Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS : OpenSSL vulnerabilities (USN-8847-1)

The remote Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8847-1 advisory. It was discovered that OpenSSL incorrectly handled certain certificate revocation list distribution point names. An attacker coul...

AlmaLinux 9.2 [TuxCare] Security Update: buildah / buildah-tests Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2025:1747251120)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1747251120 advisory. - Before Go 1.20, the RSA based TLS key exchanges used the math/big library, which is not constant time. RSA blinding was applied to...

AlmaLinux 9.2 [TuxCare] Security Update: opencryptoki / opencryptoki-devel / opencryptoki-icsftok / etc (ALMALINUX9.2:CLSA-2026:1784542737)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1784542737 advisory. - A timing side-channel vulnerability has been discovered in the opencryptoki package while processing RSA PKCS1 v1.5 padded ciphertexts. Thi...

AlmaLinux 9.2 [TuxCare] Security Update: golang / golang-bin / golang-docs / golang-misc / golang-race / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2025:1746792031)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1746792031 advisory. - Before Go 1.20, the RSA based TLS key exchanges used the math/big library, which is not constant time. RSA blinding was applied to...

AlmaLinux 9.2 [TuxCare] Security Update: gnutls / gnutls-c++ / gnutls-dane / gnutls-devel / gnutls-utils (ALMALINUX9.2:CLSA-2024:1726769216)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2024:1726769216 advisory. - A flaw was found in GnuTLS. The Minerva attack is a cryptographic vulnerability that exploits deterministic behavior in systems like GnuTLS...

Rocky Linux 9.6 [TuxCare] Security Update: memcached / memcached-devel / memcached-selinux (ALMALINUX9.6:CLSA-2026:1783629498)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1783629498 advisory. - In memcached before 1.6.42, username data for SASL password database authentication has a timing side channel because a loop exits as soo...

AlmaLinux 9.2 [TuxCare] Security Update: iperf3 / iperf3-devel (ALMALINUX9.2:CLSA-2026:1779373661)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1779373661 advisory. - iPerf3 before 3.17, when used with OpenSSL before 3.2.0 as a server with RSA authentication, allows a timing side channel in RSA decryption...

CentOS Linux 6 [TuxCare] Security Update: openssl / openssl-devel / openssl-perl / openssl-static Multiple Vulnerabilities (CENTOS6:CLSA-2025:1760559298)

The CentOS Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS6:CLSA-2025:1760559298 advisory. - The OpenSSL DSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations ...

USN-8847-2: OpenSSL vulnerabilities

USN-8847-1 fixed vulnerabilities in OpenSSL. This update provides the corresponding fix for OpenSSL on Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. Original advisory details: It was discovered that OpenSSL incorrectly handled certain certificate revocation list...

USN-8847-2 openssl, openssl1.0 vulnerabilities

USN-8847-1 fixed vulnerabilities in OpenSSL. This update provides the corresponding fix for OpenSSL on Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. Original advisory details: It was discovered that OpenSSL incorrectly handled certain certificate revocation list...

USN-8847-1 openssl vulnerabilities

It was discovered that OpenSSL incorrectly handled certain certificate revocation list distribution point names. An attacker could possibly use this issue to cause OpenSSL to consume excessive memory, resulting in a denial of service. CVE-2026-35189 It was discovered that OpenSSL incorrectly...

USN-8847-1: OpenSSL vulnerabilities

It was discovered that OpenSSL incorrectly handled certain certificate revocation list distribution point names. An attacker could possibly use this issue to cause OpenSSL to consume excessive memory, resulting in a denial of service. CVE-2026-35189 It was discovered that OpenSSL incorrectly...

Oauthlib: Timing Attack Vulnerability in PKCE code_verifier Comparison (CWE-208)

Summary A timing side-channel vulnerability exists in the PKCE RFC 7636 implementation of the Authorization Code Grant flow. The codechallengemethodplain function uses Python's standard == operator for string comparison instead of a constant-time comparison function, potentially allowing...

GHSA-XPV3-W29H-X7CV Oauthlib: Timing Attack Vulnerability in PKCE code_verifier Comparison (CWE-208)

Summary A timing side-channel vulnerability exists in the PKCE RFC 7636 implementation of the Authorization Code Grant flow. The codechallengemethodplain function uses Python's standard == operator for string comparison instead of a constant-time comparison function, potentially allowing...

CVE-2026-77696

A flaw was found in OpenSSL. During SM2 signature generation, variable-time arithmetic operations are performed on secret values, creating an observable timing side-channel. An attacker capable of measuring signature generation times can collect timing data across multiple signing operations, whi...

CVE-2026-54872

A flaw was found in OpenSSL. A timing side-channel vulnerability in generic elliptic curve scalar multiplication allows an attacker to recover private cryptographic keys. When performing signature operations, such as the Elliptic Curve Digital Signature Algorithm ECDSA or SM2, using curves withou...

AZL-105570 CVE-2026-77696 affecting package openssl 3.3.7-6

Issue summary: SM2 signature generation uses non-constant-time arithmetic on secret values, forming a timing side-channel. Impact summary: An attacker able to measure SM2 signing times may learn information about the per-signature secret nonce, which over many signatures can, via a lattice / Hidd...

CVE-2026-77696

Issue summary: SM2 signature generation uses non-constant-time arithmetic on secret values, forming a timing side-channel. Impact summary: An attacker able to measure SM2 signing times may learn information about the per-signature secret nonce, which over many signatures can, via a lattice / Hidd...

AZL-105732 CVE-2026-77696 affecting package qemu 10.1.0-1

Issue summary: SM2 signature generation uses non-constant-time arithmetic on secret values, forming a timing side-channel. Impact summary: An attacker able to measure SM2 signing times may learn information about the per-signature secret nonce, which over many signatures can, via a lattice / Hidd...

AZL-105519 CVE-2026-77696 affecting package kata-containers 4.1.0.kata0-1

Issue summary: SM2 signature generation uses non-constant-time arithmetic on secret values, forming a timing side-channel. Impact summary: An attacker able to measure SM2 signing times may learn information about the per-signature secret nonce, which over many signatures can, via a lattice / Hidd...