{ "document": { "aggregate_severity": { "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "TuxCare License Agreement", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Cloud Linux Inc. and provide a link to the original.", "title": "Terms of Use" }, { "category": "details", "text": "CVE-2026-28387: fix use-after-free in DANE client code by using X509_free()\n instead of OPENSSL_free() to properly release reference-counted X509 objects\n- CVE-2026-28388: fix NULL pointer dereference when processing a delta CRL\n that has a Delta CRL Indicator but lacks a CRL Number extension\n- CVE-2026-28389: fix NULL pointer dereference in CMS KeyAgreeRecipientInfo\n processing when KeyEncryptionAlgorithmIdentifier omits the optional\n parameter field, by using safe X509_ALGOR_get0() extraction\n- CVE-2026-28390: fix NULL pointer dereference in CMS KeyTransportRecipientInfo\n processing when RSA-OAEP SourceFunc parameters are missing, by using safe\n X509_ALGOR_get0() extraction and OPENSSL_memdup() for label data", "title": "Details" } ], "publisher": { "category": "vendor", "contact_details": "https://tuxcare.com/contact/", "name": "TuxCare", "namespace": "https://tuxcare.com/" }, "references": [ { "category": "self", "summary": "https://cve.tuxcare.com/els-alt-common/releases/CLSA-2026:1776705646", "url": "https://cve.tuxcare.com/els-alt-common/releases/CLSA-2026:1776705646" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.tuxcare.com/csaf/v2/els_alt_common/el8/advisories/2026/clsa-2026_1776705646.json" } ], "tracking": { "current_release_date": "2026-04-20T17:21:38Z", "generator": { "date": "2026-04-20T17:21:38Z", "engine": { "name": "pyCSAF" } }, "id": "CLSA-2026:1776705646", "initial_release_date": "2026-04-20T17:21:38Z", "revision_history": [ { "date": "2026-04-20T17:21:38Z", "number": "1", "summary": "Initial version" } ], "status": "final", "version": "1" }, "title": "alt-openssl11: Fix of 4 CVEs" }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Community Enterprise Operating System 8", "product": { "name": "Community Enterprise Operating System 8", "product_id": "CentOS-8", "product_identification_helper": { "cpe": "cpe:2.3:o:centos:centos:8:*:*:*:*:*:*:*" } } } ], "category": "product_family", "name": "Community Enterprise Operating System" } ], "category": "vendor", "name": "Cloud Linux Software, Inc." }, { "branches": [ { "branches": [ { "category": "product_version", "name": "alt-openssl11-1:1.1.1w-3.3.el8.x86_64", "product": { "name": "alt-openssl11-1:1.1.1w-3.3.el8.x86_64", "product_id": "alt-openssl11-1:1.1.1w-3.3.el8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/alt-openssl11@1.1.1w-3.3.el8?arch=x86_64&epoch=1&os_name=centos&os_version=8" } } }, { "category": "product_version", "name": "alt-openssl11-devel-1:1.1.1w-3.3.el8.x86_64", "product": { "name": "alt-openssl11-devel-1:1.1.1w-3.3.el8.x86_64", "product_id": "alt-openssl11-devel-1:1.1.1w-3.3.el8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/alt-openssl11-devel@1.1.1w-3.3.el8?arch=x86_64&epoch=1&os_name=centos&os_version=8" } } }, { "category": "product_version", "name": "alt-openssl11-libs-1:1.1.1w-3.3.el8.x86_64", "product": { "name": "alt-openssl11-libs-1:1.1.1w-3.3.el8.x86_64", "product_id": "alt-openssl11-libs-1:1.1.1w-3.3.el8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/alt-openssl11-libs@1.1.1w-3.3.el8?arch=x86_64&epoch=1&os_name=centos&os_version=8" } } } ], "category": "architecture", "name": "x86_64" } ], "category": "vendor", "name": "TuxCare" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "alt-openssl11-1:1.1.1w-3.3.el8.x86_64 as a component of Community Enterprise Operating System 8", "product_id": "CentOS-8:alt-openssl11-1:1.1.1w-3.3.el8.x86_64" }, "product_reference": "alt-openssl11-1:1.1.1w-3.3.el8.x86_64", "relates_to_product_reference": "CentOS-8" }, { "category": "default_component_of", "full_product_name": { "name": "alt-openssl11-devel-1:1.1.1w-3.3.el8.x86_64 as a component of Community Enterprise Operating System 8", "product_id": "CentOS-8:alt-openssl11-devel-1:1.1.1w-3.3.el8.x86_64" }, "product_reference": "alt-openssl11-devel-1:1.1.1w-3.3.el8.x86_64", "relates_to_product_reference": "CentOS-8" }, { "category": "default_component_of", "full_product_name": { "name": "alt-openssl11-libs-1:1.1.1w-3.3.el8.x86_64 as a component of Community Enterprise Operating System 8", "product_id": "CentOS-8:alt-openssl11-libs-1:1.1.1w-3.3.el8.x86_64" }, "product_reference": "alt-openssl11-libs-1:1.1.1w-3.3.el8.x86_64", "relates_to_product_reference": "CentOS-8" } ] }, "vulnerabilities": [ { "cve": "CVE-2026-28389", "cwe": { "id": "CWE-166", "name": "Improper Handling of Missing Special Element" }, "notes": [ { "category": "description", "text": "Issue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyAgreeRecipientInfo a NULL pointer dereference can happen.\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\nWhen a CMS EnvelopedData message that uses KeyAgreeRecipientInfo is\nprocessed, the optional parameters field of KeyEncryptionAlgorithmIdentifier\nis examined without checking for its presence. This results in a NULL\npointer dereference if the field is missing.\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "CentOS-8:alt-openssl11-1:1.1.1w-3.3.el8.x86_64", "CentOS-8:alt-openssl11-devel-1:1.1.1w-3.3.el8.x86_64", "CentOS-8:alt-openssl11-libs-1:1.1.1w-3.3.el8.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els-alt-common/cve/CVE-2026-28389" } ], "release_date": "2026-04-07T00:00:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-04-20T17:20:48.810025Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els-alt-common/releases/CLSA-2026:1776705646", "product_ids": [ "CentOS-8:alt-openssl11-1:1.1.1w-3.3.el8.x86_64", "CentOS-8:alt-openssl11-devel-1:1.1.1w-3.3.el8.x86_64", "CentOS-8:alt-openssl11-libs-1:1.1.1w-3.3.el8.x86_64" ], "url": "https://cve.tuxcare.com/els-alt-common/releases/CLSA-2026:1776705646" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "CentOS-8:alt-openssl11-1:1.1.1w-3.3.el8.x86_64", "CentOS-8:alt-openssl11-devel-1:1.1.1w-3.3.el8.x86_64", "CentOS-8:alt-openssl11-libs-1:1.1.1w-3.3.el8.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ] }, { "cve": "CVE-2026-28390", "cwe": { "id": "CWE-476", "name": "NULL Pointer Dereference" }, "notes": [ { "category": "description", "text": "Issue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyTransportRecipientInfo a NULL pointer dereference can happen.\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\nWhen a CMS EnvelopedData message that uses KeyTransportRecipientInfo with\nRSA-OAEP encryption is processed, the optional parameters field of\nRSA-OAEP SourceFunc algorithm identifier is examined without checking\nfor its presence. This results in a NULL pointer dereference if the field\nis missing.\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "CentOS-8:alt-openssl11-1:1.1.1w-3.3.el8.x86_64", "CentOS-8:alt-openssl11-devel-1:1.1.1w-3.3.el8.x86_64", "CentOS-8:alt-openssl11-libs-1:1.1.1w-3.3.el8.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els-alt-common/cve/CVE-2026-28390" } ], "release_date": "2026-04-07T22:00:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-04-20T17:20:48.810025Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els-alt-common/releases/CLSA-2026:1776705646", "product_ids": [ "CentOS-8:alt-openssl11-1:1.1.1w-3.3.el8.x86_64", "CentOS-8:alt-openssl11-devel-1:1.1.1w-3.3.el8.x86_64", "CentOS-8:alt-openssl11-libs-1:1.1.1w-3.3.el8.x86_64" ], "url": "https://cve.tuxcare.com/els-alt-common/releases/CLSA-2026:1776705646" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "CentOS-8:alt-openssl11-1:1.1.1w-3.3.el8.x86_64", "CentOS-8:alt-openssl11-devel-1:1.1.1w-3.3.el8.x86_64", "CentOS-8:alt-openssl11-libs-1:1.1.1w-3.3.el8.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-28388", "cwe": { "id": "CWE-476", "name": "NULL Pointer Dereference" }, "notes": [ { "category": "description", "text": "Issue summary: When a delta CRL that contains a Delta CRL Indicator extension\nis processed a NULL pointer dereference might happen if the required CRL\nNumber extension is missing.\nImpact summary: A NULL pointer dereference can trigger a crash which\nleads to a Denial of Service for an application.\nWhen CRL processing and delta CRL processing is enabled during X.509\ncertificate verification, the delta CRL processing does not check\nwhether the CRL Number extension is NULL before dereferencing it.\nWhen a malformed delta CRL file is being processed, this parameter\ncan be NULL, causing a NULL pointer dereference.\nExploiting this issue requires the X509_V_FLAG_USE_DELTAS flag to be enabled in\nthe verification context, the certificate being verified to contain a\nfreshestCRL extension or the base CRL to have the EXFLAG_FRESHEST flag set, and\nan attacker to provide a malformed CRL to an application that processes it.\nThe vulnerability is limited to Denial of Service and cannot be escalated to\nachieve code execution or memory disclosure. For that reason the issue was\nassessed as Low severity according to our Security Policy.\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the affected code is outside the OpenSSL FIPS module boundary.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "CentOS-8:alt-openssl11-1:1.1.1w-3.3.el8.x86_64", "CentOS-8:alt-openssl11-devel-1:1.1.1w-3.3.el8.x86_64", "CentOS-8:alt-openssl11-libs-1:1.1.1w-3.3.el8.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els-alt-common/cve/CVE-2026-28388" } ], "release_date": "2026-04-07T00:00:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-04-20T17:20:48.810025Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els-alt-common/releases/CLSA-2026:1776705646", "product_ids": [ "CentOS-8:alt-openssl11-1:1.1.1w-3.3.el8.x86_64", "CentOS-8:alt-openssl11-devel-1:1.1.1w-3.3.el8.x86_64", "CentOS-8:alt-openssl11-libs-1:1.1.1w-3.3.el8.x86_64" ], "url": "https://cve.tuxcare.com/els-alt-common/releases/CLSA-2026:1776705646" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "CentOS-8:alt-openssl11-1:1.1.1w-3.3.el8.x86_64", "CentOS-8:alt-openssl11-devel-1:1.1.1w-3.3.el8.x86_64", "CentOS-8:alt-openssl11-libs-1:1.1.1w-3.3.el8.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ] }, { "cve": "CVE-2026-28387", "cwe": { "id": "CWE-1341", "name": "Multiple Releases of Same Resource or Handle" }, "notes": [ { "category": "description", "text": "A flaw was found in OpenSSL. An uncommon configuration of clients performing DANE TLSA-based server authentication, when paired with uncommon server DANE TLSA records, may result in a use-after-free and/or double-free on the client side. This vulnerability could lead to data corruption, application crashes, or, in severe cases, arbitrary code execution. This issue is highly specific and uncommon, as it only affects clients using both PKIX-TA(0)/PKIX-EE(1) and DANE-TA(2) certificate usages and communicating with a server publishing a TLSA record set with both types of records.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "CentOS-8:alt-openssl11-1:1.1.1w-3.3.el8.x86_64", "CentOS-8:alt-openssl11-devel-1:1.1.1w-3.3.el8.x86_64", "CentOS-8:alt-openssl11-libs-1:1.1.1w-3.3.el8.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els-alt-common/cve/CVE-2026-28387" } ], "release_date": "2026-04-07T00:00:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-04-20T17:20:48.810025Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els-alt-common/releases/CLSA-2026:1776705646", "product_ids": [ "CentOS-8:alt-openssl11-1:1.1.1w-3.3.el8.x86_64", "CentOS-8:alt-openssl11-devel-1:1.1.1w-3.3.el8.x86_64", "CentOS-8:alt-openssl11-libs-1:1.1.1w-3.3.el8.x86_64" ], "url": "https://cve.tuxcare.com/els-alt-common/releases/CLSA-2026:1776705646" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 3.7, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1" }, "products": [ "CentOS-8:alt-openssl11-1:1.1.1w-3.3.el8.x86_64", "CentOS-8:alt-openssl11-devel-1:1.1.1w-3.3.el8.x86_64", "CentOS-8:alt-openssl11-libs-1:1.1.1w-3.3.el8.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ] } ] }