{"id":"CLSA-2026-1780062952","summary":"Fix CVE(s): CVE-2026-28389","details":"   * SECURITY UPDATE: NULL pointer dereference in CMS EnvelopedData processing\n     when a KeyAgreeRecipientInfo message omits the optional parameters field of\n     KeyEncryptionAlgorithmIdentifier. Both dh_cms_set_shared_info() and\n     ecdh_cms_set_shared_info() dereference alg-\u003eparameter without a NULL check,\n     allowing a remote attacker to crash applications that process untrusted CMS\n     data (e.g. S/MIME decryption), causing Denial of Service before any\n     authentication or cryptographic operations occur.\n     - debian/patches/CVE-2026-28389.patch: use X509_ALGOR_get0() to safely\n       extract algorithm OID and parameter type/value in dh_cms_set_shared_info()\n       in crypto/dh/dh_ameth.c and ecdh_cms_set_shared_info() in\n       crypto/ec/ec_ameth.c instead of dereferencing alg-\u003eparameter directly\n     - CVE-2026-28389","modified":"2026-06-04T09:47:21.962885320Z","published":"2026-05-29T13:55:57Z","upstream":["CVE-2026-28389"],"references":[{"type":"ADVISORY","url":"https://errata.tuxcare.com/els_os/ubuntu20.04els/CLSA-2026-1780062952.html"}],"affected":[{"package":{"name":"libssl-dev","ecosystem":"TuxCare:Ubuntu:20.04","purl":"pkg:deb/tuxcare/libssl-dev?distro=ubuntu-20.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1f-1ubuntu2.24+tuxcare.els5"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1780062952.json"}},{"package":{"name":"libssl-doc","ecosystem":"TuxCare:Ubuntu:20.04","purl":"pkg:deb/tuxcare/libssl-doc?distro=ubuntu-20.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1f-1ubuntu2.24+tuxcare.els5"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1780062952.json"}},{"package":{"name":"libssl1.1","ecosystem":"TuxCare:Ubuntu:20.04","purl":"pkg:deb/tuxcare/libssl1.1?distro=ubuntu-20.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1f-1ubuntu2.24+tuxcare.els5"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1780062952.json"}},{"package":{"name":"openssl","ecosystem":"TuxCare:Ubuntu:20.04","purl":"pkg:deb/tuxcare/openssl?distro=ubuntu-20.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1f-1ubuntu2.24+tuxcare.els5"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1780062952.json"}}],"schema_version":"1.7.5"}