OPENSUSE-SU-2026:20525-1

Advisory lineage Upstream: 7 Downstream: 0
Published: 13 Apr 2026, 15:48
Last modified:22 Apr 2026, 18:26

Vulnerability Summary

Overall Risk (default)
minimal
0/100
CVSS Score
No data
EPSS Score
No data
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

13 Apr 2026, 15:48
Published
Vulnerability first disclosed
22 Apr 2026, 18:26
Last Modified
Vulnerability information updated

Description

Security update for openssl-3 This update for openssl-3 fixes the following issues: Security issues fixed: - CVE-2026-2673: TLS 1.3 servers may choose unexpected key agreement group (bsc#1259652). - CVE-2026-28387: potential use-after-free in DANE client code (bsc#1260441). - CVE-2026-28388: NULL pointer dereference when processing a delta (bsc#1260442). - CVE-2026-28389: possible NULL pointer dereference when processing CMS KeyAgreeRecipientInfo (bsc#1260443). - CVE-2026-28390: NULL pointer dereference during processing of a crafted CMS EnvelopedData message with KeyTransportRecipientInfo (bsc#1261678). - CVE-2026-31789: heap buffer overflow in hexadecimal conversion (bsc#1260444). - CVE-2026-31790: incorrect failure handling in RSA KEM RSASVE encapsulation (bsc#1260445). Other updates and bugfixes: - Enable MD2 in legacy provider (jsc#PED-15724).

Affected Systems

  • opensuse•openssl-3&distro=openSUSE Leap 16.0

    < 3.5.0-160000.7.1

References (14)