{"id":"CLSA-2026-1781549242","summary":"Fix CVE(s): CVE-2026-34180, CVE-2026-42766, CVE-2026-7383, CVE-2026-9076","details":"   * SECURITY UPDATE: Heap buffer overflow in ASN1_mbstring_ncopy() where\n     the destination length for BMPSTRING and UNIVERSALSTRING output is\n     computed by a signed left shift that can overflow int, producing an\n     undersized allocation followed by out-of-bounds writes for oversized\n     attacker-controlled inputs reaching ASN1_mbstring_copy() or\n     ASN1_mbstring_ncopy() directly.\n     - debian/patches/CVE-2026-7383.patch: reject oversized inputs before\n       the shifts and in out_utf8() in crypto/asn1/a_mbstr.c.\n     - CVE-2026-7383\n   * SECURITY UPDATE: Out-of-bounds read in kek_unwrap_key() check-byte\n     validation when a CMS PasswordRecipientInfo uses a KEK cipher with a\n     block size smaller than 4 octets, making the decrypted buffer smaller\n     than the seven octets the check-byte test reads.\n     - debian/patches/CVE-2026-9076.patch: reject blocklen \u003c 4 and\n       oversized inlen in kek_unwrap_key() in crypto/cms/cms_pwri.c.\n     - CVE-2026-9076\n   * SECURITY UPDATE: Heap buffer over-read in ASN.1 content parsing: the\n     long content length was truncated to int in asn1_ex_c2i(), so\n     ASN1_STRING_set() could be called with an inconsistent length.\n     - debian/patches/CVE-2026-34180.patch: pass the length as long in\n       asn1_ex_c2i() and reject lengths not representable as int in\n       crypto/asn1/tasn_dec.c.\n     - CVE-2026-34180\n   * SECURITY UPDATE: NULL pointer dereference when processing CMS\n     PasswordRecipientInfo with the optional keyDerivationAlgorithm field\n     absent, allowing a denial of service via crafted CMS messages.\n     - debian/patches/CVE-2026-42766.patch: fail cleanly when\n       keyDerivationAlgorithm is missing in crypto/cms/cms_pwri.c.\n     - CVE-2026-42766","modified":"2026-10-26T09:32:05.233937197Z","published":"2026-06-15T18:52:46Z","upstream":["CVE-2026-34180","CVE-2026-42766","CVE-2026-7383","CVE-2026-9076"],"references":[{"type":"ADVISORY","url":"https://errata.tuxcare.com/els_os/ubuntu20.04els/CLSA-2026-1781549242.html"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34180"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42766"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-7383"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-9076"}],"affected":[{"package":{"name":"libssl-dev","ecosystem":"TuxCare:Ubuntu:20.04","purl":"pkg:deb/tuxcare/libssl-dev?distro=ubuntu-20.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1f-1ubuntu2.24+tuxcare.els7"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1781549242.json"}},{"package":{"name":"libssl-doc","ecosystem":"TuxCare:Ubuntu:20.04","purl":"pkg:deb/tuxcare/libssl-doc?distro=ubuntu-20.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1f-1ubuntu2.24+tuxcare.els7"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1781549242.json"}},{"package":{"name":"libssl1.1","ecosystem":"TuxCare:Ubuntu:20.04","purl":"pkg:deb/tuxcare/libssl1.1?distro=ubuntu-20.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1f-1ubuntu2.24+tuxcare.els7"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1781549242.json"}},{"package":{"name":"openssl","ecosystem":"TuxCare:Ubuntu:20.04","purl":"pkg:deb/tuxcare/openssl?distro=ubuntu-20.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1f-1ubuntu2.24+tuxcare.els7"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1781549242.json"}}],"schema_version":"1.9.0"}