VDB
RHSA-2026:3228
RHSA-2026:3228
PUBLISHED
CVSS 6.099999904632568 MEDIUM
A flaw was found in OpenSSL. When an application processes a maliciously crafted PKCS#12 file, an attacker can exploit a stack buffer overflow or a NULL pointer dereference. This can lead to a denial of service (DoS) by crashing the application, and in some cases, may enable arbitrary code execution. The vulnerability arises from the lack of validation for PBKDF2 salt and keylength parameters within the PKCS#12 file.
Risk Scores
CVSS 3.1
6.099999904632568
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:210abe5689a75606b17b1cea30eeef8fd7f0ab39a5d2af6af32e314ed80928c7_amd64 as a component of Cost Management 4 | *, *, * |
| Red Hat | registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:7424ae28625701b1441987b0457100505e273b2cbcb087bf0c046d7b2cc596c7_ppc64le as a component of Cost Management 4 | *, *, * |
| Red Hat | registry.redhat.io/costmanagement/costmanagement-metrics-operator-bundle@sha256:5acccd71d43acf0b452b05a87ddaecffe7bfb4dd47bab24725b1d4ec88879441_amd64 as a component of Cost Management 4 | *, *, * |
| Red Hat | registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:5ae433507d81fd888260a30b4519daf148c42a71d469e9f63eed75f599733937_s390x as a component of Cost Management 4 | *, *, * |
| Red Hat | registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:1dd05671a8614a4354d9ebf94673f9e1bfd7a38af7052c2a4b9a25264f3ee4e1_arm64 as a component of Cost Management 4 | *, *, * |
Timeline
- Feb 24, 2026 CVE Published
- May 15, 2026 Security Advisory
- May 15, 2026 Security Advisory
- May 15, 2026 Security Advisory
- May 16, 2026 Distribution Patch
- May 16, 2026 Security Advisory
- May 16, 2026 Security Advisory
- May 16, 2026 Security Advisory
- May 16, 2026 Security Advisory
- May 16, 2026 Security Advisory
- May 16, 2026 Security Advisory
- May 16, 2026 Security Advisory
References
- https://access.redhat.com/security/cve/CVE-2025-15281 advisory
- https://access.redhat.com/security/cve/CVE-2025-15467 advisory
- https://access.redhat.com/security/cve/CVE-2025-68160 advisory
- https://access.redhat.com/security/cve/CVE-2025-69418 advisory
- https://access.redhat.com/security/cve/CVE-2025-69420 advisory
- https://access.redhat.com/security/cve/CVE-2026-0915 advisory
- https://access.redhat.com/security/cve/CVE-2026-22796 advisory
- https://docs.redhat.com/en/documentation/cost_management_service/1-latest/html/getting_started_with_cost_management/steps-to-cost-management advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_3228.json advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2431196 issue
- https://www.cve.org/CVERecord?id=CVE-2025-15281 advisory
- https://sourceware.org/bugzilla/show_bug.cgi?id=33814 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2430376 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2430377 issue
- https://www.cve.org/CVERecord?id=CVE-2025-15468 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-15469 advisory
- https://www.cve.org/CVERecord?id=CVE-2025-66199 advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2430380 issue
- https://nvd.nist.gov/vuln/detail/CVE-2025-68160 advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2430381 issue
…and 48 more