Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
AlmaLinux OpenSSL can expose data, crash, or be stopped
published 8 months ago
Summary
The OpenSSL libraries that come with AlmaLinux (including the main package and its development, library, and Perl extensions) have three flaws. One could let an attacker see leftover encrypted data, another could cause the program to stop working and deny service, and a third could let malformed certificates bypass checks. Install the latest OpenSSL updates from AlmaLinux to protect your systems.
What to do
- Update almalinux openssl to version 1:3.2.2-6.el9_6.1.tuxcare.6.els5.
- Update almalinux openssl-devel to version 1:3.2.2-6.el9_6.1.tuxcare.6.els5.
- Update almalinux openssl-libs to version 1:3.2.2-6.el9_6.1.tuxcare.6.els5.
- Update almalinux openssl-perl to version 1:3.2.2-6.el9_6.1.tuxcare.6.els5.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| TuxCare:AlmaLinux:9.6 | almalinux | openssl |
< 1:3.2.2-6.el9_6.1.tuxcare.6.els5 Fix: upgrade to 1:3.2.2-6.el9_6.1.tuxcare.6.els5
|
| TuxCare:AlmaLinux:9.6 | almalinux | openssl-devel |
< 1:3.2.2-6.el9_6.1.tuxcare.6.els5 Fix: upgrade to 1:3.2.2-6.el9_6.1.tuxcare.6.els5
|
| TuxCare:AlmaLinux:9.6 | almalinux | openssl-libs |
< 1:3.2.2-6.el9_6.1.tuxcare.6.els5 Fix: upgrade to 1:3.2.2-6.el9_6.1.tuxcare.6.els5
|
| TuxCare:AlmaLinux:9.6 | almalinux | openssl-perl |
< 1:3.2.2-6.el9_6.1.tuxcare.6.els5 Fix: upgrade to 1:3.2.2-6.el9_6.1.tuxcare.6.els5
|
Original advisory text
openssl: Fix of 3 CVEs
- CVE-2025-69418: fix OCB AES-NI/HW stream path leaving trailing bytes
unauthenticated/unencrypted by advancing pointers after stream processing
- CVE-2025-69420: fix missing ASN1_TYPE validation in TS_RESP_verify_response
for signing certificate attributes
- CVE-2025-15468: add a NULL guard before dereferencing SSL_CIPHER to prevent abnormal
termination of the running process causing Denial of Service
unauthenticated/unencrypted by advancing pointers after stream processing
- CVE-2025-69420: fix missing ASN1_TYPE validation in TS_RESP_verify_response
for signing certificate attributes
- CVE-2025-15468: add a NULL guard before dereferencing SSL_CIPHER to prevent abnormal
termination of the running process causing Denial of Service
References
Timeline
Published9 Feb 2026
Updated21 Oct 2026
First seen21 Oct 2026
Sources
CLSA-2026-1770667352 · OSV
Track software like this
Free during beta