{ "document": { "aggregate_severity": { "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "TuxCare License Agreement", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Cloud Linux Inc. and provide a link to the original.", "title": "Terms of Use" }, { "category": "details", "text": "* SECURITY UPDATE: Use-after-free / heap corruption in dane_match() of\n the X.509 verifier where the cached DANE-matched certificate was freed\n via OPENSSL_free() instead of X509_free(), bypassing the X509 reference\n counting and freeing certificate fields that may still be referenced by\n other holders. An attacker able to influence the DANE TLSA records used\n during certificate verification can trigger memory corruption.\n - debian/patches/CVE-2026-28387.patch: replace OPENSSL_free(dane->mcert)\n with X509_free(dane->mcert) in dane_match() in crypto/x509/x509_vfy.c.\n - CVE-2026-28387\n * SECURITY UPDATE: NULL pointer dereference in check_delta_base() of\n the X.509 CRL verifier when a delta CRL lacks the CRL Number extension.\n A remote attacker controlling a delta CRL can trigger a crash, leading\n to denial of service in applications using -crl_check with -use_deltas.\n - debian/patches/CVE-2026-28388.patch: NULL-check delta->crl_number\n before passing it to ASN1_INTEGER_cmp() in check_delta_base() in\n crypto/x509/x509_vfy.c, and ship the upstream test fixtures and\n verify recipe.\n - CVE-2026-28388\n * SECURITY UPDATE: NULL pointer dereference in dh_cms_set_shared_info()\n and ecdh_cms_set_shared_info() when a CMS KeyAgreeRecipientInfo has\n no KeyEncryptionAlgorithmIdentifier parameters field, allowing a\n remote attacker to trigger a denial of service via crafted CMS data.\n - debian/patches/CVE-2026-28389.patch: NULL-check alg->parameter\n before accessing its type in crypto/dh/dh_ameth.c and\n crypto/ec/ec_ameth.c.\n - CVE-2026-28389", "title": "Details" } ], "publisher": { "category": "vendor", "contact_details": "https://tuxcare.com/contact/", "name": "TuxCare", "namespace": "https://tuxcare.com/" }, "references": [ { "category": "self", "summary": "https://cve.tuxcare.com/els/releases/CLSA-2026:1778787445", "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1778787445" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.tuxcare.com/csaf/v2/els_os/ubuntu18.04els/advisories/2026/clsa-2026_1778787445.json" } ], "tracking": { "current_release_date": "2026-05-14T22:20:45Z", "generator": { "date": "2026-05-14T22:20:45Z", "engine": { "name": "pyCSAF" } }, "id": "CLSA-2026:1778787445", "initial_release_date": "2026-05-14T19:37:29Z", "revision_history": [ { "date": "2026-05-14T19:37:29Z", "number": "1", "summary": "Initial version" }, { "date": "2026-05-14T22:20:45Z", "number": "2", "summary": "Official Publication" } ], "status": "final", "version": "2" }, "title": "Fix CVE(s): CVE-2026-28387, CVE-2026-28388, CVE-2026-28389" }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Ubuntu 18.04", "product": { "name": "Ubuntu 18.04", "product_id": "Ubuntu-18", "product_identification_helper": { "cpe": "cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*" } } } ], "category": "product_family", "name": "Ubuntu" } ], "category": "vendor", "name": "Canonical Ltd." }, { "branches": [ { "branches": [ { "category": "product_version", "name": "libssl-dev-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els9.amd64", "product": { "name": "libssl-dev-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els9.amd64", "product_id": "libssl-dev-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els9.amd64", "product_identification_helper": { "purl": "pkg:deb/cloudlinux/libssl-dev@1.1.1-1ubuntu2.1~18.04.23%2Btuxcare.els9?arch=amd64" } } }, { "category": "product_version", "name": "libssl1.1-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els9.amd64", "product": { "name": "libssl1.1-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els9.amd64", "product_id": "libssl1.1-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els9.amd64", "product_identification_helper": { "purl": "pkg:deb/cloudlinux/libssl1.1@1.1.1-1ubuntu2.1~18.04.23%2Btuxcare.els9?arch=amd64" } } }, { "category": "product_version", "name": "openssl-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els9.amd64", "product": { "name": "openssl-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els9.amd64", "product_id": "openssl-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els9.amd64", "product_identification_helper": { "purl": "pkg:deb/cloudlinux/openssl@1.1.1-1ubuntu2.1~18.04.23%2Btuxcare.els9?arch=amd64" } } }, { "category": "product_version", "name": "libssl1.1-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els8.amd64", "product": { "name": "libssl1.1-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els8.amd64", "product_id": "libssl1.1-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els8.amd64", "product_identification_helper": { "purl": "pkg:deb/cloudlinux/libssl1.1@1.1.1-1ubuntu2.1~18.04.23%2Btuxcare.els8?arch=amd64" } } }, { "category": "product_version", "name": "libssl-dev-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els8.amd64", "product": { "name": "libssl-dev-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els8.amd64", "product_id": "libssl-dev-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els8.amd64", "product_identification_helper": { "purl": "pkg:deb/cloudlinux/libssl-dev@1.1.1-1ubuntu2.1~18.04.23%2Btuxcare.els8?arch=amd64" } } }, { "category": "product_version", "name": "openssl-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els8.amd64", "product": { "name": "openssl-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els8.amd64", "product_id": "openssl-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els8.amd64", "product_identification_helper": { "purl": "pkg:deb/cloudlinux/openssl@1.1.1-1ubuntu2.1~18.04.23%2Btuxcare.els8?arch=amd64" } } }, { "category": "product_version", "name": "libssl1.1-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els7.amd64", "product": { "name": "libssl1.1-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els7.amd64", "product_id": "libssl1.1-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els7.amd64", "product_identification_helper": { "purl": "pkg:deb/cloudlinux/libssl1.1@1.1.1-1ubuntu2.1~18.04.23%2Btuxcare.els7?arch=amd64" } } }, { "category": "product_version", "name": "openssl-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els7.amd64", "product": { "name": "openssl-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els7.amd64", "product_id": "openssl-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els7.amd64", "product_identification_helper": { "purl": "pkg:deb/cloudlinux/openssl@1.1.1-1ubuntu2.1~18.04.23%2Btuxcare.els7?arch=amd64" } } }, { "category": "product_version", "name": "libssl-dev-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els7.amd64", "product": { "name": "libssl-dev-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els7.amd64", "product_id": "libssl-dev-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els7.amd64", "product_identification_helper": { "purl": "pkg:deb/cloudlinux/libssl-dev@1.1.1-1ubuntu2.1~18.04.23%2Btuxcare.els7?arch=amd64" } } }, { "category": "product_version", "name": "openssl-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els4.amd64", "product": { "name": "openssl-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els4.amd64", "product_id": "openssl-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els4.amd64", "product_identification_helper": { "purl": "pkg:deb/cloudlinux/openssl@1.1.1-1ubuntu2.1~18.04.23%2Btuxcare.els4?arch=amd64" } } }, { "category": "product_version", "name": "libssl-dev-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els4.amd64", "product": { "name": "libssl-dev-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els4.amd64", "product_id": "libssl-dev-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els4.amd64", "product_identification_helper": { "purl": "pkg:deb/cloudlinux/libssl-dev@1.1.1-1ubuntu2.1~18.04.23%2Btuxcare.els4?arch=amd64" } } }, { "category": "product_version", "name": "libssl1.1-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els4.amd64", "product": { "name": "libssl1.1-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els4.amd64", "product_id": "libssl1.1-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els4.amd64", "product_identification_helper": { "purl": "pkg:deb/cloudlinux/libssl1.1@1.1.1-1ubuntu2.1~18.04.23%2Btuxcare.els4?arch=amd64" } } }, { "category": "product_version", "name": "libssl1.1-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els3.amd64", "product": { "name": "libssl1.1-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els3.amd64", "product_id": "libssl1.1-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els3.amd64", "product_identification_helper": { "purl": "pkg:deb/cloudlinux/libssl1.1@1.1.1-1ubuntu2.1~18.04.23%2Btuxcare.els3?arch=amd64" } } }, { "category": "product_version", "name": "libssl-dev-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els3.amd64", "product": { "name": "libssl-dev-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els3.amd64", "product_id": "libssl-dev-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els3.amd64", "product_identification_helper": { "purl": "pkg:deb/cloudlinux/libssl-dev@1.1.1-1ubuntu2.1~18.04.23%2Btuxcare.els3?arch=amd64" } } }, { "category": "product_version", "name": "openssl-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els3.amd64", "product": { "name": "openssl-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els3.amd64", "product_id": "openssl-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els3.amd64", "product_identification_helper": { "purl": "pkg:deb/cloudlinux/openssl@1.1.1-1ubuntu2.1~18.04.23%2Btuxcare.els3?arch=amd64" } } }, { "category": "product_version", "name": "openssl-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els2.amd64", "product": { "name": "openssl-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els2.amd64", "product_id": "openssl-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els2.amd64", "product_identification_helper": { "purl": "pkg:deb/cloudlinux/openssl@1.1.1-1ubuntu2.1~18.04.23%2Btuxcare.els2?arch=amd64" } } }, { "category": "product_version", "name": "libssl1.1-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els2.amd64", "product": { "name": "libssl1.1-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els2.amd64", "product_id": "libssl1.1-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els2.amd64", "product_identification_helper": { "purl": "pkg:deb/cloudlinux/libssl1.1@1.1.1-1ubuntu2.1~18.04.23%2Btuxcare.els2?arch=amd64" } } }, { "category": "product_version", "name": "libssl-dev-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els2.amd64", "product": { "name": "libssl-dev-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els2.amd64", "product_id": "libssl-dev-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els2.amd64", "product_identification_helper": { "purl": "pkg:deb/cloudlinux/libssl-dev@1.1.1-1ubuntu2.1~18.04.23%2Btuxcare.els2?arch=amd64" } } }, { "category": "product_version", "name": "libssl1.1-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els1.amd64", "product": { "name": "libssl1.1-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els1.amd64", "product_id": "libssl1.1-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els1.amd64", "product_identification_helper": { "purl": "pkg:deb/cloudlinux/libssl1.1@1.1.1-1ubuntu2.1~18.04.23%2Btuxcare.els1?arch=amd64" } } }, { "category": "product_version", "name": "libssl-dev-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els1.amd64", "product": { "name": "libssl-dev-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els1.amd64", "product_id": "libssl-dev-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els1.amd64", "product_identification_helper": { "purl": "pkg:deb/cloudlinux/libssl-dev@1.1.1-1ubuntu2.1~18.04.23%2Btuxcare.els1?arch=amd64" } } }, { "category": "product_version", "name": "openssl-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els1.amd64", "product": { "name": "openssl-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els1.amd64", "product_id": "openssl-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els1.amd64", "product_identification_helper": { "purl": "pkg:deb/cloudlinux/openssl@1.1.1-1ubuntu2.1~18.04.23%2Btuxcare.els1?arch=amd64" } } } ], "category": "architecture", "name": "amd64" }, { "branches": [ { "category": "product_version", "name": "libssl-doc-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els9.all", "product": { "name": "libssl-doc-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els9.all", "product_id": "libssl-doc-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els9.all", "product_identification_helper": { "purl": "pkg:deb/cloudlinux/libssl-doc@1.1.1-1ubuntu2.1~18.04.23%2Btuxcare.els9?arch=all" } } }, { "category": "product_version", "name": "libssl-doc-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els8.all", "product": { "name": "libssl-doc-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els8.all", "product_id": "libssl-doc-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els8.all", "product_identification_helper": { "purl": "pkg:deb/cloudlinux/libssl-doc@1.1.1-1ubuntu2.1~18.04.23%2Btuxcare.els8?arch=all" } } }, { "category": "product_version", "name": "libssl-doc-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els7.all", "product": { "name": "libssl-doc-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els7.all", "product_id": "libssl-doc-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els7.all", "product_identification_helper": { "purl": "pkg:deb/cloudlinux/libssl-doc@1.1.1-1ubuntu2.1~18.04.23%2Btuxcare.els7?arch=all" } } }, { "category": "product_version", "name": "libssl-doc-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els4.all", "product": { "name": "libssl-doc-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els4.all", "product_id": "libssl-doc-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els4.all", "product_identification_helper": { "purl": "pkg:deb/cloudlinux/libssl-doc@1.1.1-1ubuntu2.1~18.04.23%2Btuxcare.els4?arch=all" } } }, { "category": "product_version", "name": "libssl-doc-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els3.all", "product": { "name": "libssl-doc-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els3.all", "product_id": "libssl-doc-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els3.all", "product_identification_helper": { "purl": "pkg:deb/cloudlinux/libssl-doc@1.1.1-1ubuntu2.1~18.04.23%2Btuxcare.els3?arch=all" } } }, { "category": "product_version", "name": "libssl-doc-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els2.all", "product": { "name": "libssl-doc-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els2.all", "product_id": "libssl-doc-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els2.all", "product_identification_helper": { "purl": "pkg:deb/cloudlinux/libssl-doc@1.1.1-1ubuntu2.1~18.04.23%2Btuxcare.els2?arch=all" } } }, { "category": "product_version", "name": "libssl-doc-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els1.all", "product": { "name": "libssl-doc-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els1.all", "product_id": "libssl-doc-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els1.all", "product_identification_helper": { "purl": "pkg:deb/cloudlinux/libssl-doc@1.1.1-1ubuntu2.1~18.04.23%2Btuxcare.els1?arch=all" } } } ], "category": "architecture", "name": "all" } ], "category": "vendor", "name": "CloudLinux" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "libssl-dev-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els9.amd64 as a component of Ubuntu 18.04", "product_id": "Ubuntu-18:libssl-dev-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els9.amd64" }, "product_reference": "libssl-dev-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els9.amd64", "relates_to_product_reference": "Ubuntu-18" }, { "category": "default_component_of", "full_product_name": { "name": "libssl1.1-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els9.amd64 as a component of Ubuntu 18.04", "product_id": "Ubuntu-18:libssl1.1-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els9.amd64" }, "product_reference": "libssl1.1-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els9.amd64", "relates_to_product_reference": "Ubuntu-18" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els9.amd64 as a component of Ubuntu 18.04", "product_id": "Ubuntu-18:openssl-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els9.amd64" }, "product_reference": "openssl-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els9.amd64", "relates_to_product_reference": "Ubuntu-18" }, { "category": "default_component_of", "full_product_name": { "name": "libssl-doc-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els9.all as a component of Ubuntu 18.04", "product_id": "Ubuntu-18:libssl-doc-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els9.all" }, "product_reference": "libssl-doc-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els9.all", "relates_to_product_reference": "Ubuntu-18" }, { "category": "default_component_of", "full_product_name": { "name": "libssl1.1-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els8.amd64 as a component of Ubuntu 18.04", "product_id": "Ubuntu-18:libssl1.1-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els8.amd64" }, "product_reference": "libssl1.1-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els8.amd64", "relates_to_product_reference": "Ubuntu-18" }, { "category": "default_component_of", "full_product_name": { "name": "libssl-dev-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els8.amd64 as a component of Ubuntu 18.04", "product_id": "Ubuntu-18:libssl-dev-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els8.amd64" }, "product_reference": "libssl-dev-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els8.amd64", "relates_to_product_reference": "Ubuntu-18" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els8.amd64 as a component of Ubuntu 18.04", "product_id": "Ubuntu-18:openssl-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els8.amd64" }, "product_reference": "openssl-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els8.amd64", "relates_to_product_reference": "Ubuntu-18" }, { "category": "default_component_of", "full_product_name": { "name": "libssl-doc-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els8.all as a component of Ubuntu 18.04", "product_id": "Ubuntu-18:libssl-doc-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els8.all" }, "product_reference": "libssl-doc-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els8.all", "relates_to_product_reference": "Ubuntu-18" }, { "category": "default_component_of", "full_product_name": { "name": "libssl-doc-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els7.all as a component of Ubuntu 18.04", "product_id": "Ubuntu-18:libssl-doc-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els7.all" }, "product_reference": "libssl-doc-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els7.all", "relates_to_product_reference": "Ubuntu-18" }, { "category": "default_component_of", "full_product_name": { "name": "libssl1.1-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els7.amd64 as a component of Ubuntu 18.04", "product_id": "Ubuntu-18:libssl1.1-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els7.amd64" }, "product_reference": "libssl1.1-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els7.amd64", "relates_to_product_reference": "Ubuntu-18" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els7.amd64 as a component of Ubuntu 18.04", "product_id": "Ubuntu-18:openssl-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els7.amd64" }, "product_reference": "openssl-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els7.amd64", "relates_to_product_reference": "Ubuntu-18" }, { "category": "default_component_of", "full_product_name": { "name": "libssl-dev-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els7.amd64 as a component of Ubuntu 18.04", "product_id": "Ubuntu-18:libssl-dev-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els7.amd64" }, "product_reference": "libssl-dev-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els7.amd64", "relates_to_product_reference": "Ubuntu-18" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els4.amd64 as a component of Ubuntu 18.04", "product_id": "Ubuntu-18:openssl-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els4.amd64" }, "product_reference": "openssl-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els4.amd64", "relates_to_product_reference": "Ubuntu-18" }, { "category": "default_component_of", "full_product_name": { "name": "libssl-doc-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els4.all as a component of Ubuntu 18.04", "product_id": "Ubuntu-18:libssl-doc-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els4.all" }, "product_reference": "libssl-doc-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els4.all", "relates_to_product_reference": "Ubuntu-18" }, { "category": "default_component_of", "full_product_name": { "name": "libssl-dev-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els4.amd64 as a component of Ubuntu 18.04", "product_id": "Ubuntu-18:libssl-dev-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els4.amd64" }, "product_reference": "libssl-dev-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els4.amd64", "relates_to_product_reference": "Ubuntu-18" }, { "category": "default_component_of", "full_product_name": { "name": "libssl1.1-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els4.amd64 as a component of Ubuntu 18.04", "product_id": "Ubuntu-18:libssl1.1-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els4.amd64" }, "product_reference": "libssl1.1-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els4.amd64", "relates_to_product_reference": "Ubuntu-18" }, { "category": "default_component_of", "full_product_name": { "name": "libssl1.1-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els3.amd64 as a component of Ubuntu 18.04", "product_id": "Ubuntu-18:libssl1.1-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els3.amd64" }, "product_reference": "libssl1.1-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els3.amd64", "relates_to_product_reference": "Ubuntu-18" }, { "category": "default_component_of", "full_product_name": { "name": "libssl-dev-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els3.amd64 as a component of Ubuntu 18.04", "product_id": "Ubuntu-18:libssl-dev-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els3.amd64" }, "product_reference": "libssl-dev-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els3.amd64", "relates_to_product_reference": "Ubuntu-18" }, { "category": "default_component_of", "full_product_name": { "name": "libssl-doc-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els3.all as a component of Ubuntu 18.04", "product_id": "Ubuntu-18:libssl-doc-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els3.all" }, "product_reference": "libssl-doc-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els3.all", "relates_to_product_reference": "Ubuntu-18" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els3.amd64 as a component of Ubuntu 18.04", "product_id": "Ubuntu-18:openssl-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els3.amd64" }, "product_reference": "openssl-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els3.amd64", "relates_to_product_reference": "Ubuntu-18" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els2.amd64 as a component of Ubuntu 18.04", "product_id": "Ubuntu-18:openssl-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els2.amd64" }, "product_reference": "openssl-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els2.amd64", "relates_to_product_reference": "Ubuntu-18" }, { "category": "default_component_of", "full_product_name": { "name": "libssl1.1-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els2.amd64 as a component of Ubuntu 18.04", "product_id": "Ubuntu-18:libssl1.1-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els2.amd64" }, "product_reference": "libssl1.1-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els2.amd64", "relates_to_product_reference": "Ubuntu-18" }, { "category": "default_component_of", "full_product_name": { "name": "libssl-dev-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els2.amd64 as a component of Ubuntu 18.04", "product_id": "Ubuntu-18:libssl-dev-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els2.amd64" }, "product_reference": "libssl-dev-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els2.amd64", "relates_to_product_reference": "Ubuntu-18" }, { "category": "default_component_of", "full_product_name": { "name": "libssl-doc-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els2.all as a component of Ubuntu 18.04", "product_id": "Ubuntu-18:libssl-doc-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els2.all" }, "product_reference": "libssl-doc-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els2.all", "relates_to_product_reference": "Ubuntu-18" }, { "category": "default_component_of", "full_product_name": { "name": "libssl-doc-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els1.all as a component of Ubuntu 18.04", "product_id": "Ubuntu-18:libssl-doc-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els1.all" }, "product_reference": "libssl-doc-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els1.all", "relates_to_product_reference": "Ubuntu-18" }, { "category": "default_component_of", "full_product_name": { "name": "libssl1.1-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els1.amd64 as a component of Ubuntu 18.04", "product_id": "Ubuntu-18:libssl1.1-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els1.amd64" }, "product_reference": "libssl1.1-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els1.amd64", "relates_to_product_reference": "Ubuntu-18" }, { "category": "default_component_of", "full_product_name": { "name": "libssl-dev-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els1.amd64 as a component of Ubuntu 18.04", "product_id": "Ubuntu-18:libssl-dev-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els1.amd64" }, "product_reference": "libssl-dev-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els1.amd64", "relates_to_product_reference": "Ubuntu-18" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els1.amd64 as a component of Ubuntu 18.04", "product_id": "Ubuntu-18:openssl-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els1.amd64" }, "product_reference": "openssl-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els1.amd64", "relates_to_product_reference": "Ubuntu-18" } ] }, "vulnerabilities": [ { "cve": "CVE-2026-28389", "cwe": { "id": "CWE-476", "name": "NULL Pointer Dereference" }, "notes": [ { "category": "description", "text": "Issue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyAgreeRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyAgreeRecipientInfo is\nprocessed, the optional parameters field of KeyEncryptionAlgorithmIdentifier\nis examined without checking for its presence. This results in a NULL\npointer dereference if the field is missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Ubuntu-18:libssl-dev-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els9.amd64", "Ubuntu-18:libssl-doc-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els9.all", "Ubuntu-18:libssl1.1-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els9.amd64", "Ubuntu-18:openssl-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els9.amd64" ], "known_affected": [ "Ubuntu-18:libssl-dev-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els1.amd64", "Ubuntu-18:libssl-dev-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els2.amd64", "Ubuntu-18:libssl-dev-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els3.amd64", "Ubuntu-18:libssl-dev-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els4.amd64", "Ubuntu-18:libssl-dev-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els7.amd64", "Ubuntu-18:libssl-dev-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els8.amd64", "Ubuntu-18:libssl-doc-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els1.all", "Ubuntu-18:libssl-doc-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els2.all", "Ubuntu-18:libssl-doc-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els3.all", "Ubuntu-18:libssl-doc-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els4.all", "Ubuntu-18:libssl-doc-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els7.all", "Ubuntu-18:libssl-doc-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els8.all", "Ubuntu-18:libssl1.1-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els1.amd64", "Ubuntu-18:libssl1.1-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els2.amd64", "Ubuntu-18:libssl1.1-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els3.amd64", "Ubuntu-18:libssl1.1-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els4.amd64", "Ubuntu-18:libssl1.1-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els7.amd64", "Ubuntu-18:libssl1.1-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els8.amd64", "Ubuntu-18:openssl-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els1.amd64", "Ubuntu-18:openssl-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els2.amd64", "Ubuntu-18:openssl-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els3.amd64", "Ubuntu-18:openssl-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els4.amd64", "Ubuntu-18:openssl-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els7.amd64", "Ubuntu-18:openssl-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els8.amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-28389" }, { "category": "external", "summary": "https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5", "url": "https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5" }, { "category": "external", "summary": "https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616", "url": "https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616" }, { "category": "external", "summary": "https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f", "url": "https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f" }, { "category": "external", "summary": "https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a", "url": "https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a" }, { "category": "external", "summary": "https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686", "url": "https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686" }, { "category": "external", "summary": "https://openssl-library.org/news/secadv/20260407.txt", "url": "https://openssl-library.org/news/secadv/20260407.txt" }, { "category": "external", "summary": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" }, { "category": "external", "summary": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" } ], "release_date": "2026-04-07T22:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-05-14T19:37:29.647256Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1778787445", "product_ids": [ "Ubuntu-18:libssl-dev-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els9.amd64", "Ubuntu-18:libssl-doc-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els9.all", "Ubuntu-18:libssl1.1-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els9.amd64", "Ubuntu-18:openssl-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els9.amd64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1778787445" }, { "category": "none_available", "date": "2026-04-07T22:16:00Z", "details": "Affected", "product_ids": [ "Ubuntu-18:libssl-dev-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els1.amd64", "Ubuntu-18:libssl-dev-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els2.amd64", "Ubuntu-18:libssl-dev-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els3.amd64", "Ubuntu-18:libssl-dev-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els4.amd64", "Ubuntu-18:libssl-dev-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els7.amd64", "Ubuntu-18:libssl-dev-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els8.amd64", "Ubuntu-18:libssl-doc-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els1.all", "Ubuntu-18:libssl-doc-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els2.all", "Ubuntu-18:libssl-doc-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els3.all", "Ubuntu-18:libssl-doc-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els4.all", "Ubuntu-18:libssl-doc-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els7.all", "Ubuntu-18:libssl-doc-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els8.all", "Ubuntu-18:libssl1.1-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els1.amd64", "Ubuntu-18:libssl1.1-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els2.amd64", "Ubuntu-18:libssl1.1-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els3.amd64", "Ubuntu-18:libssl1.1-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els4.amd64", "Ubuntu-18:libssl1.1-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els7.amd64", "Ubuntu-18:libssl1.1-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els8.amd64", "Ubuntu-18:openssl-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els1.amd64", "Ubuntu-18:openssl-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els2.amd64", "Ubuntu-18:openssl-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els3.amd64", "Ubuntu-18:openssl-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els4.amd64", "Ubuntu-18:openssl-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els7.amd64", "Ubuntu-18:openssl-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els8.amd64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "Ubuntu-18:libssl-dev-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els9.amd64", "Ubuntu-18:libssl-doc-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els9.all", "Ubuntu-18:libssl1.1-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els9.amd64", "Ubuntu-18:openssl-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els9.amd64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-28388", "cwe": { "id": "CWE-476", "name": "NULL Pointer Dereference" }, "notes": [ { "category": "description", "text": "Issue summary: When a delta CRL that contains a Delta CRL Indicator extension\nis processed a NULL pointer dereference might happen if the required CRL\nNumber extension is missing.\n\nImpact summary: A NULL pointer dereference can trigger a crash which\nleads to a Denial of Service for an application.\n\nWhen CRL processing and delta CRL processing is enabled during X.509\ncertificate verification, the delta CRL processing does not check\nwhether the CRL Number extension is NULL before dereferencing it.\nWhen a malformed delta CRL file is being processed, this parameter\ncan be NULL, causing a NULL pointer dereference.\n\nExploiting this issue requires the X509_V_FLAG_USE_DELTAS flag to be enabled in\nthe verification context, the certificate being verified to contain a\nfreshestCRL extension or the base CRL to have the EXFLAG_FRESHEST flag set, and\nan attacker to provide a malformed CRL to an application that processes it.\n\nThe vulnerability is limited to Denial of Service and cannot be escalated to\nachieve code execution or memory disclosure. For that reason the issue was\nassessed as Low severity according to our Security Policy.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the affected code is outside the OpenSSL FIPS module boundary.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Ubuntu-18:libssl-dev-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els9.amd64", "Ubuntu-18:libssl-doc-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els9.all", "Ubuntu-18:libssl1.1-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els9.amd64", "Ubuntu-18:openssl-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els9.amd64" ], "known_affected": [ "Ubuntu-18:libssl-dev-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els1.amd64", "Ubuntu-18:libssl-dev-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els2.amd64", "Ubuntu-18:libssl-dev-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els3.amd64", "Ubuntu-18:libssl-dev-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els4.amd64", "Ubuntu-18:libssl-dev-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els7.amd64", "Ubuntu-18:libssl-dev-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els8.amd64", "Ubuntu-18:libssl-doc-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els1.all", "Ubuntu-18:libssl-doc-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els2.all", "Ubuntu-18:libssl-doc-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els3.all", "Ubuntu-18:libssl-doc-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els4.all", "Ubuntu-18:libssl-doc-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els7.all", "Ubuntu-18:libssl-doc-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els8.all", "Ubuntu-18:libssl1.1-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els1.amd64", "Ubuntu-18:libssl1.1-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els2.amd64", "Ubuntu-18:libssl1.1-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els3.amd64", "Ubuntu-18:libssl1.1-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els4.amd64", "Ubuntu-18:libssl1.1-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els7.amd64", "Ubuntu-18:libssl1.1-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els8.amd64", "Ubuntu-18:openssl-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els1.amd64", "Ubuntu-18:openssl-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els2.amd64", "Ubuntu-18:openssl-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els3.amd64", "Ubuntu-18:openssl-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els4.amd64", "Ubuntu-18:openssl-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els7.amd64", "Ubuntu-18:openssl-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els8.amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-28388" }, { "category": "external", "summary": "https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e", "url": "https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e" }, { "category": "external", "summary": "https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139", "url": "https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139" }, { "category": "external", "summary": "https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3", "url": "https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3" }, { "category": "external", "summary": "https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8", "url": "https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8" }, { "category": "external", "summary": "https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726", "url": "https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726" }, { "category": "external", "summary": "https://openssl-library.org/news/secadv/20260407.txt", "url": "https://openssl-library.org/news/secadv/20260407.txt" }, { "category": "external", "summary": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" }, { "category": "external", "summary": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" } ], "release_date": "2026-04-07T22:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-05-14T19:37:29.647256Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1778787445", "product_ids": [ "Ubuntu-18:libssl-dev-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els9.amd64", "Ubuntu-18:libssl-doc-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els9.all", "Ubuntu-18:libssl1.1-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els9.amd64", "Ubuntu-18:openssl-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els9.amd64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1778787445" }, { "category": "none_available", "date": "2026-04-07T22:16:00Z", "details": "Affected", "product_ids": [ "Ubuntu-18:libssl-dev-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els1.amd64", "Ubuntu-18:libssl-dev-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els2.amd64", "Ubuntu-18:libssl-dev-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els3.amd64", "Ubuntu-18:libssl-dev-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els4.amd64", "Ubuntu-18:libssl-dev-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els7.amd64", "Ubuntu-18:libssl-dev-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els8.amd64", "Ubuntu-18:libssl-doc-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els1.all", "Ubuntu-18:libssl-doc-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els2.all", "Ubuntu-18:libssl-doc-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els3.all", "Ubuntu-18:libssl-doc-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els4.all", "Ubuntu-18:libssl-doc-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els7.all", "Ubuntu-18:libssl-doc-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els8.all", "Ubuntu-18:libssl1.1-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els1.amd64", "Ubuntu-18:libssl1.1-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els2.amd64", "Ubuntu-18:libssl1.1-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els3.amd64", "Ubuntu-18:libssl1.1-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els4.amd64", "Ubuntu-18:libssl1.1-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els7.amd64", "Ubuntu-18:libssl1.1-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els8.amd64", "Ubuntu-18:openssl-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els1.amd64", "Ubuntu-18:openssl-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els2.amd64", "Ubuntu-18:openssl-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els3.amd64", "Ubuntu-18:openssl-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els4.amd64", "Ubuntu-18:openssl-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els7.amd64", "Ubuntu-18:openssl-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els8.amd64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "Ubuntu-18:libssl-dev-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els9.amd64", "Ubuntu-18:libssl-doc-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els9.all", "Ubuntu-18:libssl1.1-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els9.amd64", "Ubuntu-18:openssl-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els9.amd64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-28387", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "description", "text": "Issue summary: An uncommon configuration of clients performing DANE TLSA-based\nserver authentication, when paired with uncommon server DANE TLSA records, may\nresult in a use-after-free and/or double-free on the client side.\n\nImpact summary: A use after free can have a range of potential consequences\nsuch as the corruption of valid data, crashes or execution of arbitrary code.\n\nHowever, the issue only affects clients that make use of TLSA records with both\nthe PKIX-TA(0/PKIX-EE(1) certificate usages and the DANE-TA(2) certificate\nusage.\n\nBy far the most common deployment of DANE is in SMTP MTAs for which RFC7672\nrecommends that clients treat as 'unusable' any TLSA records that have the PKIX\ncertificate usages. These SMTP (or other similar) clients are not vulnerable\nto this issue. Conversely, any clients that support only the PKIX usages, and\nignore the DANE-TA(2) usage are also not vulnerable.\n\nThe client would also need to be communicating with a server that publishes a\nTLSA RRset with both types of TLSA records.\n\nNo FIPS modules are affected by this issue, the problem code is outside the\nFIPS module boundary.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Ubuntu-18:libssl-dev-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els9.amd64", "Ubuntu-18:libssl-doc-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els9.all", "Ubuntu-18:libssl1.1-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els9.amd64", "Ubuntu-18:openssl-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els9.amd64" ], "known_affected": [ "Ubuntu-18:libssl-dev-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els1.amd64", "Ubuntu-18:libssl-dev-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els2.amd64", "Ubuntu-18:libssl-dev-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els3.amd64", "Ubuntu-18:libssl-dev-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els4.amd64", "Ubuntu-18:libssl-dev-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els7.amd64", "Ubuntu-18:libssl-dev-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els8.amd64", "Ubuntu-18:libssl-doc-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els1.all", "Ubuntu-18:libssl-doc-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els2.all", "Ubuntu-18:libssl-doc-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els3.all", "Ubuntu-18:libssl-doc-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els4.all", "Ubuntu-18:libssl-doc-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els7.all", "Ubuntu-18:libssl-doc-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els8.all", "Ubuntu-18:libssl1.1-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els1.amd64", "Ubuntu-18:libssl1.1-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els2.amd64", "Ubuntu-18:libssl1.1-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els3.amd64", "Ubuntu-18:libssl1.1-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els4.amd64", "Ubuntu-18:libssl1.1-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els7.amd64", "Ubuntu-18:libssl1.1-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els8.amd64", "Ubuntu-18:openssl-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els1.amd64", "Ubuntu-18:openssl-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els2.amd64", "Ubuntu-18:openssl-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els3.amd64", "Ubuntu-18:openssl-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els4.amd64", "Ubuntu-18:openssl-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els7.amd64", "Ubuntu-18:openssl-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els8.amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-28387" }, { "category": "external", "summary": "https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b", "url": "https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b" }, { "category": "external", "summary": "https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe", "url": "https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe" }, { "category": "external", "summary": "https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3", "url": "https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3" }, { "category": "external", "summary": "https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7", "url": "https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7" }, { "category": "external", "summary": "https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177", "url": "https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177" }, { "category": "external", "summary": "https://openssl-library.org/news/secadv/20260407.txt", "url": "https://openssl-library.org/news/secadv/20260407.txt" }, { "category": "external", "summary": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" }, { "category": "external", "summary": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" } ], "release_date": "2026-04-07T22:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-05-14T19:37:29.647256Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1778787445", "product_ids": [ "Ubuntu-18:libssl-dev-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els9.amd64", "Ubuntu-18:libssl-doc-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els9.all", "Ubuntu-18:libssl1.1-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els9.amd64", "Ubuntu-18:openssl-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els9.amd64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1778787445" }, { "category": "none_available", "date": "2026-04-07T22:16:00Z", "details": "Affected", "product_ids": [ "Ubuntu-18:libssl-dev-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els1.amd64", "Ubuntu-18:libssl-dev-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els2.amd64", "Ubuntu-18:libssl-dev-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els3.amd64", "Ubuntu-18:libssl-dev-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els4.amd64", "Ubuntu-18:libssl-dev-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els7.amd64", "Ubuntu-18:libssl-dev-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els8.amd64", "Ubuntu-18:libssl-doc-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els1.all", "Ubuntu-18:libssl-doc-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els2.all", "Ubuntu-18:libssl-doc-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els3.all", "Ubuntu-18:libssl-doc-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els4.all", "Ubuntu-18:libssl-doc-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els7.all", "Ubuntu-18:libssl-doc-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els8.all", "Ubuntu-18:libssl1.1-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els1.amd64", "Ubuntu-18:libssl1.1-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els2.amd64", "Ubuntu-18:libssl1.1-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els3.amd64", "Ubuntu-18:libssl1.1-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els4.amd64", "Ubuntu-18:libssl1.1-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els7.amd64", "Ubuntu-18:libssl1.1-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els8.amd64", "Ubuntu-18:openssl-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els1.amd64", "Ubuntu-18:openssl-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els2.amd64", "Ubuntu-18:openssl-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els3.amd64", "Ubuntu-18:openssl-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els4.amd64", "Ubuntu-18:openssl-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els7.amd64", "Ubuntu-18:openssl-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els8.amd64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Ubuntu-18:libssl-dev-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els9.amd64", "Ubuntu-18:libssl-doc-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els9.all", "Ubuntu-18:libssl1.1-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els9.amd64", "Ubuntu-18:openssl-0:1.1.1-1ubuntu2.1~18.04.23+tuxcare.els9.amd64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] } ] }