ELSA-2026-500498

ELSA-2026-500498 - openssl security update

Type:	SECURITY
Impact:	IMPORTANT
Release Date:	2026-10-23

Description

[1:1.1.1k-18]
- Fix CVE-2026-63072: heap buffer overflow in CMS key unwrapping
Resolves: RHEL-246295
- Fix CVE-2026-84782: DTLS Retransmits Handshake Messages From a Stale Buffer Offset
Resolves: RHEL-264420

[1:1.1.1k-17]
- Fixes CVE-2026-28390: Denial of Service due to NULL pointer dereference in CMS EnvelopedData processing
Resolves: RHEL-165783

[1:1.1.1k-16]
- Fix CVE-2026-45447: Heap Use-After-Free in OpenSSL PKCS7_verify()
Resolves: RHEL-180978
- Fix CVE-2024-4741: Use After Free with SSL_free_buffers
Resolves: RHEL-180983

[1:1.1.1k-15]
- Fix CVE-2025-69419: Arbitrary code execution due to out-of-bounds write in PKCS#12 processing
ticket_lifetime_hint exceed 1 week in TLSv1.3 and breaks compliant clients
Resolves: RHEL-149165
Resolves: RHEL-142715

[1:1.1.1k-14.1]
- Backport fix for openssl: Out-of-bounds read & write in RFC 3211 KEK Unwrap
Fix CVE-2025-9230
Resolves: RHEL-128615

Related CVEs

CVE-2026-63072

CVE-2026-84782

Updated Packages

Release/Architecture	Filename	sha256	Superseded By Advisory	Channel Label
Oracle Linux 8 (aarch64)	openssl-1.1.1k-18.ksplice1.el8_6.src.rpm	0bc8b794db018a7a6927ef338de5e7417b5c793b293b22eea3cdaea02b9a2df6	-	ol8_aarch64_userspace_ksplice
	openssl-1.1.1k-18.ksplice1.el8_6.aarch64.rpm	84698e1693445bf5ab7f5c4bf8ac3bd78f348cfba8edeabbadbf2bf9810aa832	-	ol8_aarch64_userspace_ksplice
	openssl-devel-1.1.1k-18.ksplice1.el8_6.aarch64.rpm	9b7737ec3c89d444738fdbed4e4f625d70a6992a259fae16b4207a0dfd4b2da6	-	ol8_aarch64_userspace_ksplice
	openssl-libs-1.1.1k-18.ksplice1.el8_6.aarch64.rpm	1e7b3e5f7aadc8200f0c9707d6ef292e61ee0e942984d4f78440a642c56f9736	-	ol8_aarch64_userspace_ksplice
	openssl-perl-1.1.1k-18.ksplice1.el8_6.aarch64.rpm	21566a1ff2bf529c128af84db07187cbf31ccce03352a428954879c8b57c24ee	-	ol8_aarch64_userspace_ksplice
	openssl-static-1.1.1k-18.ksplice1.el8_6.aarch64.rpm	4f1b9d25dc554c02cb027271ee6def1084090bd9dbbae7f377fe6093300b5065	-	ol8_aarch64_userspace_ksplice
Oracle Linux 8 (x86_64)	openssl-1.1.1k-18.ksplice1.el8_6.src.rpm	0bc8b794db018a7a6927ef338de5e7417b5c793b293b22eea3cdaea02b9a2df6	-	ol8_x86_64_userspace_ksplice
	openssl-1.1.1k-18.ksplice1.el8_6.x86_64.rpm	ab30fafca8991352c2e5e6ebad0b1f5b675ce86e36c6de9742d320d60e212de8	-	ol8_x86_64_userspace_ksplice
	openssl-devel-1.1.1k-18.ksplice1.el8_6.i686.rpm	0afd19120831442829bf93a151dd04a4b47cd60134dc9d71a812f35f607f0b50	-	ol8_x86_64_userspace_ksplice
	openssl-devel-1.1.1k-18.ksplice1.el8_6.x86_64.rpm	a61205f18c429e437bd723e4ada2666133054e086dc89d76aef9805d482e1271	-	ol8_x86_64_userspace_ksplice
	openssl-libs-1.1.1k-18.ksplice1.el8_6.i686.rpm	ce79f02476ad3df9f7f5ba43aac66176ed5ac7a2bc2f64664af41a364eb88885	-	ol8_x86_64_userspace_ksplice
	openssl-libs-1.1.1k-18.ksplice1.el8_6.x86_64.rpm	a4a5d026176b26339b4e26340ceaf365fcc5b03ecb1b5a525e09f4bdb81270a2	-	ol8_x86_64_userspace_ksplice
	openssl-perl-1.1.1k-18.ksplice1.el8_6.x86_64.rpm	466e53cc427aa84e75bbc36587c56863e430eb20526ad3a3774ae55d79077031	-	ol8_x86_64_userspace_ksplice

This page is generated automatically and has not been checked for errors or omissions. For clarification or corrections please contact the Oracle Linux ULN team