OESA-2025-2326

See a problem?
Please try reporting it to the source first.

Source

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-2326

Import Source

https://repo.openeuler.org/security/data/osv/OESA-2025-2326.json

JSON Data

https://api.osv.dev/v1/vulns/OESA-2025-2326

Upstream

CVE-2024-41996

Published

2025-09-26T13:08:34Z

Modified

2025-09-26T14:17:00.705091Z

Summary

openssl security update

Details

The OpenSSL Project is a collaborative effort to develop a robust, commercial-grade, fully featured, and Open Source toolkit implementing the Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1) protocols as well as a full-strength general purpose cryptography library. The project is managed by a worldwide community of volunteers that use the Internet to communicate, plan, and develop the OpenSSL tookit and its related documentation.

Security Fix(es):

Validating the order of the public keys in the Diffie-Hellman Key Agreement Protocol, when an approved safe prime is used, allows remote attackers (from the client side) to trigger unnecessarily expensive server-side DHE modular-exponentiation calculations. The client may cause asymmetric resource consumption. The basic attack scenario is that the client must claim that it can only communicate with DHE, and the server must be configured to allow DHE and validate the order of the public key.(CVE-2024-41996)

Database specific

{
    "severity": "High"
}

References

Affected packages

openEuler:24.03-LTS-SP2 / openssl

Package

Name: openssl
Purl: pkg:rpm/openEuler/openssl&distro=openEuler-24.03-LTS-SP2

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

3.0.12-22.oe2403sp2

Ecosystem specific

{
    "src": [
        "openssl-3.0.12-22.oe2403sp2.src.rpm"
    ],
    "aarch64": [
        "openssl-3.0.12-22.oe2403sp2.aarch64.rpm",
        "openssl-debuginfo-3.0.12-22.oe2403sp2.aarch64.rpm",
        "openssl-debugsource-3.0.12-22.oe2403sp2.aarch64.rpm",
        "openssl-devel-3.0.12-22.oe2403sp2.aarch64.rpm",
        "openssl-libs-3.0.12-22.oe2403sp2.aarch64.rpm",
        "openssl-perl-3.0.12-22.oe2403sp2.aarch64.rpm"
    ],
    "x86_64": [
        "openssl-3.0.12-22.oe2403sp2.x86_64.rpm",
        "openssl-debuginfo-3.0.12-22.oe2403sp2.x86_64.rpm",
        "openssl-debugsource-3.0.12-22.oe2403sp2.x86_64.rpm",
        "openssl-devel-3.0.12-22.oe2403sp2.x86_64.rpm",
        "openssl-libs-3.0.12-22.oe2403sp2.x86_64.rpm",
        "openssl-perl-3.0.12-22.oe2403sp2.x86_64.rpm"
    ],
    "noarch": [
        "openssl-help-3.0.12-22.oe2403sp2.noarch.rpm"
    ]
}

Database specific

source

"https://repo.openeuler.org/security/data/osv/OESA-2025-2326.json"