IP-DB.com
Türkçe English Deutsch Español
Anmelden API-Schlüssel holen
8.8Hoch

CVE-2026-45447Heap Use-After-Free in the PKCS7_verify() Function

OpenSSL OpenSSL; Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION; Red Hat Red Hat Enterprise Li… Veröffentlicht: (vor 5 Monaten)

Beschreibung

Issue summary: A specially crafted PKCS#7 or S/MIME signed message could trigger a use-after-free during PKCS#7 signature verification. Impact summary: A use-after-free may result in process crashes, heap corruption, or potentially remote code execution. When processing a PKCS#7 or S/MIME signed message, if the SignedData digestAlgorithms field is present as an empty ASN.1 SET, OpenSSL may incorrectly free a caller-owned BIO during PKCS7_verify(). A subsequent use of the BIO by the calling application results in a use-after-free condition. In the common case this occurs when the application later calls BIO_free() on the BIO originally passed to PKCS7_verify(). Depending on allocator behavior and application-specific BIO usage patterns, this may result in a crash or other memory corruption. In some application contexts this may potentially be exploitable for remote code execution. Applications that process PKCS#7 or S/MIME signed messages using OpenSSL PKCS#7 APIs may be affected. Applications using the CMS APIs for this processing are not affected. The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.

Schwachstellentyp (CWE): CWE-416CWE-825

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

HerstellerProduktVersionen
acm 2.13 —
cost management 4 —
discovery 2 —
insights proxy 1.5 —
multicluster engine 2.8 —
openshift 4.12 —
OpenSSL OpenSSL 4.0.0 – < 4.0.1, 3.6.0 – < 3.6.3, 3.5.0 – < 3.5.7, 3.4.0 – < 3.4.6, 3.0.0 – < 3.0.21, 1.1.1 – < 1.1.1zh, 1.0.2 – < 1.0.2zq
Red Hat Cost Management 4 all versions
Red Hat Multicluster Engine for Kubernetes —
Red Hat multicluster engine for Kubernetes 2.8 all versions
Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.13 all versions
Red Hat Red Hat Discovery 2 all versions
Red Hat Red Hat Enterprise Linux 10 all versions
Red Hat Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION all versions
Red Hat Red Hat Enterprise Linux 7 —
Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support all versions
Red Hat Red Hat Enterprise Linux 8 all versions
Red Hat Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On all versions
Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Service all versions
Red Hat Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions all versions
Red Hat Red Hat Enterprise Linux 9 all versions
Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions all versions
Red Hat Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions all versions
Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support all versions
Red Hat Red Hat Hardened Images all versions
Red Hat Red Hat Insights proxy 1.5 all versions
Red Hat Red Hat JBoss Core Services —
Red Hat Red Hat JBoss Web Server 6 —
Red Hat Red Hat JBoss Web Server 7 —
Red Hat Red Hat OpenShift Container Platform 4 all versions
Red Hat Red Hat OpenShift Container Platform 4.12 all versions
Red Hat Red Hat Update Infrastructure 5 all versions
rhui 5 —

Referenzen und Patches

CPE-Treffer (NVD) (7)
  • cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:* ≥ 1.0.2 < 1.0.2zq
  • cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:* ≥ 1.1.1 < 1.1.1zh
  • cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:* ≥ 3.0.0 < 3.0.21
  • cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:* ≥ 3.4.0 < 3.4.6
  • cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:* ≥ 3.5.0 < 3.5.7
  • cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:* ≥ 3.6.0 < 3.6.3
  • cpe:2.3:a:openssl:openssl:4.0.0:-:*:*:*:*:*:*

Neue CVEs im selben Produkt — OpenSSL

7.5Hoch
CVE-2026-84784

QUIC: Unbounded RETIRE_CONNECTION_ID Backlog

OpenSSL OpenSSL

Issue summary: A malicious remote peer may flood the local QUIC stack with NEW_CONNECTION_ID frames by avoiding a limit check on how many connection IDs the remote QUIC stack can use. Impact summary: The local QUIC stack sends a RETIRE_CONN_ID frame for ever…

7.5Hoch
CVE-2026-84783

Use-After-Free in X.509 Extension Cache Under Concurrent Use

OpenSSL OpenSSL

Issue summary: The first concurrent use of the same X.509 certificate by several threads may cause its cached extension data to be freed while another thread is still using it. Impact summary: A remote, unauthenticated peer could crash a multi-threaded TLS c…

3.7Niedrig
CVE-2026-77696

Timing Side-Channel in SM2 Signature Generation

OpenSSL OpenSSL

Issue summary: SM2 signature generation uses non-constant-time arithmetic on secret values, forming a timing side-channel. Impact summary: An attacker able to measure SM2 signing times may learn information about the per-signature secret nonce, which over ma…

5.3Mittel
CVE-2026-75806

Unauthenticated and Undersized DTLS 1.2 AEAD Record Causes DoS

OpenSSL OpenSSL

Issue summary: An established DTLS 1.2 association using an AEAD cipher suite can be terminated by a single unauthenticated datagram whose encrypted fragment is shorter than the mandatory explicit IV and authentication tag overhead. Impact summary: An attack…

1.1%EPSS