Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

Red Hat OpenSSL may let attackers read encrypted data

published 2 years ago

Summary

The OpenSSL packages for Red Hat Linux, including the main library and related development files, contain a weakness that could let a malicious user decrypt information they should not see. This could expose sensitive communications or credentials. Apply the Red Hat security update as soon as possible to close the gap.

What to do

Update redhat openssl to version 1:1.1.1k-9.el8_6.
Update redhat openssl-debuginfo to version 1:1.1.1k-9.el8_6.
Update redhat openssl-debugsource to version 1:1.1.1k-9.el8_6.
Update redhat openssl-devel to version 1:1.1.1k-9.el8_6.
Update redhat openssl-libs to version 1:1.1.1k-9.el8_6.
Update redhat openssl-libs-debuginfo to version 1:1.1.1k-9.el8_6.
Update redhat openssl-perl to version 1:1.1.1k-9.el8_6.

Affected software

Ecosystem	Vendor	Product	Affected versions
Red Hat:rhel_eus:8.6::baseos	redhat	openssl	< 1:1.1.1k-9.el8_6 Fix: upgrade to 1:1.1.1k-9.el8_6
Red Hat:rhel_eus:8.6::baseos	redhat	openssl-debuginfo	< 1:1.1.1k-9.el8_6 Fix: upgrade to 1:1.1.1k-9.el8_6
Red Hat:rhel_eus:8.6::baseos	redhat	openssl-debugsource	< 1:1.1.1k-9.el8_6 Fix: upgrade to 1:1.1.1k-9.el8_6
Red Hat:rhel_eus:8.6::baseos	redhat	openssl-devel	< 1:1.1.1k-9.el8_6 Fix: upgrade to 1:1.1.1k-9.el8_6
Red Hat:rhel_eus:8.6::baseos	redhat	openssl-libs	< 1:1.1.1k-9.el8_6 Fix: upgrade to 1:1.1.1k-9.el8_6
Red Hat:rhel_eus:8.6::baseos	redhat	openssl-libs-debuginfo	< 1:1.1.1k-9.el8_6 Fix: upgrade to 1:1.1.1k-9.el8_6
Red Hat:rhel_eus:8.6::baseos	redhat	openssl-perl	< 1:1.1.1k-9.el8_6 Fix: upgrade to 1:1.1.1k-9.el8_6

Original advisory text

Red Hat Security Advisory: openssl security update

References

https://access.redhat.com/errata/RHSA-2023:3408 Vendor Advisory
https://access.redhat.com/security/updates/classification/#moderate Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2164487 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2164492 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2164494 Third Party Advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_3408.j... Vendor Advisory
https://access.redhat.com/security/cve/CVE-2022-4304 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2022-4304 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-4304 Vendor Advisory
https://www.openssl.org/news/secadv/20230207.txt Third Party Advisory
https://access.redhat.com/security/cve/CVE-2022-4450 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2022-4450 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-4450 Vendor Advisory
https://access.redhat.com/security/cve/CVE-2023-0215 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2023-0215 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2023-0215 Vendor Advisory

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker partial control (estimated)

Severity

7.5 High

Timeline

Published13 Sep 2024

Updated23 Sep 2026

First seen23 Sep 2026

Sources

RHSA-2023:3408 · OSV

Track software like this

Free during beta