RHSA-2026:84573HighCVSS 9.1

Red Hat Security Advisory: openssl security update

Published
October 19, 2026
Last Modified
October 19, 2026

🔗 CVE IDs covered (6)

CVE-2025-69418 →CVE-2026-28390 →CVE-2026-31790 →CVE-2026-34182 →CVE-2026-45445 →CVE-2026-45447 →

📋 Description

CVE-2025-69418 — openssl: OpenSSL: Information disclosure and data tampering via specific low-level OCB encryption/decryption calls CVE-2026-28390 — openssl: OpenSSL: Denial of Service due to NULL pointer dereference in CMS EnvelopedData processing CVE-2026-31790 — openssl: openssl: Information Disclosure from Uninitialized Memory via Invalid RSA Public Key CVE-2026-34182 — openssl: CMS AuthEnvelopedData Processing May Accept Forged Messages CVE-2026-45445 — openssl: AES-OCB IV Ignored on EVP_Cipher() Path CVE-2026-45447 — openssl: Heap Use-After-Free in OpenSSL PKCS7_verify()

🎯 Affected products51

  • Red Hat Enterprise Linux AppStream E4S (v.9.4)
  • Red Hat Enterprise Linux BaseOS E4S (v.9.4)
  • openssl-1:3.0.7-29.el9_4.3.aarch64 as a component of Red Hat Enterprise Linux BaseOS E4S (v.9.4)
  • openssl-1:3.0.7-29.el9_4.3.ppc64le as a component of Red Hat Enterprise Linux BaseOS E4S (v.9.4)
  • openssl-1:3.0.7-29.el9_4.3.s390x as a component of Red Hat Enterprise Linux BaseOS E4S (v.9.4)
  • openssl-1:3.0.7-29.el9_4.3.src as a component of Red Hat Enterprise Linux BaseOS E4S (v.9.4)
  • openssl-1:3.0.7-29.el9_4.3.x86_64 as a component of Red Hat Enterprise Linux BaseOS E4S (v.9.4)
  • openssl-debuginfo-1:3.0.7-29.el9_4.3.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)
  • openssl-debuginfo-1:3.0.7-29.el9_4.3.aarch64 as a component of Red Hat Enterprise Linux BaseOS E4S (v.9.4)
  • openssl-debuginfo-1:3.0.7-29.el9_4.3.i686 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)
  • openssl-debuginfo-1:3.0.7-29.el9_4.3.i686 as a component of Red Hat Enterprise Linux BaseOS E4S (v.9.4)
  • openssl-debuginfo-1:3.0.7-29.el9_4.3.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)
  • openssl-debuginfo-1:3.0.7-29.el9_4.3.ppc64le as a component of Red Hat Enterprise Linux BaseOS E4S (v.9.4)
  • openssl-debuginfo-1:3.0.7-29.el9_4.3.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)
  • openssl-debuginfo-1:3.0.7-29.el9_4.3.s390x as a component of Red Hat Enterprise Linux BaseOS E4S (v.9.4)
  • openssl-debuginfo-1:3.0.7-29.el9_4.3.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)
  • openssl-debuginfo-1:3.0.7-29.el9_4.3.x86_64 as a component of Red Hat Enterprise Linux BaseOS E4S (v.9.4)
  • openssl-debugsource-1:3.0.7-29.el9_4.3.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)
  • openssl-debugsource-1:3.0.7-29.el9_4.3.aarch64 as a component of Red Hat Enterprise Linux BaseOS E4S (v.9.4)
  • openssl-debugsource-1:3.0.7-29.el9_4.3.i686 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)
  • openssl-debugsource-1:3.0.7-29.el9_4.3.i686 as a component of Red Hat Enterprise Linux BaseOS E4S (v.9.4)
  • openssl-debugsource-1:3.0.7-29.el9_4.3.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)
  • openssl-debugsource-1:3.0.7-29.el9_4.3.ppc64le as a component of Red Hat Enterprise Linux BaseOS E4S (v.9.4)
  • openssl-debugsource-1:3.0.7-29.el9_4.3.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)
  • openssl-debugsource-1:3.0.7-29.el9_4.3.s390x as a component of Red Hat Enterprise Linux BaseOS E4S (v.9.4)
  • openssl-debugsource-1:3.0.7-29.el9_4.3.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)
  • openssl-debugsource-1:3.0.7-29.el9_4.3.x86_64 as a component of Red Hat Enterprise Linux BaseOS E4S (v.9.4)
  • openssl-devel-1:3.0.7-29.el9_4.3.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)
  • openssl-devel-1:3.0.7-29.el9_4.3.i686 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)
  • openssl-devel-1:3.0.7-29.el9_4.3.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.4)
  • +21 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: Applications that process Cryptographic Message Syntax (CMS) EnvelopedData messages should be configured to only accept input from trusted sources. Restricting network access to services that process untrusted CMS data can also reduce exposure to this Denial of Service vulnerability. Workaround: Systems configured to operate in FIPS mode are not affected by this vulnerability. To mitigate this issue, ensure that OpenSSL is operating in FIPS mode by enabling the system-wide FIPS policy. This may have broader implications for cryptographic operations on the system and should be evaluated for compatibility with existing applications. A system reboot may be required for the changes to take effect.

🔗 References (9)