{"id":"AZL-97671","summary":"CVE-2026-75803 affecting package openssl-fips-provider 3.1.2-2","details":"Issue summary: ChaCha20-Poly1305 and AES-OCB decryption with an empty\nciphertext can report success without verifying the supplied authentication\ntag when the operation is finalized by calling the EVP_Cipher() function.\n\nImpact summary: Applications calling EVP_Cipher() on an empty ciphertext and\nexpecting the call to check the AEAD tag may accept forged messages.\n\nCWE: CWE-354 (Improper Validation of Integrity Check Value)\n\nDescription: The EVP_Cipher() API call for AEAD ciphers behaves like a one\nshot encryption and decryption call. It also verifies the AEAD tag after the\ndecryption operation. However for AES-OCB and ChaCha20-Poly1305 ciphers\nit skipped the AEAD tag verification when an empty ciphertext was passed to\nthe function. The callers of this function might believe that a successful\nreturn indicates a valid AEAD tag for these ciphers, even when that has not\ntruly been validated in this case.\n\nFIPS impact: no\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this CVE\nas the affected algorithms are not FIPS approved and thus not implemented\nin the FIPS module.","modified":"2026-08-30T05:24:52Z","published":"2026-08-25T13:19:29Z","upstream":["CVE-2026-75803"],"references":[{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75803"}],"affected":[{"package":{"name":"openssl-fips-provider","ecosystem":"Azure Linux:3","purl":"pkg:rpm/azure-linux/openssl-fips-provider"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.1.2-2"}]}],"database_specific":{"source":"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-97671.json"}}],"schema_version":"1.9.0"}