Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

fstec логотип

BDU:2026-10556

Опубликовано: 07 апр. 2026
Источник: fstec
CVSS3: 7.5
CVSS2: 7.8
EPSS Низкий

Описание

Уязвимость инструмента для создания воспроизводимых и перемещаемых окружений Python relenv связана с разыменованием нулевого указателя. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, вызвать отказ в обслуживании

Вендор

Red Hat Inc.
Сообщество свободного программного обеспечения
ООО «Ред Софт»
Siemens AG
OpenSSL Software Foundation

Наименование ПО

Red Hat Enterprise Linux
Debian GNU/Linux
РЕД ОС
Red Hat OpenShift Container Platform
Red Hat Ansible Automation Platform
Logging subsystem for Red Hat OpenShift
Red Hat OpenShift Lightspeed
Confidential Compute Attestation
Red Hat Offline Knowledge Portal
Red Hat Update Infrastructure
Red Hat Ansible Automation Platform Ansible Core
Lightspeed Core
Pen Drive Powered by Red Hat Lightspeed
Red Hat OpenShift AI
SIMATIC CN 4100
relenv
OpenSSL
SIMATIC S7-1500 MFP

Версия ПО

7 (Red Hat Enterprise Linux)
8 (Red Hat Enterprise Linux)
11 (Debian GNU/Linux)
12 (Debian GNU/Linux)
7.3 (РЕД ОС)
4 (Red Hat OpenShift Container Platform)
9 (Red Hat Enterprise Linux)
2 (Red Hat Ansible Automation Platform)
8.4 Advanced Mission Critical Update Support (Red Hat Enterprise Linux)
- (Logging subsystem for Red Hat OpenShift)
8.6 Advanced Mission Critical Update Support (Red Hat Enterprise Linux)
- (Red Hat OpenShift Lightspeed)
10 (Red Hat Enterprise Linux)
8.8 Telecommunications Update Service (Red Hat Enterprise Linux)
8.8 Update Services for SAP Solutions (Red Hat Enterprise Linux)
9.2 Update Services for SAP Solutions (Red Hat Enterprise Linux)
- (Confidential Compute Attestation)
13 (Debian GNU/Linux)
8.6 Extended Update Support Long-Life Add-On (Red Hat Enterprise Linux)
8.4 Extended Update Support Long-Life Add-On (Red Hat Enterprise Linux)
9.6 Extended Update Support (Red Hat Enterprise Linux)
8.0 (РЕД ОС)
- (Red Hat Offline Knowledge Portal)
2.6 (Red Hat Ansible Automation Platform)
5 (Red Hat Update Infrastructure)
2 (Red Hat Ansible Automation Platform Ansible Core)
- (Lightspeed Core)
- (Pen Drive Powered by Red Hat Lightspeed)
- (Red Hat OpenShift AI)
до 5.0 (SIMATIC CN 4100)
9.4 Update Services for SAP Solutions (Red Hat Enterprise Linux)
до 0.22.14 (relenv)
до 3.6.2 (OpenSSL)
до 3.5.6 (OpenSSL)
до 3.3.7 (OpenSSL)
до 3.4.5 (OpenSSL)
- (SIMATIC S7-1500 MFP)
до 1.1.1zg (OpenSSL)
до 1.0.2zp (OpenSSL)

Тип ПО

Операционная система
Прикладное ПО информационных систем
Сетевое программное средство
ПО программно-аппаратного средства АСУ ТП
Программное средство защиты
Программное средство АСУ ТП

Операционные системы и аппаратные платформы

Red Hat Inc. Red Hat Enterprise Linux 7
Red Hat Inc. Red Hat Enterprise Linux 8
Сообщество свободного программного обеспечения Debian GNU/Linux 11
Сообщество свободного программного обеспечения Debian GNU/Linux 12
ООО «Ред Софт» РЕД ОС 7.3
Red Hat Inc. Red Hat Enterprise Linux 9
Red Hat Inc. Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
Red Hat Inc. Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
Red Hat Inc. Red Hat Enterprise Linux 10
Red Hat Inc. Red Hat Enterprise Linux 8.8 Telecommunications Update Service
Red Hat Inc. Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
Red Hat Inc. Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions
Сообщество свободного программного обеспечения Debian GNU/Linux 13
Red Hat Inc. Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On
Red Hat Inc. Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On
Red Hat Inc. Red Hat Enterprise Linux 9.6 Extended Update Support
ООО «Ред Софт» РЕД ОС 8.0
Red Hat Inc. Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions

Уровень опасности уязвимости

Высокий уровень опасности (базовая оценка CVSS 2.0 составляет 7,8)
Высокий уровень опасности (базовая оценка CVSS 3.1 составляет 7,5)

Возможные меры по устранению уязвимости

Использование рекомендаций:
https://github.com/advisories/GHSA-fgpp-q3px-3xhc
Для Ред ОС:
https://redos.red-soft.ru/search/?iblock_id=24&q=CVE-2026-28390
Для программных продуктов Red Hat Inc.:
https://access.redhat.com/security/cve/cve-2026-28390
Для Debian GNU/Linux:
https://security-tracker.debian.org/tracker/CVE-2026-28390
Для OpenSSL:
https://openssl-library.org/news/secadv/20260407.txt
Для Siemens AG:
https://cert-portal.siemens.com/productcert/html/ssa-032379.html
https://cert-portal.siemens.com/productcert/html/ssa-265688.html

Статус уязвимости

Подтверждена производителем

Наличие эксплойта

Данные уточняются

Информация об устранении

Уязвимость устранена

Идентификаторы других систем описаний уязвимостей

EPSS

Процентиль: 52%
0.00805
Низкий

7.5 High

CVSS3

7.8 High

CVSS2

Связанные уязвимости

CVSS3: 7.5
redos
18 дней назад

Уязвимость python-relenv

CVSS3: 7.5
ubuntu
4 месяца назад

Issue summary: During processing of a crafted CMS EnvelopedData message with KeyTransportRecipientInfo a NULL pointer dereference can happen. Impact summary: Applications that process attacker-controlled CMS data may crash before authentication or cryptographic operations occur resulting in Denial of Service. When a CMS EnvelopedData message that uses KeyTransportRecipientInfo with RSA-OAEP encryption is processed, the optional parameters field of RSA-OAEP SourceFunc algorithm identifier is examined without checking for its presence. This results in a NULL pointer dereference if the field is missing. Applications and services that call CMS_decrypt() on untrusted input (e.g., S/MIME processing or CMS-based protocols) are vulnerable. The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary. Impact summary: Applications that process attacker-controlled CMS data may crash before authentication or cryp...

CVSS3: 7.5
redhat
4 месяца назад

Issue summary: During processing of a crafted CMS EnvelopedData message with KeyTransportRecipientInfo a NULL pointer dereference can happen. Impact summary: Applications that process attacker-controlled CMS data may crash before authentication or cryptographic operations occur resulting in Denial of Service. When a CMS EnvelopedData message that uses KeyTransportRecipientInfo with RSA-OAEP encryption is processed, the optional parameters field of RSA-OAEP SourceFunc algorithm identifier is examined without checking for its presence. This results in a NULL pointer dereference if the field is missing. Applications and services that call CMS_decrypt() on untrusted input (e.g., S/MIME processing or CMS-based protocols) are vulnerable. The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.

CVSS3: 7.5
nvd
4 месяца назад

Issue summary: During processing of a crafted CMS EnvelopedData message with KeyTransportRecipientInfo a NULL pointer dereference can happen. Impact summary: Applications that process attacker-controlled CMS data may crash before authentication or cryptographic operations occur resulting in Denial of Service. When a CMS EnvelopedData message that uses KeyTransportRecipientInfo with RSA-OAEP encryption is processed, the optional parameters field of RSA-OAEP SourceFunc algorithm identifier is examined without checking for its presence. This results in a NULL pointer dereference if the field is missing. Applications and services that call CMS_decrypt() on untrusted input (e.g., S/MIME processing or CMS-based protocols) are vulnerable. The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.

CVSS3: 5.9
msrc
4 месяца назад

Possible NULL Dereference When Processing CMS KeyTransportRecipientInfo

EPSS

Процентиль: 52%
0.00805
Низкий

7.5 High

CVSS3

7.8 High

CVSS2