SUSE-SU-2026:3094-1

Details

Description of the patch:

This update for openssl-3 fixes the following issues

CVE-2026-34182: CMS AuthEnvelopedData Processing May Accept Forged Messages (bsc#1266344).
CVE-2026-42767: NULL Pointer Dereference in CRMF EncryptedValue Decryption (bsc#1266350).

Affected Packages

libopenssl-3-devel

SUSE Linux Enterprise High Performance Computing 15 SP4SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOSSUSE Linux Enterprise High Performance Computing 15 SP4-LTSSSUSE Linux Enterprise Server 15 SP4SUSE Linux Enterprise Server 15 SP4-LTSS

Fixed in:

3.0.8-150400.4.90.1

libopenssl3

SUSE Linux Enterprise High Performance Computing 15 SP4SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOSSUSE Linux Enterprise High Performance Computing 15 SP4-LTSSSUSE Linux Enterprise Micro 5.3SUSE Linux Enterprise Micro 5.4

Fixed in:

3.0.8-150400.4.90.1

openssl-3

SUSE Linux Enterprise High Performance Computing 15 SP4SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOSSUSE Linux Enterprise High Performance Computing 15 SP4-LTSSSUSE Linux Enterprise Server 15 SP4SUSE Linux Enterprise Server 15 SP4-LTSS

Fixed in:

3.0.8-150400.4.90.1

References

ADVISORY

https://bugzilla.suse.com/1266344

ADVISORY

https://bugzilla.suse.com/1266350

ADVISORY

https://lists.suse.com/pipermail/sle-updates/2026-July/048426.html

ADVISORY

https://www.suse.com/security/cve/CVE-2026-34182/

ADVISORY

https://www.suse.com/security/cve/CVE-2026-42767/

WEB

https://www.suse.com/support/security/rating/

ADVISORY

https://www.suse.com/support/update/announcement/2026/suse-su-20263094-1/