{"id":"CLSA-2026-1780683040","summary":"openssl11: Fix of 10 CVEs","details":"- CVE-2021-3711: fix SM2 decryption buffer overflow; check the plaintext buffer\n  is large enough when decrypting SM2; add extended tests for SM2\n- CVE-2022-3996: fix X.509 policy constraints double-locking denial of service\n- CVE-2023-0464: fix excessive resource use verifying X.509 policy constraints\n- CVE-2023-0466: fix X509_VERIFY_PARAM_add0_policy() does not enable policy check\n- CVE-2023-2650: restrict the size of OBJECT IDENTIFIERs that OBJ_obj2txt translates\n- CVE-2024-13176: fix timing side-channel in ECDSA signature computation\n- CVE-2024-5535: validate provided client list in SSL_select_next_proto\n- CVE-2025-9230: fix out-of-bounds read and write in RFC 3211 KEK unwrap\n- CVE-2025-69419: fix one-byte write-before-buffer in PKCS#12 BMPString conversion\n- CVE-2025-69421: fix NULL dereference in PKCS12_item_decrypt_d2i_ex()\n- CVE-2026-28387: fix use-after-free / double-free in dane_match()\n- CVE-2026-28388: fix NULL dereference in check_delta_base()\n- CVE-2026-28389: fix NULL dereference in dh/ecdh_cms_set_shared_info()\n- CVE-2026-28390: fix NULL dereference in rsa_cms_decrypt()","modified":"2026-10-26T09:43:24.002329629Z","published":"2026-10-19T20:23:13Z","upstream":["CVE-2021-3711","CVE-2022-3996","CVE-2023-0464","CVE-2023-0466","CVE-2023-2650","CVE-2024-13176","CVE-2024-5535","CVE-2025-69419","CVE-2025-69421","CVE-2025-9230","CVE-2026-28387","CVE-2026-28388","CVE-2026-28389","CVE-2026-28390"],"references":[{"type":"ADVISORY","url":"https://errata.tuxcare.com/els_os/centos7els/CLSA-2026-1780683040.html"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-3711"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-3996"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-0464"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-5535"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-69419"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-69421"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28387"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28388"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28389"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28390"}],"affected":[{"package":{"name":"openssl11","ecosystem":"TuxCare:CentOS:7","purl":"pkg:rpm/tuxcare/openssl11?distro=centos-7"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-7.el7.tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/centos7els/CLSA-2026-1780683040.json"}},{"package":{"name":"openssl11-devel","ecosystem":"TuxCare:CentOS:7","purl":"pkg:rpm/tuxcare/openssl11-devel?distro=centos-7"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-7.el7.tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/centos7els/CLSA-2026-1780683040.json"}},{"package":{"name":"openssl11-libs","ecosystem":"TuxCare:CentOS:7","purl":"pkg:rpm/tuxcare/openssl11-libs?distro=centos-7"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-7.el7.tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/centos7els/CLSA-2026-1780683040.json"}},{"package":{"name":"openssl11-static","ecosystem":"TuxCare:CentOS:7","purl":"pkg:rpm/tuxcare/openssl11-static?distro=centos-7"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1k-7.el7.tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/centos7els/CLSA-2026-1780683040.json"}}],"schema_version":"1.9.0"}