VDB
RHSA-2026:58563
RHSA-2026:58563
PUBLISHED
CVSS 5.900000095367432 MEDIUM
A flaw was found in OpenSSL. Affected versions of this package are vulnerable to Information Exposure through the SSL_select_next_proto function. This flaw allows an attacker to cause unexpected application behavior or a crash by exploiting the buffer overread condition when the function is called with a zero-length client list. This issue is only exploitable if the application is misconfigured to use a zero-length server list and mishandles the 'no overlap' response in ALPN or uses the output as the opportunistic protocol in NPN.
Risk Scores
CVSS 3.0
5.900000095367432
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | openssl-devel-1:1.0.2k-26.el7_9.2.s390 as a component of Red Hat Enterprise Linux Server (v. 7 ELS) | 1.0.2, 1.0.2 |
| Red Hat | openssl-debuginfo-1:1.0.2k-26.el7_9.2.ppc64 as a component of Red Hat Enterprise Linux Server Optional (v. 7 ELS) | 1.0.2, 1.0.2 |
| Red Hat | openssl-debuginfo-1:1.0.2k-26.el7_9.2.ppc as a component of Red Hat Enterprise Linux Server Optional (v. 7 ELS) | 1.0.2, 1.0.2 |
| Red Hat | openssl-libs-1:1.0.2k-26.el7_9.2.s390 as a component of Red Hat Enterprise Linux Server (v. 7 ELS) | 1.0.2, 1.0.2 |
| Red Hat | openssl-debuginfo-1:1.0.2k-26.el7_9.2.x86_64 as a component of Red Hat Enterprise Linux Server (v. 7 ELS) | 1.0.2, 1.0.2 |
| Red Hat | openssl-libs-1:1.0.2k-26.el7_9.2.s390x as a component of Red Hat Enterprise Linux Server (v. 7 ELS) | 1.0.2, 1.0.2 |
| Red Hat | openssl-libs-1:1.0.2k-26.el7_9.2.ppc64 as a component of Red Hat Enterprise Linux Server (v. 7 ELS) | 1.0.2, 1.0.2 |
| Red Hat | openssl-debuginfo-1:1.0.2k-26.el7_9.2.s390 as a component of Red Hat Enterprise Linux Server Optional (v. 7 ELS) | 1.0.2, 1.0.2 |
| Red Hat | openssl-debuginfo-1:1.0.2k-26.el7_9.2.s390x as a component of Red Hat Enterprise Linux Server (v. 7 ELS) | 1.0.2, 1.0.2 |
| Red Hat | openssl-1:1.0.2k-26.el7_9.2.ppc64 as a component of Red Hat Enterprise Linux Server (v. 7 ELS) | 1.0.2, 1.0.2 |
| Red Hat | openssl-devel-1:1.0.2k-26.el7_9.2.ppc64 as a component of Red Hat Enterprise Linux Server (v. 7 ELS) | 1.0.2, 1.0.2 |
| Red Hat | openssl-devel-1:1.0.2k-26.el7_9.2.ppc64le as a component of Red Hat Enterprise Linux Server (v. 7 ELS) | 1.0.2, 1.0.2 |
| Red Hat | openssl-libs-1:1.0.2k-26.el7_9.2.ppc64le as a component of Red Hat Enterprise Linux Server (v. 7 ELS) | 1.0.2, 1.0.2 |
| Red Hat | openssl-debuginfo-1:1.0.2k-26.el7_9.2.i686 as a component of Red Hat Enterprise Linux Server Optional (v. 7 ELS) | 1.0.2, 1.0.2 |
| Red Hat | openssl-devel-1:1.0.2k-26.el7_9.2.s390x as a component of Red Hat Enterprise Linux Server (v. 7 ELS) | 1.0.2, 1.0.2 |
| Red Hat | openssl-perl-1:1.0.2k-26.el7_9.2.ppc64le as a component of Red Hat Enterprise Linux Server Optional (v. 7 ELS) | 1.0.2, 1.0.2 |
| Red Hat | openssl-devel-1:1.0.2k-26.el7_9.2.x86_64 as a component of Red Hat Enterprise Linux Server (v. 7 ELS) | 1.0.2, 1.0.2 |
| Red Hat | openssl-debuginfo-1:1.0.2k-26.el7_9.2.i686 as a component of Red Hat Enterprise Linux Server (v. 7 ELS) | 1.0.2, 1.0.2 |
| Red Hat | openssl-1:1.0.2k-26.el7_9.2.ppc64le as a component of Red Hat Enterprise Linux Server (v. 7 ELS) | 1.0.2, 1.0.2 |
| Red Hat | openssl-devel-1:1.0.2k-26.el7_9.2.ppc as a component of Red Hat Enterprise Linux Server (v. 7 ELS) | 1.0.2, 1.0.2 |
…and 24 more
Timeline
- Aug 24, 2026 CVE Published
- Sep 1, 2026 CVE Updated
- Sep 1, 2026 Distribution Patch
- Sep 1, 2026 Distribution Patch
- Sep 1, 2026 Security Advisory
- Sep 1, 2026 Security Advisory
- Sep 1, 2026 Security Advisory
- Sep 1, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2026:58563 advisory
- https://access.redhat.com/security/updates/classification/#important advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2294581 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2456314 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2481898 issue
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_58563.json advisory
- https://access.redhat.com/security/cve/CVE-2024-5535 advisory
- https://www.cve.org/CVERecord?id=CVE-2024-5535 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2024-5535 advisory
- https://www.oracle.com/security-alerts/cpuoct2024.html#AppendixMSQL advisory
- https://access.redhat.com/security/cve/CVE-2026-28390 advisory
- https://www.cve.org/CVERecord?id=CVE-2026-28390 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-28390 advisory
- https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc advisory
- https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6 advisory
- https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4 advisory
- https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788 advisory
- https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75 advisory
- https://openssl-library.org/news/secadv/20260407.txt advisory
- https://access.redhat.com/security/cve/CVE-2026-45447 advisory
…and 2 more