Release date:
2026-05-06 12:39:15 UTC
Description:
- CVE-2026-28387: fix use of OPENSSL_free instead of X509_free on
dane->mcert in dane_match() (X509 reference-count bypass / UAF)
- CVE-2026-28388: fix NULL deref in check_delta_base when a delta CRL
carries the Delta CRL Indicator extension but lacks a CRL Number
- CVE-2026-28389: fix NULL deref in dh_cms_set_shared_info /
ecdh_cms_set_shared_info on absent CMS KARI parameters
- CVE-2026-31789: fix integer overflow in OPENSSL_buf2hexstr causing
heap OOB write when converting > SIZE_MAX/3 bytes (32-bit builds)
Updated packages:
-
openssl-3.0.7-20.el9_2.tuxcare.1.els11.x86_64.rpm
sha:3ac3e097cf0a5683e73cec38b376f2e36dd0db333d5fe36c0947ed82573e1065
-
openssl-devel-3.0.7-20.el9_2.tuxcare.1.els11.i686.rpm
sha:15a3e2cabc6b1fad07c34f0764294ad567808b20a52d4c1d3c37425503f73390
-
openssl-devel-3.0.7-20.el9_2.tuxcare.1.els11.x86_64.rpm
sha:a2edb2308433d4af222ceee05f821d438bf162f0045341ab3bc5bd704b9f1468
-
openssl-libs-3.0.7-20.el9_2.tuxcare.1.els11.i686.rpm
sha:8f147558bc02a3bf8ef37438cbd249ad72dfa05c6c4c4a29b910dc5dbd9bbbc0
-
openssl-libs-3.0.7-20.el9_2.tuxcare.1.els11.x86_64.rpm
sha:cc5a787dcc1eb7f5280d640bffe4c53fdc4499abbd35ed510761153aa8547f80
-
openssl-perl-3.0.7-20.el9_2.tuxcare.1.els11.x86_64.rpm
sha:65cb3be1b43626973b9bb59004efb2077b0cb538d20f21a30c8ebe55204b12df
Notes:
This page is generated automatically and has not been checked for errors. For clarification or
corrections please contact the
CloudLinux Packaging Team.
