Bug 2456314 (CVE-2026-28390)
| Summary: | CVE-2026-28390 openssl: OpenSSL: Denial of Service due to NULL pointer dereference in CMS EnvelopedData processing | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security DevOps Team <prodsec-dev> |
| Status: | NEW --- | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | aadhikar, akostadi, amasferr, anpicker, anthomas, aruklets, bdettelb, bparees, brasmith, bsmejkal, cochase, crizzo, csutherl, dbosanac, derez, dmayorov, doconnor, dranck, dschmidt, eborisov, ebourniv, ehelms, erezende, eshamard, ggainey, gotiwari, gparvin, hasun, jachapma, jcantril, jclere, jfula, jgrulich, jhorak, jkoehler, jlanda, jlledo, jmitchel, jowilson, jpasqual, jreimann, juwatts, jvasik, kaycoth, kshier, lball, lgallett, lphiri, mdessi, mhulan, mreynolds, mrizzi, mvyas, ngough, nmoumoul, nyancey, ometelka, osousa, pantinor, pcattana, pcreech, pjindal, plodge, progier, ptisnovs, rblanco, rchan, rekumar, rhaigner, rhel-process-autobot, rjohnson, rojacob, sbunciak, simaishi, smallamp, smcdonal, snegrini, spichugi, stcannon, syedriko, szappis, tbordaz, teagle, tmalecek, tpopela, tsedmik, vashirov, vchlup, veshanka, vvoronko, watson-tool-maintainers, xdharmai, yguenane |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A flaw was found in OpenSSL. A remote attacker could exploit this vulnerability by sending a specially crafted Cryptographic Message Syntax (CMS) EnvelopedData message. During the processing of a KeyTransportRecipientInfo with RSA-OAEP encryption, the system attempts to access an optional parameter field without first verifying its presence. This leads to a NULL pointer dereference, which can cause applications processing the attacker-controlled CMS data to crash, resulting in a Denial of Service (DoS).
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 2456409, 2456412, 2456413, 2456414, 2456447, 2456448, 2456449, 2456450, 2456452, 2456453, 2456454, 2456456, 2456457, 2456459, 2456460, 2456463, 2456464, 2456468, 2456470, 2456471, 2456472, 2456477, 2456478, 2456479, 2456480, 2456481, 2456410, 2456411, 2456415, 2456416, 2456417, 2456418, 2456419, 2456420, 2456421, 2456422, 2456423, 2456424, 2456425, 2456426, 2456427, 2456428, 2456429, 2456430, 2456431, 2456432, 2456433, 2456434, 2456435, 2456436, 2456437, 2456438, 2456439, 2456440, 2456441, 2456442, 2456443, 2456444, 2456445, 2456446, 2456451, 2456455, 2456458, 2456461, 2456462, 2456465, 2456466, 2456467, 2456469, 2456473, 2456474, 2456475, 2456476 | ||
| Bug Blocks: | |||
|
Description
OSIDB Bzimport
2026-04-07 23:01:41 UTC
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2026:22315 https://access.redhat.com/errata/RHSA-2026:22315 This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2026:22313 https://access.redhat.com/errata/RHSA-2026:22313 This issue has been addressed in the following products: Red Hat Enterprise Linux 10 Via RHSA-2026:22314 https://access.redhat.com/errata/RHSA-2026:22314 This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2026:22312 https://access.redhat.com/errata/RHSA-2026:22312 This issue has been addressed in the following products: Red Hat Enterprise Linux 9.6 Extended Update Support Via RHSA-2026:35869 https://access.redhat.com/errata/RHSA-2026:35869 This issue has been addressed in the following products: Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions Red Hat Enterprise Linux 8.8 Telecommunications Update Service Via RHSA-2026:36217 https://access.redhat.com/errata/RHSA-2026:36217 This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2026:38503 https://access.redhat.com/errata/RHSA-2026:38503 This issue has been addressed in the following products: Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On Via RHSA-2026:38804 https://access.redhat.com/errata/RHSA-2026:38804 This issue has been addressed in the following products: Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions Red Hat Enterprise Linux 8.8 Telecommunications Update Service Via RHSA-2026:38805 https://access.redhat.com/errata/RHSA-2026:38805 This issue has been addressed in the following products: Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions Via RHSA-2026:39009 https://access.redhat.com/errata/RHSA-2026:39009 This issue has been addressed in the following products: Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions Via RHSA-2026:39012 https://access.redhat.com/errata/RHSA-2026:39012 This issue has been addressed in the following products: Red Hat Enterprise Linux 10 Via RHSA-2026:39297 https://access.redhat.com/errata/RHSA-2026:39297 |