer dereference if the field\nis missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.","status":"published","published":"2026-04-07T22:00:54.172Z","modified":"2026-10-15T01:15:35.711Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T14:20:02.290587Z"}],"euvd":[{"id":"EUVD-2026-19966","description":"Issue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyTransportRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyTransportRecipientInfo with\nRSA-OAEP encryption is processed, the optional parameters field of\nRSA-OAEP SourceFunc algorithm identifier is examined without checking\nfor its presence. This results in a NULL pointer dereference if the field\nis missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.","status":"published","published":"2026-04-07T22:00:54Z","modified":"2026-10-15T01:15:35Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T17:27:06.52614Z"}],"ghsa":[{"id":"GHSA-fgpp-q3px-3xhc","title":"Issue summary: During processing of a crafted CMS EnvelopedData message\nwith...","description":"Issue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyTransportRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyTransportRecipientInfo with\nRSA-OAEP encryption is processed, the optional parameters field of\nRSA-OAEP SourceFunc algorithm identifier is examined without checking\nfor its presence. This results in a NULL pointer dereference if the field\nis missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.","status":"published","published":"2026-04-08T00:30:25Z","modified":"2026-05-12T15:31:15Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T15:08:03.879292Z"}],"nvd":[{"id":"CVE-2026-28390","description":"Issue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyTransportRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyTransportRecipientInfo with\nRSA-OAEP encryption is processed, the optional parameters field of\nRSA-OAEP SourceFunc algorithm identifier is examined without checking\nfor its presence. This results in a NULL pointer dereference if the field\nis missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.","status":"published","published":"2026-04-07T22:16:21.19Z","modified":"2026-07-24T23:10:00.563Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T14:12:13.535987Z"}],"osv":[{"id":"ALPINE-CVE-2026-28390","description":"Issue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyTransportRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyTransportRecipientInfo with\nRSA-OAEP encryption is processed, the optional parameters field of\nRSA-OAEP SourceFunc algorithm identifier is examined without checking\nfor its presence. This results in a NULL pointer dereference if the field\nis missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.","status":"published","published":"2026-04-07T22:16:21.19Z","modified":"2026-10-01T02:17:49.226076719Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:27:50.269992Z"},{"id":"BELL-CVE-2026-28390","status":"published","published":"2026-04-09T01:49:02.654626Z","modified":"2026-04-22T07:15:56.351239Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:23.315185Z"},{"id":"CVE-2026-28390","title":"Possible NULL Dereference When Processing CMS KeyTransportRecipientInfo","description":"Issue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyTransportRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyTransportRecipientInfo with\nRSA-OAEP encryption is processed, the optional parameters field of\nRSA-OAEP SourceFunc algorithm identifier is examined without checking\nfor its presence. This results in a NULL pointer dereference if the field\nis missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.","status":"published","published":"2026-04-07T22:00:54.172Z","modified":"2026-11-11T13:23:05.417853796Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-476"],"updated_at":"2026-11-11T11:06:43.350251Z"},{"id":"DEBIAN-CVE-2026-28390","description":"Issue summary: During processing of a crafted CMS EnvelopedData message with KeyTransportRecipientInfo a NULL pointer dereference can happen.  Impact summary: Applications that process attacker-controlled CMS data may crash before authentication or cryptographic operations occur resulting in Denial of Service.  When a CMS EnvelopedData message that uses KeyTransportRecipientInfo with RSA-OAEP encryption is processed, the optional parameters field of RSA-OAEP SourceFunc algorithm identifier is examined without checking for its presence. This results in a NULL pointer dereference if the field is missing.  Applications and services that call CMS_decrypt() on untrusted input (e.g., S/MIME processing or CMS-based protocols) are vulnerable.  The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.","status":"published","published":"2026-04-07T22:16:21.19Z","modified":"2026-10-01T03:03:07.953618101Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:53.877573Z"},{"id":"JLSEC-2026-275","description":"Issue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyTransportRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyTransportRecipientInfo with\nRSA-OAEP encryption is processed, the optional parameters field of\nRSA-OAEP SourceFunc algorithm identifier is examined without checking\nfor its presence. This results in a NULL pointer dereference if the field\nis missing.\n\nApplications and services that call `CMS_decrypt()` on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.","status":"published","published":"2026-04-27T18:33:55.942Z","modified":"2026-08-13T13:00:03.336973781Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:47:18.573531Z"},{"id":"OESA-2026-2041","title":"openssl security update","description":"Security Fix(es):\n\nIssue summary: An uncommon configuration of clients performing DANE TLSA-based\nserver authentication, when paired with uncommon server DANE TLSA records, may\nresult in a use-after-free and/or double-free on the client side.\n\nImpact summary: A use after free can have a range of potential consequences\nsuch as the corruption of valid data, crashes or execution of arbitrary code.\n\nHowever, the issue only affects clients that make use of TLSA records with both\nthe PKIX-TA(0/PKIX-EE(1) certificate usages and the DANE-TA(2) certificate\nusage.\n\nBy far the most common deployment of DANE is in SMTP MTAs for which RFC7672\nrecommends that clients treat as \u0026apos;unusable\u0026apos; any TLSA records that have the PKIX\ncertificate usages.  These SMTP (or other similar) clients are not vulnerable\nto this issue.  Conversely, any clients that support only the PKIX usages, and\nignore the DANE-TA(2) usage are also not vulnerable.\n\nThe client would also need to be communicating with a server that publishes a\nTLSA RRset with both types of TLSA records.\n\nNo FIPS modules are affected by this issue, the problem code is outside the\nFIPS module boundary.(CVE-2026-28387)\n\nIssue summary: When a delta CRL that contains a Delta CRL Indicator extension\nis processed a NULL pointer dereference might happen if the required CRL\nNumber extension is missing.\n\nImpact summary: A NULL pointer dereference can trigger a crash which\nleads to a Denial of Service for an application.\n\nWhen CRL processing and delta CRL processing is enabled during X.509\ncertificate verification, the delta CRL processing does not check\nwhether the CRL Number extension is NULL before dereferencing it.\nWhen a malformed delta CRL file is being processed, this parameter\ncan be NULL, causing a NULL pointer dereference.\n\nExploiting this issue requires the X509_V_FLAG_USE_DELTAS flag to be enabled in\nthe verification context, the certificate being verified to contain a\nfreshestCRL extension or the base CRL to have the EXFLAG_FRESHEST flag set, and\nan attacker to provide a malformed CRL to an application that processes it.\n\nThe vulnerability is limited to Denial of Service and cannot be escalated to\nachieve code execution or memory disclosure. For that reason the issue was\nassessed as Low severity according to our Security Policy.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the affected code is outside the OpenSSL FIPS module boundary.(CVE-2026-28388)\n\nIssue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyAgreeRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyAgreeRecipientInfo is\nprocessed, the optional parameters field of KeyEncryptionAlgorithmIdentifier\nis examined without checking for its presence. This results in a NULL\npointer dereference if the field is missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.(CVE-2026-28389)\n\nIssue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyTransportRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyTransportRecipientInfo with\nRSA-OAEP encryption is processed, the optional parameters field of\nRSA-OAEP SourceFunc algorithm identifier is examined without checking\nfor its presence. This results in a NULL pointer dereference if the field\nis missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.(CVE-2026-28390)\n\nIssue summary: Converting an excessively large OCTET STRING value to\na hexadecimal string leads to a heap buffer overflow on 32 bit platforms.\n\nImpact summary: A heap buffer overflow may lead to a crash or possibly\nan attacker controlled code execution or other undefined behavior.\n\nIf an attacker can supply a crafted X.509 certificate with an excessively\nlarge OCTET STRING value in extensions such as the Subject Key Identifier\n(SKID) or Authority Key Identifier (AKID) which are being converted to hex,\nthe size of the buffer needed for the result is calculated as multiplication\nof the input length by 3. On 32 bit platforms, this multiplication may overflow\nresulting in the allocation of a smaller buffer and a heap buffer overflow.\n\nApplications and services that print or log contents of untrusted X.509\ncertificates are vulnerable to this issue. As the certificates would have\nto have sizes of over 1 Gigabyte, printing or logging such certificates\nis a fairly unlikely operation and only 32 bit platforms are affected,\nthis issue was assigned Low severity.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.(CVE-2026-31789)\n\nIssue summary: Applications using RSASVE key encapsulation to establish\na secret encryption key can send contents of an uninitialized memory buffer to\na malicious peer.\n\nImpact summary: The uninitialized buffer might contain sensitive data from the\nprevious execution of the application process which leads to sensitive data\nleakage to an attacker.\n\nRSA_public_encrypt() returns the number of bytes written on success and -1\non error. The affected code tests only whether the return value is non-zero.\nAs a result, if RSA encryption fails, encapsulation can still return success to\nthe caller, set the output lengths, and leave the caller to use the contents of\nthe ciphertext buffer as if a valid KEM ciphertext had been produced.\n\nIf applications use EVP_PKEY_encapsulate() with RSA/RSASVE on an\nattacker-supplied invalid RSA public key without first validating that key,\nthen this may cause stale or uninitialized contents of the caller-provided\nciphertext buffer to be disclosed to the attacker in place of the KEM\nciphertext.\n\nAs a workaround calling EVP_PKEY_public_check() or\nEVP_PKEY_public_check_quick() before EVP_PKEY_encapsulate() will mitigate\nthe issue.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3, 3.1 and 3.0 are affected by this issue.(CVE-2026-31790)","status":"published","published":"2026-04-25T11:11:02Z","modified":"2026-08-18T01:19:56.494969704Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:46.087701Z"},{"id":"OESA-2026-2042","title":"openssl security update","description":"Security Fix(es):\n\nIssue summary: An uncommon configuration of clients performing DANE TLSA-based\nserver authentication, when paired with uncommon server DANE TLSA records, may\nresult in a use-after-free and/or double-free on the client side.\n\nImpact summary: A use after free can have a range of potential consequences\nsuch as the corruption of valid data, crashes or execution of arbitrary code.\n\nHowever, the issue only affects clients that make use of TLSA records with both\nthe PKIX-TA(0/PKIX-EE(1) certificate usages and the DANE-TA(2) certificate\nusage.\n\nBy far the most common deployment of DANE is in SMTP MTAs for which RFC7672\nrecommends that clients treat as \u0026apos;unusable\u0026apos; any TLSA records that have the PKIX\ncertificate usages.  These SMTP (or other similar) clients are not vulnerable\nto this issue.  Conversely, any clients that support only the PKIX usages, and\nignore the DANE-TA(2) usage are also not vulnerable.\n\nThe client would also need to be communicating with a server that publishes a\nTLSA RRset with both types of TLSA records.\n\nNo FIPS modules are affected by this issue, the problem code is outside the\nFIPS module boundary.(CVE-2026-28387)\n\nIssue summary: When a delta CRL that contains a Delta CRL Indicator extension\nis processed a NULL pointer dereference might happen if the required CRL\nNumber extension is missing.\n\nImpact summary: A NULL pointer dereference can trigger a crash which\nleads to a Denial of Service for an application.\n\nWhen CRL processing and delta CRL processing is enabled during X.509\ncertificate verification, the delta CRL processing does not check\nwhether the CRL Number extension is NULL before dereferencing it.\nWhen a malformed delta CRL file is being processed, this parameter\ncan be NULL, causing a NULL pointer dereference.\n\nExploiting this issue requires the X509_V_FLAG_USE_DELTAS flag to be enabled in\nthe verification context, the certificate being verified to contain a\nfreshestCRL extension or the base CRL to have the EXFLAG_FRESHEST flag set, and\nan attacker to provide a malformed CRL to an application that processes it.\n\nThe vulnerability is limited to Denial of Service and cannot be escalated to\nachieve code execution or memory disclosure. For that reason the issue was\nassessed as Low severity according to our Security Policy.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the affected code is outside the OpenSSL FIPS module boundary.(CVE-2026-28388)\n\nIssue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyAgreeRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyAgreeRecipientInfo is\nprocessed, the optional parameters field of KeyEncryptionAlgorithmIdentifier\nis examined without checking for its presence. This results in a NULL\npointer dereference if the field is missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.(CVE-2026-28389)\n\nIssue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyTransportRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyTransportRecipientInfo with\nRSA-OAEP encryption is processed, the optional parameters field of\nRSA-OAEP SourceFunc algorithm identifier is examined without checking\nfor its presence. This results in a NULL pointer dereference if the field\nis missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.(CVE-2026-28390)\n\nIssue summary: Converting an excessively large OCTET STRING value to\na hexadecimal string leads to a heap buffer overflow on 32 bit platforms.\n\nImpact summary: A heap buffer overflow may lead to a crash or possibly\nan attacker controlled code execution or other undefined behavior.\n\nIf an attacker can supply a crafted X.509 certificate with an excessively\nlarge OCTET STRING value in extensions such as the Subject Key Identifier\n(SKID) or Authority Key Identifier (AKID) which are being converted to hex,\nthe size of the buffer needed for the result is calculated as multiplication\nof the input length by 3. On 32 bit platforms, this multiplication may overflow\nresulting in the allocation of a smaller buffer and a heap buffer overflow.\n\nApplications and services that print or log contents of untrusted X.509\ncertificates are vulnerable to this issue. As the certificates would have\nto have sizes of over 1 Gigabyte, printing or logging such certificates\nis a fairly unlikely operation and only 32 bit platforms are affected,\nthis issue was assigned Low severity.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.(CVE-2026-31789)\n\nIssue summary: Applications using RSASVE key encapsulation to establish\na secret encryption key can send contents of an uninitialized memory buffer to\na malicious peer.\n\nImpact summary: The uninitialized buffer might contain sensitive data from the\nprevious execution of the application process which leads to sensitive data\nleakage to an attacker.\n\nRSA_public_encrypt() returns the number of bytes written on success and -1\non error. The affected code tests only whether the return value is non-zero.\nAs a result, if RSA encryption fails, encapsulation can still return success to\nthe caller, set the output lengths, and leave the caller to use the contents of\nthe ciphertext buffer as if a valid KEM ciphertext had been produced.\n\nIf applications use EVP_PKEY_encapsulate() with RSA/RSASVE on an\nattacker-supplied invalid RSA public key without first validating that key,\nthen this may cause stale or uninitialized contents of the caller-provided\nciphertext buffer to be disclosed to the attacker in place of the KEM\nciphertext.\n\nAs a workaround calling EVP_PKEY_public_check() or\nEVP_PKEY_public_check_quick() before EVP_PKEY_encapsulate() will mitigate\nthe issue.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3, 3.1 and 3.0 are affected by this issue.(CVE-2026-31790)","status":"published","published":"2026-04-25T11:11:02Z","modified":"2026-08-18T01:19:44.594600507Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:46.087701Z"},{"id":"OESA-2026-2043","title":"openssl security update","description":"Security Fix(es):\n\nIssue summary: An uncommon configuration of clients performing DANE TLSA-based\nserver authentication, when paired with uncommon server DANE TLSA records, may\nresult in a use-after-free and/or double-free on the client side.\n\nImpact summary: A use after free can have a range of potential consequences\nsuch as the corruption of valid data, crashes or execution of arbitrary code.\n\nHowever, the issue only affects clients that make use of TLSA records with both\nthe PKIX-TA(0/PKIX-EE(1) certificate usages and the DANE-TA(2) certificate\nusage.\n\nBy far the most common deployment of DANE is in SMTP MTAs for which RFC7672\nrecommends that clients treat as \u0026apos;unusable\u0026apos; any TLSA records that have the PKIX\ncertificate usages.  These SMTP (or other similar) clients are not vulnerable\nto this issue.  Conversely, any clients that support only the PKIX usages, and\nignore the DANE-TA(2) usage are also not vulnerable.\n\nThe client would also need to be communicating with a server that publishes a\nTLSA RRset with both types of TLSA records.\n\nNo FIPS modules are affected by this issue, the problem code is outside the\nFIPS module boundary.(CVE-2026-28387)\n\nIssue summary: When a delta CRL that contains a Delta CRL Indicator extension\nis processed a NULL pointer dereference might happen if the required CRL\nNumber extension is missing.\n\nImpact summary: A NULL pointer dereference can trigger a crash which\nleads to a Denial of Service for an application.\n\nWhen CRL processing and delta CRL processing is enabled during X.509\ncertificate verification, the delta CRL processing does not check\nwhether the CRL Number extension is NULL before dereferencing it.\nWhen a malformed delta CRL file is being processed, this parameter\ncan be NULL, causing a NULL pointer dereference.\n\nExploiting this issue requires the X509_V_FLAG_USE_DELTAS flag to be enabled in\nthe verification context, the certificate being verified to contain a\nfreshestCRL extension or the base CRL to have the EXFLAG_FRESHEST flag set, and\nan attacker to provide a malformed CRL to an application that processes it.\n\nThe vulnerability is limited to Denial of Service and cannot be escalated to\nachieve code execution or memory disclosure. For that reason the issue was\nassessed as Low severity according to our Security Policy.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the affected code is outside the OpenSSL FIPS module boundary.(CVE-2026-28388)\n\nIssue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyAgreeRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyAgreeRecipientInfo is\nprocessed, the optional parameters field of KeyEncryptionAlgorithmIdentifier\nis examined without checking for its presence. This results in a NULL\npointer dereference if the field is missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.(CVE-2026-28389)\n\nIssue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyTransportRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyTransportRecipientInfo with\nRSA-OAEP encryption is processed, the optional parameters field of\nRSA-OAEP SourceFunc algorithm identifier is examined without checking\nfor its presence. This results in a NULL pointer dereference if the field\nis missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.(CVE-2026-28390)\n\nIssue summary: Converting an excessively large OCTET STRING value to\na hexadecimal string leads to a heap buffer overflow on 32 bit platforms.\n\nImpact summary: A heap buffer overflow may lead to a crash or possibly\nan attacker controlled code execution or other undefined behavior.\n\nIf an attacker can supply a crafted X.509 certificate with an excessively\nlarge OCTET STRING value in extensions such as the Subject Key Identifier\n(SKID) or Authority Key Identifier (AKID) which are being converted to hex,\nthe size of the buffer needed for the result is calculated as multiplication\nof the input length by 3. On 32 bit platforms, this multiplication may overflow\nresulting in the allocation of a smaller buffer and a heap buffer overflow.\n\nApplications and services that print or log contents of untrusted X.509\ncertificates are vulnerable to this issue. As the certificates would have\nto have sizes of over 1 Gigabyte, printing or logging such certificates\nis a fairly unlikely operation and only 32 bit platforms are affected,\nthis issue was assigned Low severity.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.(CVE-2026-31789)\n\nIssue summary: Applications using RSASVE key encapsulation to establish\na secret encryption key can send contents of an uninitialized memory buffer to\na malicious peer.\n\nImpact summary: The uninitialized buffer might contain sensitive data from the\nprevious execution of the application process which leads to sensitive data\nleakage to an attacker.\n\nRSA_public_encrypt() returns the number of bytes written on success and -1\non error. The affected code tests only whether the return value is non-zero.\nAs a result, if RSA encryption fails, encapsulation can still return success to\nthe caller, set the output lengths, and leave the caller to use the contents of\nthe ciphertext buffer as if a valid KEM ciphertext had been produced.\n\nIf applications use EVP_PKEY_encapsulate() with RSA/RSASVE on an\nattacker-supplied invalid RSA public key without first validating that key,\nthen this may cause stale or uninitialized contents of the caller-provided\nciphertext buffer to be disclosed to the attacker in place of the KEM\nciphertext.\n\nAs a workaround calling EVP_PKEY_public_check() or\nEVP_PKEY_public_check_quick() before EVP_PKEY_encapsulate() will mitigate\nthe issue.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3, 3.1 and 3.0 are affected by this issue.(CVE-2026-31790)","status":"published","published":"2026-04-25T11:11:02Z","modified":"2026-08-18T01:19:56.441268425Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:46.087701Z"},{"id":"OESA-2026-2044","title":"openssl security update","description":"Security Fix(es):\n\nIssue summary: An uncommon configuration of clients performing DANE TLSA-based\nserver authentication, when paired with uncommon server DANE TLSA records, may\nresult in a use-after-free and/or double-free on the client side.\n\nImpact summary: A use after free can have a range of potential consequences\nsuch as the corruption of valid data, crashes or execution of arbitrary code.\n\nHowever, the issue only affects clients that make use of TLSA records with both\nthe PKIX-TA(0/PKIX-EE(1) certificate usages and the DANE-TA(2) certificate\nusage.\n\nBy far the most common deployment of DANE is in SMTP MTAs for which RFC7672\nrecommends that clients treat as \u0026apos;unusable\u0026apos; any TLSA records that have the PKIX\ncertificate usages.  These SMTP (or other similar) clients are not vulnerable\nto this issue.  Conversely, any clients that support only the PKIX usages, and\nignore the DANE-TA(2) usage are also not vulnerable.\n\nThe client would also need to be communicating with a server that publishes a\nTLSA RRset with both types of TLSA records.\n\nNo FIPS modules are affected by this issue, the problem code is outside the\nFIPS module boundary.(CVE-2026-28387)\n\nIssue summary: When a delta CRL that contains a Delta CRL Indicator extension\nis processed a NULL pointer dereference might happen if the required CRL\nNumber extension is missing.\n\nImpact summary: A NULL pointer dereference can trigger a crash which\nleads to a Denial of Service for an application.\n\nWhen CRL processing and delta CRL processing is enabled during X.509\ncertificate verification, the delta CRL processing does not check\nwhether the CRL Number extension is NULL before dereferencing it.\nWhen a malformed delta CRL file is being processed, this parameter\ncan be NULL, causing a NULL pointer dereference.\n\nExploiting this issue requires the X509_V_FLAG_USE_DELTAS flag to be enabled in\nthe verification context, the certificate being verified to contain a\nfreshestCRL extension or the base CRL to have the EXFLAG_FRESHEST flag set, and\nan attacker to provide a malformed CRL to an application that processes it.\n\nThe vulnerability is limited to Denial of Service and cannot be escalated to\nachieve code execution or memory disclosure. For that reason the issue was\nassessed as Low severity according to our Security Policy.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the affected code is outside the OpenSSL FIPS module boundary.(CVE-2026-28388)\n\nIssue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyAgreeRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyAgreeRecipientInfo is\nprocessed, the optional parameters field of KeyEncryptionAlgorithmIdentifier\nis examined without checking for its presence. This results in a NULL\npointer dereference if the field is missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.(CVE-2026-28389)\n\nIssue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyTransportRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyTransportRecipientInfo with\nRSA-OAEP encryption is processed, the optional parameters field of\nRSA-OAEP SourceFunc algorithm identifier is examined without checking\nfor its presence. This results in a NULL pointer dereference if the field\nis missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.(CVE-2026-28390)","status":"published","published":"2026-04-25T11:11:02Z","modified":"2026-08-18T01:19:56.342776511Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:46.087701Z"},{"id":"OESA-2026-2045","title":"openssl security update","description":"Security Fix(es):\n\nIssue summary: An uncommon configuration of clients performing DANE TLSA-based\nserver authentication, when paired with uncommon server DANE TLSA records, may\nresult in a use-after-free and/or double-free on the client side.\n\nImpact summary: A use after free can have a range of potential consequences\nsuch as the corruption of valid data, crashes or execution of arbitrary code.\n\nHowever, the issue only affects clients that make use of TLSA records with both\nthe PKIX-TA(0/PKIX-EE(1) certificate usages and the DANE-TA(2) certificate\nusage.\n\nBy far the most common deployment of DANE is in SMTP MTAs for which RFC7672\nrecommends that clients treat as \u0026apos;unusable\u0026apos; any TLSA records that have the PKIX\ncertificate usages.  These SMTP (or other similar) clients are not vulnerable\nto this issue.  Conversely, any clients that support only the PKIX usages, and\nignore the DANE-TA(2) usage are also not vulnerable.\n\nThe client would also need to be communicating with a server that publishes a\nTLSA RRset with both types of TLSA records.\n\nNo FIPS modules are affected by this issue, the problem code is outside the\nFIPS module boundary.(CVE-2026-28387)\n\nIssue summary: When a delta CRL that contains a Delta CRL Indicator extension\nis processed a NULL pointer dereference might happen if the required CRL\nNumber extension is missing.\n\nImpact summary: A NULL pointer dereference can trigger a crash which\nleads to a Denial of Service for an application.\n\nWhen CRL processing and delta CRL processing is enabled during X.509\ncertificate verification, the delta CRL processing does not check\nwhether the CRL Number extension is NULL before dereferencing it.\nWhen a malformed delta CRL file is being processed, this parameter\ncan be NULL, causing a NULL pointer dereference.\n\nExploiting this issue requires the X509_V_FLAG_USE_DELTAS flag to be enabled in\nthe verification context, the certificate being verified to contain a\nfreshestCRL extension or the base CRL to have the EXFLAG_FRESHEST flag set, and\nan attacker to provide a malformed CRL to an application that processes it.\n\nThe vulnerability is limited to Denial of Service and cannot be escalated to\nachieve code execution or memory disclosure. For that reason the issue was\nassessed as Low severity according to our Security Policy.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the affected code is outside the OpenSSL FIPS module boundary.(CVE-2026-28388)\n\nIssue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyAgreeRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyAgreeRecipientInfo is\nprocessed, the optional parameters field of KeyEncryptionAlgorithmIdentifier\nis examined without checking for its presence. This results in a NULL\npointer dereference if the field is missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.(CVE-2026-28389)\n\nIssue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyTransportRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyTransportRecipientInfo with\nRSA-OAEP encryption is processed, the optional parameters field of\nRSA-OAEP SourceFunc algorithm identifier is examined without checking\nfor its presence. This results in a NULL pointer dereference if the field\nis missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.(CVE-2026-28390)","status":"published","published":"2026-04-25T11:11:02Z","modified":"2026-08-18T01:19:49.308515463Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:46.087701Z"},{"id":"OESA-2026-2189","title":"compat-openssl11 security update","description":"OpenSSL is a robust, commercial-grade, and full-featured toolkit for the Transport Layer Security (TLS) and Secure Sockets Layer (SSL) protocols.\r\n\r\nSecurity Fix(es):\n\nIssue summary: An invalid or NULL pointer dereference can happen in\nan application processing a malformed PKCS#12 file.\n\nImpact summary: An application processing a malformed PKCS#12 file can be\ncaused to dereference an invalid or NULL pointer on memory read, resulting\nin a Denial of Service.\n\nA type confusion vulnerability exists in PKCS#12 parsing code where\nan ASN1_TYPE union member is accessed without first validating the type,\ncausing an invalid pointer read.\n\nThe location is constrained to a 1-byte address space, meaning any\nattempted pointer manipulation can only target addresses between 0x00 and 0xFF.\nThis range corresponds to the zero page, which is unmapped on most modern\noperating systems and will reliably result in a crash, leading only to a\nDenial of Service. Exploiting this issue also requires a user or application\nto process a maliciously crafted PKCS#12 file. It is uncommon to accept\nuntrusted PKCS#12 files in applications as they are usually used to store\nprivate keys which are trusted by definition. For these reasons, the issue\nwas assessed as Low severity.\n\nThe FIPS modules in 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the PKCS12 implementation is outside the OpenSSL FIPS module boundary.\n\nOpenSSL 3.6, 3.5, 3.4, 3.3, 3.0 and 1.1.1 are vulnerable to this issue.\n\nOpenSSL 1.0.2 is not affected by this issue.(CVE-2026-22795)\n\nIssue summary: An uncommon configuration of clients performing DANE TLSA-based\nserver authentication, when paired with uncommon server DANE TLSA records, may\nresult in a use-after-free and/or double-free on the client side.\n\nImpact summary: A use after free can have a range of potential consequences\nsuch as the corruption of valid data, crashes or execution of arbitrary code.\n\nHowever, the issue only affects clients that make use of TLSA records with both\nthe PKIX-TA(0/PKIX-EE(1) certificate usages and the DANE-TA(2) certificate\nusage.\n\nBy far the most common deployment of DANE is in SMTP MTAs for which RFC7672\nrecommends that clients treat as \u0026apos;unusable\u0026apos; any TLSA records that have the PKIX\ncertificate usages.  These SMTP (or other similar) clients are not vulnerable\nto this issue.  Conversely, any clients that support only the PKIX usages, and\nignore the DANE-TA(2) usage are also not vulnerable.\n\nThe client would also need to be communicating with a server that publishes a\nTLSA RRset with both types of TLSA records.\n\nNo FIPS modules are affected by this issue, the problem code is outside the\nFIPS module boundary.(CVE-2026-28387)\n\nIssue summary: When a delta CRL that contains a Delta CRL Indicator extension\nis processed a NULL pointer dereference might happen if the required CRL\nNumber extension is missing.\n\nImpact summary: A NULL pointer dereference can trigger a crash which\nleads to a Denial of Service for an application.\n\nWhen CRL processing and delta CRL processing is enabled during X.509\ncertificate verification, the delta CRL processing does not check\nwhether the CRL Number extension is NULL before dereferencing it.\nWhen a malformed delta CRL file is being processed, this parameter\ncan be NULL, causing a NULL pointer dereference.\n\nExploiting this issue requires the X509_V_FLAG_USE_DELTAS flag to be enabled in\nthe verification context, the certificate being verified to contain a\nfreshestCRL extension or the base CRL to have the EXFLAG_FRESHEST flag set, and\nan attacker to provide a malformed CRL to an application that processes it.\n\nThe vulnerability is limited to Denial of Service and cannot be escalated to\nachieve code execution or memory disclosure. For that reason the issue was\nassessed as Low severity according to our Security Policy.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the affected code is outside the OpenSSL FIPS module boundary.(CVE-2026-28388)\n\nIssue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyAgreeRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyAgreeRecipientInfo is\nprocessed, the optional parameters field of KeyEncryptionAlgorithmIdentifier\nis examined without checking for its presence. This results in a NULL\npointer dereference if the field is missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.(CVE-2026-28389)\n\nIssue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyTransportRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyTransportRecipientInfo with\nRSA-OAEP encryption is processed, the optional parameters field of\nRSA-OAEP SourceFunc algorithm identifier is examined without checking\nfor its presence. This results in a NULL pointer dereference if the field\nis missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.(CVE-2026-28390)","status":"published","published":"2026-05-03T11:11:10Z","modified":"2026-08-18T01:19:50.936078875Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:46.087701Z"},{"id":"OESA-2026-2190","title":"compat-openssl11 security update","description":"OpenSSL is a robust, commercial-grade, and full-featured toolkit for the Transport Layer Security (TLS) and Secure Sockets Layer (SSL) protocols.\r\n\r\nSecurity Fix(es):\n\nIssue summary: An invalid or NULL pointer dereference can happen in\nan application processing a malformed PKCS#12 file.\n\nImpact summary: An application processing a malformed PKCS#12 file can be\ncaused to dereference an invalid or NULL pointer on memory read, resulting\nin a Denial of Service.\n\nA type confusion vulnerability exists in PKCS#12 parsing code where\nan ASN1_TYPE union member is accessed without first validating the type,\ncausing an invalid pointer read.\n\nThe location is constrained to a 1-byte address space, meaning any\nattempted pointer manipulation can only target addresses between 0x00 and 0xFF.\nThis range corresponds to the zero page, which is unmapped on most modern\noperating systems and will reliably result in a crash, leading only to a\nDenial of Service. Exploiting this issue also requires a user or application\nto process a maliciously crafted PKCS#12 file. It is uncommon to accept\nuntrusted PKCS#12 files in applications as they are usually used to store\nprivate keys which are trusted by definition. For these reasons, the issue\nwas assessed as Low severity.\n\nThe FIPS modules in 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the PKCS12 implementation is outside the OpenSSL FIPS module boundary.\n\nOpenSSL 3.6, 3.5, 3.4, 3.3, 3.0 and 1.1.1 are vulnerable to this issue.\n\nOpenSSL 1.0.2 is not affected by this issue.(CVE-2026-22795)\n\nIssue summary: An uncommon configuration of clients performing DANE TLSA-based\nserver authentication, when paired with uncommon server DANE TLSA records, may\nresult in a use-after-free and/or double-free on the client side.\n\nImpact summary: A use after free can have a range of potential consequences\nsuch as the corruption of valid data, crashes or execution of arbitrary code.\n\nHowever, the issue only affects clients that make use of TLSA records with both\nthe PKIX-TA(0/PKIX-EE(1) certificate usages and the DANE-TA(2) certificate\nusage.\n\nBy far the most common deployment of DANE is in SMTP MTAs for which RFC7672\nrecommends that clients treat as \u0026apos;unusable\u0026apos; any TLSA records that have the PKIX\ncertificate usages.  These SMTP (or other similar) clients are not vulnerable\nto this issue.  Conversely, any clients that support only the PKIX usages, and\nignore the DANE-TA(2) usage are also not vulnerable.\n\nThe client would also need to be communicating with a server that publishes a\nTLSA RRset with both types of TLSA records.\n\nNo FIPS modules are affected by this issue, the problem code is outside the\nFIPS module boundary.(CVE-2026-28387)\n\nIssue summary: When a delta CRL that contains a Delta CRL Indicator extension\nis processed a NULL pointer dereference might happen if the required CRL\nNumber extension is missing.\n\nImpact summary: A NULL pointer dereference can trigger a crash which\nleads to a Denial of Service for an application.\n\nWhen CRL processing and delta CRL processing is enabled during X.509\ncertificate verification, the delta CRL processing does not check\nwhether the CRL Number extension is NULL before dereferencing it.\nWhen a malformed delta CRL file is being processed, this parameter\ncan be NULL, causing a NULL pointer dereference.\n\nExploiting this issue requires the X509_V_FLAG_USE_DELTAS flag to be enabled in\nthe verification context, the certificate being verified to contain a\nfreshestCRL extension or the base CRL to have the EXFLAG_FRESHEST flag set, and\nan attacker to provide a malformed CRL to an application that processes it.\n\nThe vulnerability is limited to Denial of Service and cannot be escalated to\nachieve code execution or memory disclosure. For that reason the issue was\nassessed as Low severity according to our Security Policy.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the affected code is outside the OpenSSL FIPS module boundary.(CVE-2026-28388)\n\nIssue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyAgreeRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyAgreeRecipientInfo is\nprocessed, the optional parameters field of KeyEncryptionAlgorithmIdentifier\nis examined without checking for its presence. This results in a NULL\npointer dereference if the field is missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.(CVE-2026-28389)\n\nIssue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyTransportRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyTransportRecipientInfo with\nRSA-OAEP encryption is processed, the optional parameters field of\nRSA-OAEP SourceFunc algorithm identifier is examined without checking\nfor its presence. This results in a NULL pointer dereference if the field\nis missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.(CVE-2026-28390)","status":"published","published":"2026-05-03T11:11:10Z","modified":"2026-08-18T01:19:51.819303807Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:46.087701Z"},{"id":"OESA-2026-2191","title":"compat-openssl11 security update","description":"OpenSSL is a robust, commercial-grade, and full-featured toolkit for the Transport Layer Security (TLS) and Secure Sockets Layer (SSL) protocols.\r\n\r\nSecurity Fix(es):\n\nIssue summary: An invalid or NULL pointer dereference can happen in\nan application processing a malformed PKCS#12 file.\n\nImpact summary: An application processing a malformed PKCS#12 file can be\ncaused to dereference an invalid or NULL pointer on memory read, resulting\nin a Denial of Service.\n\nA type confusion vulnerability exists in PKCS#12 parsing code where\nan ASN1_TYPE union member is accessed without first validating the type,\ncausing an invalid pointer read.\n\nThe location is constrained to a 1-byte address space, meaning any\nattempted pointer manipulation can only target addresses between 0x00 and 0xFF.\nThis range corresponds to the zero page, which is unmapped on most modern\noperating systems and will reliably result in a crash, leading only to a\nDenial of Service. Exploiting this issue also requires a user or application\nto process a maliciously crafted PKCS#12 file. It is uncommon to accept\nuntrusted PKCS#12 files in applications as they are usually used to store\nprivate keys which are trusted by definition. For these reasons, the issue\nwas assessed as Low severity.\n\nThe FIPS modules in 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the PKCS12 implementation is outside the OpenSSL FIPS module boundary.\n\nOpenSSL 3.6, 3.5, 3.4, 3.3, 3.0 and 1.1.1 are vulnerable to this issue.\n\nOpenSSL 1.0.2 is not affected by this issue.(CVE-2026-22795)\n\nIssue summary: An uncommon configuration of clients performing DANE TLSA-based\nserver authentication, when paired with uncommon server DANE TLSA records, may\nresult in a use-after-free and/or double-free on the client side.\n\nImpact summary: A use after free can have a range of potential consequences\nsuch as the corruption of valid data, crashes or execution of arbitrary code.\n\nHowever, the issue only affects clients that make use of TLSA records with both\nthe PKIX-TA(0/PKIX-EE(1) certificate usages and the DANE-TA(2) certificate\nusage.\n\nBy far the most common deployment of DANE is in SMTP MTAs for which RFC7672\nrecommends that clients treat as \u0026apos;unusable\u0026apos; any TLSA records that have the PKIX\ncertificate usages.  These SMTP (or other similar) clients are not vulnerable\nto this issue.  Conversely, any clients that support only the PKIX usages, and\nignore the DANE-TA(2) usage are also not vulnerable.\n\nThe client would also need to be communicating with a server that publishes a\nTLSA RRset with both types of TLSA records.\n\nNo FIPS modules are affected by this issue, the problem code is outside the\nFIPS module boundary.(CVE-2026-28387)\n\nIssue summary: When a delta CRL that contains a Delta CRL Indicator extension\nis processed a NULL pointer dereference might happen if the required CRL\nNumber extension is missing.\n\nImpact summary: A NULL pointer dereference can trigger a crash which\nleads to a Denial of Service for an application.\n\nWhen CRL processing and delta CRL processing is enabled during X.509\ncertificate verification, the delta CRL processing does not check\nwhether the CRL Number extension is NULL before dereferencing it.\nWhen a malformed delta CRL file is being processed, this parameter\ncan be NULL, causing a NULL pointer dereference.\n\nExploiting this issue requires the X509_V_FLAG_USE_DELTAS flag to be enabled in\nthe verification context, the certificate being verified to contain a\nfreshestCRL extension or the base CRL to have the EXFLAG_FRESHEST flag set, and\nan attacker to provide a malformed CRL to an application that processes it.\n\nThe vulnerability is limited to Denial of Service and cannot be escalated to\nachieve code execution or memory disclosure. For that reason the issue was\nassessed as Low severity according to our Security Policy.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the affected code is outside the OpenSSL FIPS module boundary.(CVE-2026-28388)\n\nIssue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyAgreeRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyAgreeRecipientInfo is\nprocessed, the optional parameters field of KeyEncryptionAlgorithmIdentifier\nis examined without checking for its presence. This results in a NULL\npointer dereference if the field is missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.(CVE-2026-28389)\n\nIssue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyTransportRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyTransportRecipientInfo with\nRSA-OAEP encryption is processed, the optional parameters field of\nRSA-OAEP SourceFunc algorithm identifier is examined without checking\nfor its presence. This results in a NULL pointer dereference if the field\nis missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.(CVE-2026-28390)","status":"published","published":"2026-05-03T11:11:10Z","modified":"2026-08-18T01:19:50.918351295Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:46.087701Z"},{"id":"OESA-2026-2619","title":"edk2 security update","description":"EDK II is a modern, feature-rich, cross-platform firmware development environment for the UEFI and PI specifications.\r\n\r\nSecurity Fix(es):\n\nIssue summary: An uncommon configuration of clients performing DANE TLSA-based\nserver authentication, when paired with uncommon server DANE TLSA records, may\nresult in a use-after-free and/or double-free on the client side.\n\nImpact summary: A use after free can have a range of potential consequences\nsuch as the corruption of valid data, crashes or execution of arbitrary code.\n\nHowever, the issue only affects clients that make use of TLSA records with both\nthe PKIX-TA(0/PKIX-EE(1) certificate usages and the DANE-TA(2) certificate\nusage.\n\nBy far the most common deployment of DANE is in SMTP MTAs for which RFC7672\nrecommends that clients treat as \u0026apos;unusable\u0026apos; any TLSA records that have the PKIX\ncertificate usages.  These SMTP (or other similar) clients are not vulnerable\nto this issue.  Conversely, any clients that support only the PKIX usages, and\nignore the DANE-TA(2) usage are also not vulnerable.\n\nThe client would also need to be communicating with a server that publishes a\nTLSA RRset with both types of TLSA records.\n\nNo FIPS modules are affected by this issue, the problem code is outside the\nFIPS module boundary.(CVE-2026-28387)\n\nIssue summary: When a delta CRL that contains a Delta CRL Indicator extension\nis processed a NULL pointer dereference might happen if the required CRL\nNumber extension is missing.\n\nImpact summary: A NULL pointer dereference can trigger a crash which\nleads to a Denial of Service for an application.\n\nWhen CRL processing and delta CRL processing is enabled during X.509\ncertificate verification, the delta CRL processing does not check\nwhether the CRL Number extension is NULL before dereferencing it.\nWhen a malformed delta CRL file is being processed, this parameter\ncan be NULL, causing a NULL pointer dereference.\n\nExploiting this issue requires the X509_V_FLAG_USE_DELTAS flag to be enabled in\nthe verification context, the certificate being verified to contain a\nfreshestCRL extension or the base CRL to have the EXFLAG_FRESHEST flag set, and\nan attacker to provide a malformed CRL to an application that processes it.\n\nThe vulnerability is limited to Denial of Service and cannot be escalated to\nachieve code execution or memory disclosure. For that reason the issue was\nassessed as Low severity according to our Security Policy.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the affected code is outside the OpenSSL FIPS module boundary.(CVE-2026-28388)\n\nIssue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyAgreeRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyAgreeRecipientInfo is\nprocessed, the optional parameters field of KeyEncryptionAlgorithmIdentifier\nis examined without checking for its presence. This results in a NULL\npointer dereference if the field is missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.(CVE-2026-28389)\n\nIssue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyTransportRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyTransportRecipientInfo with\nRSA-OAEP encryption is processed, the optional parameters field of\nRSA-OAEP SourceFunc algorithm identifier is examined without checking\nfor its presence. This results in a NULL pointer dereference if the field\nis missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.(CVE-2026-28390)\n\nIssue summary: Converting an excessively large OCTET STRING value to\na hexadecimal string leads to a heap buffer overflow on 32 bit platforms.\n\nImpact summary: A heap buffer overflow may lead to a crash or possibly\nan attacker controlled code execution or other undefined behavior.\n\nIf an attacker can supply a crafted X.509 certificate with an excessively\nlarge OCTET STRING value in extensions such as the Subject Key Identifier\n(SKID) or Authority Key Identifier (AKID) which are being converted to hex,\nthe size of the buffer needed for the result is calculated as multiplication\nof the input length by 3. On 32 bit platforms, this multiplication may overflow\nresulting in the allocation of a smaller buffer and a heap buffer overflow.\n\nApplications and services that print or log contents of untrusted X.509\ncertificates are vulnerable to this issue. As the certificates would have\nto have sizes of over 1 Gigabyte, printing or logging such certificates\nis a fairly unlikely operation and only 32 bit platforms are affected,\nthis issue was assigned Low severity.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.(CVE-2026-31789)","status":"published","published":"2026-06-12T11:11:33Z","modified":"2026-08-18T01:20:03.840404273Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:46.449097Z"},{"id":"OESA-2026-2622","title":"edk2 security update","description":"EDK II is a modern, feature-rich, cross-platform firmware development environment for the UEFI and PI specifications.\r\n\r\nSecurity Fix(es):\n\nIssue summary: An uncommon configuration of clients performing DANE TLSA-based\nserver authentication, when paired with uncommon server DANE TLSA records, may\nresult in a use-after-free and/or double-free on the client side.\n\nImpact summary: A use after free can have a range of potential consequences\nsuch as the corruption of valid data, crashes or execution of arbitrary code.\n\nHowever, the issue only affects clients that make use of TLSA records with both\nthe PKIX-TA(0/PKIX-EE(1) certificate usages and the DANE-TA(2) certificate\nusage.\n\nBy far the most common deployment of DANE is in SMTP MTAs for which RFC7672\nrecommends that clients treat as \u0026apos;unusable\u0026apos; any TLSA records that have the PKIX\ncertificate usages.  These SMTP (or other similar) clients are not vulnerable\nto this issue.  Conversely, any clients that support only the PKIX usages, and\nignore the DANE-TA(2) usage are also not vulnerable.\n\nThe client would also need to be communicating with a server that publishes a\nTLSA RRset with both types of TLSA records.\n\nNo FIPS modules are affected by this issue, the problem code is outside the\nFIPS module boundary.(CVE-2026-28387)\n\nIssue summary: When a delta CRL that contains a Delta CRL Indicator extension\nis processed a NULL pointer dereference might happen if the required CRL\nNumber extension is missing.\n\nImpact summary: A NULL pointer dereference can trigger a crash which\nleads to a Denial of Service for an application.\n\nWhen CRL processing and delta CRL processing is enabled during X.509\ncertificate verification, the delta CRL processing does not check\nwhether the CRL Number extension is NULL before dereferencing it.\nWhen a malformed delta CRL file is being processed, this parameter\ncan be NULL, causing a NULL pointer dereference.\n\nExploiting this issue requires the X509_V_FLAG_USE_DELTAS flag to be enabled in\nthe verification context, the certificate being verified to contain a\nfreshestCRL extension or the base CRL to have the EXFLAG_FRESHEST flag set, and\nan attacker to provide a malformed CRL to an application that processes it.\n\nThe vulnerability is limited to Denial of Service and cannot be escalated to\nachieve code execution or memory disclosure. For that reason the issue was\nassessed as Low severity according to our Security Policy.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the affected code is outside the OpenSSL FIPS module boundary.(CVE-2026-28388)\n\nIssue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyAgreeRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyAgreeRecipientInfo is\nprocessed, the optional parameters field of KeyEncryptionAlgorithmIdentifier\nis examined without checking for its presence. This results in a NULL\npointer dereference if the field is missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.(CVE-2026-28389)\n\nIssue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyTransportRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyTransportRecipientInfo with\nRSA-OAEP encryption is processed, the optional parameters field of\nRSA-OAEP SourceFunc algorithm identifier is examined without checking\nfor its presence. This results in a NULL pointer dereference if the field\nis missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.(CVE-2026-28390)\n\nIssue summary: Converting an excessively large OCTET STRING value to\na hexadecimal string leads to a heap buffer overflow on 32 bit platforms.\n\nImpact summary: A heap buffer overflow may lead to a crash or possibly\nan attacker controlled code execution or other undefined behavior.\n\nIf an attacker can supply a crafted X.509 certificate with an excessively\nlarge OCTET STRING value in extensions such as the Subject Key Identifier\n(SKID) or Authority Key Identifier (AKID) which are being converted to hex,\nthe size of the buffer needed for the result is calculated as multiplication\nof the input length by 3. On 32 bit platforms, this multiplication may overflow\nresulting in the allocation of a smaller buffer and a heap buffer overflow.\n\nApplications and services that print or log contents of untrusted X.509\ncertificates are vulnerable to this issue. As the certificates would have\nto have sizes of over 1 Gigabyte, printing or logging such certificates\nis a fairly unlikely operation and only 32 bit platforms are affected,\nthis issue was assigned Low severity.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.(CVE-2026-31789)","status":"published","published":"2026-06-12T11:11:33Z","modified":"2026-08-18T01:20:03.726471239Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:46.449097Z"},{"id":"RHSA-2026:14217","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-05-07T10:07:51Z","modified":"2026-10-20T10:04:55Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:18.520917Z"},{"id":"RHSA-2026:22312","title":"Red Hat Security Advisory: openssl security update","status":"published","published":"2026-06-02T10:08:36Z","modified":"2026-10-20T10:06:10Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:18.983284Z"},{"id":"RHSA-2026:22313","title":"Red Hat Security Advisory: compat-openssl11 security update","status":"published","published":"2026-06-02T10:08:37Z","modified":"2026-10-20T10:06:11Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:18.983284Z"},{"id":"RHSA-2026:22314","title":"Red Hat Security Advisory: openssl security update","status":"published","published":"2026-06-02T10:08:37Z","modified":"2026-10-20T10:06:11Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:18.983284Z"},{"id":"RHSA-2026:22315","title":"Red Hat Security Advisory: compat-openssl10 security update","status":"published","published":"2026-06-02T10:08:38Z","modified":"2026-10-20T10:06:12Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:18.983284Z"},{"id":"RHSA-2026:35869","title":"Red Hat Security Advisory: compat-openssl11 security update","status":"published","published":"2026-07-06T10:08:07Z","modified":"2026-10-20T10:07:49Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:19.963895Z"},{"id":"RHSA-2026:36217","title":"Red Hat Security Advisory: compat-openssl10 security update","status":"published","published":"2026-07-08T10:09:21Z","modified":"2026-10-20T10:07:55Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:19.963895Z"},{"id":"RHSA-2026:38503","title":"Red Hat Security Advisory: openssl security update","status":"published","published":"2026-07-13T10:07:43Z","modified":"2026-10-20T10:08:25Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:20.491441Z"},{"id":"RHSA-2026:38804","title":"Red Hat Security Advisory: openssl security update","status":"published","published":"2026-07-13T10:07:51Z","modified":"2026-10-20T10:08:31Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:20.491441Z"},{"id":"RHSA-2026:38805","title":"Red Hat Security Advisory: openssl security update","status":"published","published":"2026-07-13T10:07:51Z","modified":"2026-10-20T10:08:31Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:20.491441Z"},{"id":"RHSA-2026:39009","title":"Red Hat Security Advisory: compat-openssl11 security update","status":"published","published":"2026-07-14T10:09:21Z","modified":"2026-10-20T10:08:33Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:20.491441Z"},{"id":"RHSA-2026:39012","title":"Red Hat Security Advisory: compat-openssl11 security update","status":"published","published":"2026-07-14T10:09:23Z","modified":"2026-10-20T10:08:34Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:20.491441Z"},{"id":"RHSA-2026:39297","title":"Red Hat Security Advisory: edk2 security, bug fix, and enhancement update","status":"published","published":"2026-07-15T10:10:15Z","modified":"2026-10-20T10:08:37Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:20.491441Z"},{"id":"RHSA-2026:43513","title":"Red Hat Security Advisory: openssl security update","status":"published","published":"2026-07-23T10:14:31Z","modified":"2026-10-20T10:09:13Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:20.491441Z"},{"id":"RHSA-2026:44480","title":"Red Hat Security Advisory: compat-openssl10 security update","status":"published","published":"2026-07-24T10:10:36Z","modified":"2026-10-20T10:09:31Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:20.491441Z"},{"id":"RHSA-2026:47096","title":"Red Hat Security Advisory: compat-openssl10 security update","status":"published","published":"2026-07-29T10:11:37Z","modified":"2026-10-20T10:09:49Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:20.984762Z"},{"id":"RHSA-2026:58563","title":"Red Hat Security Advisory: openssl security update","status":"published","published":"2026-08-24T10:18:42Z","modified":"2026-10-20T10:11:46Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.457353Z"},{"id":"RHSA-2026:71542","title":"Red Hat Security Advisory: openssl security update","status":"published","published":"2026-09-25T10:15:28Z","modified":"2026-10-20T10:14:55Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RHSA-2026:7261","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-04-20T10:11:08Z","modified":"2026-10-20T10:15:09Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RHSA-2026:83617","title":"Red Hat Security Advisory: openssl security update","status":"published","published":"2026-10-16T10:27:34Z","modified":"2026-10-20T10:17:18Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T15:53:23.547034Z"},{"id":"RHSA-2026:84572","title":"Red Hat Security Advisory: openssl security update","status":"published","published":"2026-10-19T10:07:55Z","modified":"2026-10-20T10:17:29Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T15:53:23.547034Z"},{"id":"RHSA-2026:84573","title":"Red Hat Security Advisory: openssl security update","status":"published","published":"2026-10-20T10:17:30Z","modified":"2026-10-20T10:32:22.469975676Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T15:53:23.547034Z"},{"id":"RLSA-2026:22312","title":"Moderate: openssl security update","description":"OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library.\n\nSecurity Fix(es):\n\n* openssl: OpenSSL: Denial of Service due to NULL pointer dereference in CMS EnvelopedData processing (CVE-2026-28390)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-06-02T18:03:08.506628Z","modified":"2026-06-02T18:25:41.054582739Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:25.804165Z"},{"id":"RLSA-2026:22313","title":"Moderate: compat-openssl11 security update","description":"The OpenSSL toolkit provides support for secure communications between machines. This version of OpenSSL package contains only the libraries from the 1.1.1 version and is provided for compatibility with previous releases.\n\nSecurity Fix(es):\n\n* openssl: OpenSSL: Denial of Service due to NULL pointer dereference in CMS EnvelopedData processing (CVE-2026-28390)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-06-02T18:03:08.506628Z","modified":"2026-06-02T18:25:41.065411762Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:25.804165Z"},{"id":"RLSA-2026:22314","title":"Moderate: openssl security update","description":"OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library.\n\nSecurity Fix(es):\n\n* openssl: OpenSSL: Denial of Service due to NULL pointer dereference in CMS EnvelopedData processing (CVE-2026-28390)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-06-05T12:04:50.053452Z","modified":"2026-06-05T12:30:04.658300343Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:25.804165Z"},{"id":"RLSA-2026:22315","title":"Moderate: compat-openssl10 security update","description":"The OpenSSL toolkit provides support for secure communications between machines. This version of OpenSSL package contains only the libraries and is provided for compatibility with previous releases and software that does not support compilation with OpenSSL-1.1.\n\nSecurity Fix(es):\n\n* openssl: OpenSSL: Denial of Service due to NULL pointer dereference in CMS EnvelopedData processing (CVE-2026-28390)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-06-05T06:00:56.049991Z","modified":"2026-06-05T06:30:08.197333986Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:25.804165Z"},{"id":"RLSA-2026:38503","title":"Moderate: openssl security update","description":"OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library.\n\nSecurity Fix(es):\n\n* openssl: OpenSSL: Denial of Service due to NULL pointer dereference in CMS EnvelopedData processing (CVE-2026-28390)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-07-14T06:00:42.485918Z","modified":"2026-07-14T06:30:04.781423727Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.111232Z"},{"id":"RLSA-2026:39297","title":"Moderate: edk2 security, bug fix, and enhancement update","description":"EDK (Embedded Development Kit) is a project to enable UEFI support for Virtual Machines. This package contains a sample 64-bit UEFI firmware for QEMU and KVM. \n\nSecurity Fix(es):\n\n* openssl: openssl: Information Disclosure from Uninitialized Memory via Invalid RSA Public Key (CVE-2026-31790)\n\n* openssl: OpenSSL: Denial of Service due to NULL pointer dereference in CMS EnvelopedData processing (CVE-2026-28390)\n\nBug Fix(es) and Enhancement(s):\n\n* edk2/x64: re-enable legacy kernel loader [rhel-10.2.z] (JIRA:Rocky Linux-182421)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-07-15T12:06:01.640959Z","modified":"2026-07-15T12:30:04.941103613Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.111232Z"},{"id":"ROOT-OS-ALPINE-315-CVE-2026-28390","title":"CVE-2026-28390 in openssl - Patched by Root","description":"Root has patched CVE-2026-28390 in the openssl package for Root:Alpine:3.15. Multiple fixed versions available.","status":"published","published":"2026-10-13T15:12:42Z","modified":"2026-10-13T16:15:23.603321544Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:28.259095Z"},{"id":"ROOT-OS-ALPINE-317-CVE-2026-28390","title":"CVE-2026-28390 in openssl - Patched by Root","description":"Root has patched CVE-2026-28390 in the openssl package for Root:Alpine:3.17. Multiple fixed versions available.","status":"published","published":"2026-10-15T06:28:37Z","modified":"2026-10-15T07:15:05.107504171Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:28.259095Z"},{"id":"UBUNTU-CVE-2026-28390","description":"Issue summary: During processing of a crafted CMS EnvelopedData message with KeyTransportRecipientInfo a NULL pointer dereference can happen. Impact summary: Applications that process attacker-controlled CMS data may crash before authentication or cryptographic operations occur resulting in Denial of Service. When a CMS EnvelopedData message that uses KeyTransportRecipientInfo with RSA-OAEP encryption is processed, the optional parameters field of RSA-OAEP SourceFunc algorithm identifier is examined without checking for its presence. This results in a NULL pointer dereference if the field is missing. Applications and services that call CMS_decrypt() on untrusted input (e.g., S/MIME processing or CMS-based protocols) are vulnerable. The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary. Impact summary: Applications that process attacker-controlled CMS data may crash before authentication or cryptographic operations occur resulting in Denial of Service. When a CMS EnvelopedData message that uses KeyTransportRecipientInfo with RSA-OAEP encryption is processed, the optional parameters field of RSA-OAEP SourceFunc algorithm identifier is examined without checking for its presence. This results in a NULL pointer dereference if the field is missing. Applications and services that call CMS_decrypt() on untrusted input (e.g., S/MIME processing or CMS-based protocols) are vulnerable. The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.","status":"published","published":"2026-04-07T00:00:00Z","modified":"2026-10-17T12:58:08.251174772Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:56:08.726452Z"},{"id":"ALSA-2026:22312","title":"Moderate: openssl security update","description":"OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library.  \n\nSecurity Fix(es):  \n\n  * openssl: OpenSSL: Denial of Service due to NULL pointer dereference in CMS EnvelopedData processing (CVE-2026-28390)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-06-01T00:00:00Z","modified":"2026-10-29T11:42:25.662759251Z","updated_at":"2026-11-02T15:27:54.283654Z"},{"id":"ALSA-2026:22313","title":"Moderate: compat-openssl11 security update","description":"The OpenSSL toolkit provides support for secure communications between machines. This version of OpenSSL package contains only the libraries from the 1.1.1 version and is provided for compatibility with previous releases.  \n\nSecurity Fix(es):  \n\n  * openssl: OpenSSL: Denial of Service due to NULL pointer dereference in CMS EnvelopedData processing (CVE-2026-28390)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-06-01T00:00:00Z","modified":"2026-10-29T11:32:33.983108455Z","updated_at":"2026-11-02T15:27:54.283654Z"},{"id":"ALSA-2026:22314","title":"Moderate: openssl security update","description":"OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library.  \n\nSecurity Fix(es):  \n\n  * openssl: OpenSSL: Denial of Service due to NULL pointer dereference in CMS EnvelopedData processing (CVE-2026-28390)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-06-01T00:00:00Z","modified":"2026-10-29T11:30:24.744808311Z","updated_at":"2026-11-02T15:27:54.283654Z"},{"id":"ALSA-2026:22315","title":"Moderate: compat-openssl10 security update","description":"The OpenSSL toolkit provides support for secure communications between machines. This version of OpenSSL package contains only the libraries and is provided for compatibility with previous releases and software that does not support compilation with OpenSSL-1.1.  \n\nSecurity Fix(es):  \n\n  * openssl: OpenSSL: Denial of Service due to NULL pointer dereference in CMS EnvelopedData processing (CVE-2026-28390)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-06-01T00:00:00Z","modified":"2026-10-29T11:02:23.534025416Z","updated_at":"2026-11-02T15:27:54.283654Z"}]},"sources_more":{"osv":37}}