[El-errata] New openssl updates available via Ksplice (ELSA-2026-25237)

[Errata Announcements for Oracle Linux]

Synopsis: ELSA-2026-25237 can now be patched using Ksplice
CVEs: CVE-2026-28390 CVE-2026-34180 CVE-2026-34181 CVE-2026-34182 CVE-2026-42764 CVE-2026-42766 CVE-2026-42767 CVE-2026-42768 CVE-2026-42769 CVE-2026-42770 CVE-2026-45445 CVE-2026-45446 CVE-2026-45447 CVE-2026-7383 CVE-2026-9076

Users with Oracle Linux Premier Support can now use Ksplice to patch
against the latest Oracle Linux Security Advisory, ELSA-2026-25237.

INSTALLING THE UPDATES

We recommend that all users of Ksplice on OL 10 install these updates.

You can install these updates by running:

# ksplice -y user upgrade

32-bit applications should be restarted after upgrading the on-disk
openssl RPMs and statically linked applications using
openssl should be rebuilt to include these fixes.

Ksplice user-space patching requires installation of Ksplice-aware
packages and the system must be rebooted after the first installation of
these packages.  Refer to the installation instructions for the Enhanced
Ksplice Client in the Ksplice User's Guide for more details.  Systems
may be prepared for Ksplice patching by installing the Ksplice aware
packages in advance, prior to installing the enhanced Ksplice client.

DESCRIPTION

* CVE-2026-28390: Crash when processing CMS data.




* CVE-2026-34180: Crash when reading DER-encoded ASN.1 structure.




* CVE-2026-34181: Missing validation for PKCS12 certs.




* CVE-2026-34182: Missing validation of AuthEnvelopedData in CMS.




* CVE-2026-42764: NULL-pointer dereference in QUIC server.




* CVE-2026-42766: NULL-pointer dereference when decrypting CMS.




* CVE-2026-42767: NULL-pointer dereference in CMP client.




* CVE-2026-42768: Chosen-ciphertext attack in CMS and PKCS7.




* CVE-2026-42769: Credential escalation in CMP.




* CVE-2026-42770: Information leak in ANSI X9.42 exchange.




* CVE-2026-45445: Entropy loss in AES-OCB context.




* CVE-2026-45446: Incorrect AAD handling for RFC 5297 and RFC 8452 ciphers.




* CVE-2026-45447: Use-after-free in PKCS7 verification.




* CVE-2026-7383: Integer overflow in ASN1_mbstring_ncopy.




* CVE-2026-9076: Out-of-bounds read in CMS data.



SUPPORT

Ksplice support is available at ksplice-support_ww at oracle.com.