Описание
ELSA-2026-80514: compat-openssl11 security update (MODERATE)
[1:1.1.1k-5.6]
- Fixes CVE-2026-84782: DTLS Retransmits Handshake Messages From a Stale Buffer Offset Resolves: RHEL-265517
[1:1.1.1k-5.5]
- Fixes CVE-2026-63072: Heap buffer overflow in CMS key unwrapping Resolves: RHEL-246280
Обновленные пакеты
Oracle Linux 9
Oracle Linux aarch64
compat-openssl11
1.1.1k-5.el9_8.6
Oracle Linux x86_64
compat-openssl11
1.1.1k-5.el9_8.6
Связанные CVE
Связанные уязвимости
Issue summary: The DTLS retransmission logic does not correctly handle a handshake message write that is suspended part-way through. The retransmitted message can be read past the message buffer and the retransmission overwrites the internal state the suspended write needs to resume correctly. Impact summary: The retransmitted message can disclose a heap memory to the peer as plaintext handshake data or cause a crash and a Denial of Service when the read reaches an unmapped memory region. CWE: CWE-125: Out-of-bounds Read Description: DTLS handshake messages can be written out in multiple fragments, and a write can suspend mid-message (returning WANT_WRITE) if the underlying transport temporarily cannot accept more data. While such a write is suspended, the DTLS retransmission timer may independently fire and ask the retransmission logic to resend an earlier, already-acknowledged-as-sent message from its retransmit queue. The retransmission logic reused the same internal buffer and p...
Issue summary: The DTLS retransmission logic does not correctly handle a handshake message write that is suspended part-way through. The retransmitted message can be read past the message buffer and the retransmission overwrites the internal state the suspended write needs to resume correctly. Impact summary: The retransmitted message can disclose a heap memory to the peer as plaintext handshake data or cause a crash and a Denial of Service when the read reaches an unmapped memory region. CWE: CWE-125: Out-of-bounds Read Description: DTLS handshake messages can be written out in multiple fragments, and a write can suspend mid-message (returning WANT_WRITE) if the underlying transport temporarily cannot accept more data. While such a write is suspended, the DTLS retransmission timer may independently fire and ask the retransmission logic to resend an earlier, already-acknowledged-as-sent message from its retransmit queue. The retransmission logic reused the same internal buffer and p...