Security & Threat Intelligence · 26.08.2026, 13:02 UTC
USN-8678-2: OpenSSL, OpenSSL 1.0 vulnerabilities
| Schweregrad | info |
|---|---|
| CVE | ↗ ↗ ↗ ↗ |
| Kategorie | Security & Threat Intelligence |
| Quelle | Ubuntu Security Notices ↗ |
| Veröffentlicht | 26.08.2026 UTC |
Sicherheitsmeldung mit Schweregrad noch nicht bewertet. Betroffene Kennungen: CVE-2024-2511, CVE-2024-5535, CVE-2026-54874, CVE-2026-63072. Technische Details im Tab „Originaltext“; empfohlene Schritte in der Checkliste.
USN-8678-1 fixed vulnerabilities in OpenSSL. This update provides the corresponding fix for OpenSSL and OpenSSL 1.0 on Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and Ubuntu 18.04 LTS.
In addition, this update also fixes the following issues that were not previously addressed in those releases:
It was discovered that OpenSSL incorrectly handled TLS handshake message buffering. A remote attacker could possibly use this issue to cause OpenSSL to consume excessive memory, leading to a denial of service. (LP: #2161371)
It was discovered that OpenSSL incorrectly handled session cache management when processing TLSv1.3 sessions. A remote attacker could possibly use this issue to cause OpenSSL to consume excessive memory, leading to a denial of service. This issue only affected OpenSSL 1.1.1 on Ubuntu 18.04 LTS. (CVE-2024-2511)
It was discovered that OpenSSL incorrectly handled the SSL_select_next_proto function when called with an empty client protocol list. A remote attacker could possibly use this issue to cause OpenSSL to disclose private memory contents to the peer, leading to a loss of confidentiality. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2024-5535)
Original advisory details:
It was discovered that OpenSSL incorrectly handled buffering of DTLS records for a future epoch. A remote attacker could possibly use this issue to cause OpenSSL to use excessive resources, leading to a denial of service. (CVE-2026-54874)
It was discovered that OpenSSL incorrectly handled CMS key unwrapping. A remote attacker could possibly use this issue to cause a …
Maßnahmen
⬇ Als MarkdownVerwandte Beiträge
- info USN-8678-1: OpenSSL vulnerabilities
- info Import AI 470: No rights for machines; automating environment generation with SPADE; and building better GPU kernels with Hawkeye
- info USN-8653-1: PostgreSQL vulnerabilities
- high ZDI-26-577: Trend Micro VPN OpenSSL Configuration Uncontrolled Search Path Element Local Privilege Escalation Vulnerability