Openssl 3.2.2-6 and CVE-2024-5535 and CVE-2024-9143

Security
1

Hi,

I’m running an webserver on AlmaLinux release 9.5 (Teal Serval) with httpd-2.4.62-1.el9.x86_64 and openssl-3.2.2-6.el9_5.x86_64.
After a securityscan we run into trouble because of the CVE-2024-5535.
On the openssl webpage you can find this info:
OpenSSL 3.3, 3.2, 3.1, 3.0, 1.1.1 and 1.0.2 are vulnerable to this issue.
OpenSSL 3.2 users should upgrade to OpenSSL 3.2.3 once it is released
Due to the low severity of this issue we are not issuing new releases of
OpenSSL at this time. The fix will be included in the next releases when they
become available. The fix is also available in commit e86ac436f0 (for 3.3),
commit 99fb785a5f (for 3.2), commit 4ada436a19 (for 3.1) and commit cf6f91f612
(for 3.0) in the OpenSSL git repository.
My question is, is in openssl-3.2.2-6 a commit or patchlevel that we are even like 3.2.3 or when will be there a version 3.2.3 that I can install to get rid of this problem ?
Ohh I just found out we are also having fun with CVE-2024-9143 which is patched in openssl-3.2.4, so same problem here.

Any suggestions are welcome

Best regards

fatcharly

2

However, on the cve-details Red Hat says that they did fix it in openssl-3.2.2-6.el9_5 for RHEL 9, in 2024-11-12.

What do you get with:

rpm -q --changelog openssl | grep -3 5535

Red Hat does backport security fixes: What is backporting and how does it affect Red Hat Enterprise Linux? - Red Hat Customer Portal
Therefore, 3.2.2-6.el9_5 is neither 3.2 nor 3.3. It is RHEL version of openssl based on 3.2.2, but with some modifications.

AlmaLinux does include same or equivalent changes RHEL, whenever possible.

The CVE-2024-9143: cve-details

Openssl, compat-openssl10, and compat-openssl11 in Red Hat Enterprise Linux 7, 8, 9 are unaffected by this flaw, because the vulnerability is in code for binary field elliptic curves, which RHEL has never enabled.

1 Like
3

Thank you very much jlehtone, you made my day !

Kind regards
fatcharly

1 Like
4

This topic was automatically closed 360 days after the last reply. New replies are no longer allowed.