{"id":"CLSA-2026-1792414477","summary":"openssl: Fix of 4 CVEs","details":"- CVE-2026-54872: pad the ladder scalar to a fixed, value-independent width\n  before the cardinality additions so EC scalar multiplication on curves using\n  the generic Montgomery ladder no longer leaks the scalar's magnitude by timing\n- CVE-2026-75805: guard the issuer and serial-number comparisons in\n  OSSL_CMP_exec_RR_ses() so a revocation response containing a CertId does not\n  dereference NULL when the certificate to be revoked was given as a PKCS#10 CSR\n- CVE-2026-75806: reject TLS 1.2 and DTLS 1.2 AEAD records shorter than the\n  mandatory explicit IV and authentication tag before AEAD processing, so a\n  short record is reported as bad_record_mac (TLS) or silently dropped (DTLS)\n  instead of raising a fatal internal error","modified":"2026-10-26T09:30:58.320899950Z","published":"2026-10-23T22:41:45Z","upstream":["CVE-2026-54872","CVE-2026-75805","CVE-2026-75806"],"references":[{"type":"ADVISORY","url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1792414477.html"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-5535"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54872"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75805"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75806"}],"affected":[{"package":{"name":"openssl","ecosystem":"TuxCare:AlmaLinux:9.2","purl":"pkg:rpm/tuxcare/openssl?distro=almalinux-9.2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.0.7-20.el9_2.tuxcare.1.els26"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1792414477.json"}},{"package":{"name":"openssl-devel","ecosystem":"TuxCare:AlmaLinux:9.2","purl":"pkg:rpm/tuxcare/openssl-devel?distro=almalinux-9.2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.0.7-20.el9_2.tuxcare.1.els26"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1792414477.json"}},{"package":{"name":"openssl-libs","ecosystem":"TuxCare:AlmaLinux:9.2","purl":"pkg:rpm/tuxcare/openssl-libs?distro=almalinux-9.2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.0.7-20.el9_2.tuxcare.1.els26"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1792414477.json"}},{"package":{"name":"openssl-perl","ecosystem":"TuxCare:AlmaLinux:9.2","purl":"pkg:rpm/tuxcare/openssl-perl?distro=almalinux-9.2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.0.7-20.el9_2.tuxcare.1.els26"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1792414477.json"}}],"schema_version":"1.9.0"}