Red Hat has issued an important security update for the compat-openssl10 package addressing two high-severity vulnerabilities: a NULL pointer dereference in CMS EnvelopedData processing (CVE-2026-28390, CVSS 7.5) leading to denial of service, and a heap use-after-free in PKCS7_verify() (CVE-2026-45447, CVSS 8.8). The affected versions are OpenSSL 1.0.2 up to but excluding 1.0.2zp and 1.0.2zq, respectively. The fixed versions for these legacy branches are OpenSSL 1.0.2zp and 1.0.2zq.
Red Hat Product Errata RHSA-2026:36217 - Security Advisory Issued: 2026-07-07 Updated: 2026-07-07 RHSA-2026:36217 - Security Advisory Overview Updated Packages Synopsis Important: compat-openssl10 security update Type/Severity Security Advisory: Important Red Hat Lightspeed patch analysis Identify and remediate systems affected by this advisory. View affected systems Topic An update for compat-openssl10 is now available for Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions and Red Hat Enterprise Linux 8.8 Telecommunications Update Service. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description The OpenSSL toolkit provides support for secure communications between machines. This version of OpenSSL package contains only the libraries and is provided for compatibility with previous releases and software that does not support compilation with OpenSSL-1.1. Security Fix(es): openssl: OpenSSL: Denial of Service due to NULL pointer dereference in CMS EnvelopedData processing (CVE-2026-28390) openssl: Heap Use-After-Free in OpenSSL PKCS7_verify() (CVE-2026-45447) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Solution For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Affected Products Red Hat Enterprise Linux for x86_64 - Extended Update Support Extension 8.8 x86_64 Red Hat Enterprise Linux Server - TUS 8.8 x86_64 Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 8.8 ppc64le Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 8.8 x86_64 Fixes BZ - 2456314 - CVE-2026-28390 openssl: OpenSSL: Denial of Service due to NULL pointer dereference in CMS EnvelopedData processing BZ - 2481898 - CVE-2026-45447 openssl: Heap Use-After-Free in OpenSSL PKCS7_verify() CVEs CVE-2026-28390 CVE-2026-45447 References https://access.redhat.com/security/updates/classification/#important Note: More recent versions of these packages may be available. Click a package name for more details. Red Hat Enterprise Linux for x86_64 - Extended Update Support Extension 8.8 SRPM compat-openssl10-1.0.2o-4.el8_8.1.src.rpm SHA-256: a54759fa59a1f533a71b65de720afb4af107d51a9297a2202264a78f0b575dc7 x86_64 compat-openssl10-1.0.2o-4.el8_8.1.i686.rpm SHA-256: e3b07e1c2fb0b16cc0953c55e330a73caa6027436647e422bc9a037b27841ced compat-openssl10-1.0.2o-4.el8_8.1.x86_64.rpm SHA-256: 14cf36bcc6d9b02ee9b70127365fc3d5cdf208c5012a4f265264e1ed7047c35a compat-openssl10-debuginfo-1.0.2o-4.el8_8.1.i686.rpm SHA-256: a4e14aa4ad814ab498c1191f58c6aff8ddc7a1ef9ef8e00e660ce93e54578f41 compat-openssl10-debuginfo-1.0.2o-4.el8_8.1.x86_64.rpm SHA-256: c94f61d7ee1228dc03f9337429472317a846bcefc8878d85e88fcbbc7c5399e0 compat-openssl10-debugsource-1.0.2o-4.el8_8.1.i686.rpm SHA-256: 635f30f9600fbaf8d23808b71b22adae96536fed1c5e54f7d4c85b211adb293b compat-openssl10-debugsource-1.0.2o-4.el8_8.1.x86_64.rpm SHA-256: ee98c748db7b3afbd628022ea8deba4ec9d4bc217a729f0993973c3964a16fe3 Red Hat Enterprise Linux Server - TUS 8.8 SRPM compat-openssl10-1.0.2o-4.el8_8.1.src.rpm SHA-256: a54759fa59a1f533a71b65de720afb4af107d51a9297a2202264a78f0b575dc7 x86_64 compat-openssl10-1.0.2o-4.el8_8.1.i686.rpm SHA-256: e3b07e1c2fb0b16cc0953c55e330a73caa6027436647e422bc9a037b27841ced compat-openssl10-1.0.2o-4.el8_8.1.x86_64.rpm SHA-256: 14cf36bcc6d9b02ee9b70127365fc3d5cdf208c5012a4f265264e1ed7047c35a compat-openssl10-debuginfo-1.0.2o-4.el8_8.1.i686.rpm SHA-256: a4e14aa4ad814ab498c1191f58c6aff8ddc7a1ef9ef8e00e660ce93e54578f41 compat-openssl10-debuginfo-1.0.2o-4.el8_8.1.x86_64.rpm SHA-256: c94f61d7ee1228dc03f9337429472317a846bcefc8878d85e88fcbbc7c5399e0 compat-openssl10-debugsource-1.0.2o-4.el8_8.1.i686.rpm SHA-256: 635f30f9600fbaf8d23808b71b22adae96536fed1c5e54f7d4c85b211adb293b compat-openssl10-debugsource-1.0.2o-4.el8_8.1.x86_64.rpm SHA-256: ee98c748db7b3afbd628022ea8deba4ec9d4bc217a729f0993973c3964a16fe3 Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 8.8 SRPM compat-openssl10-1.0.2o-4.el8_8.1.src.rpm SHA-256: a54759fa59a1f533a71b65de720afb4af107d51a9297a2202264a78f0b575dc7 ppc64le compat-openssl10-1.0.2o-4.el8_8.1.ppc64le.rpm SHA-256: 940628403a7370ca2effaa380a7cafba5a1c33bcd380e83c84bf2b94af78fc43 compat-openssl10-debuginfo-1.0.2o-4.el8_8.1.ppc64le.rpm SHA-256: 8bb477e0238d63e0d7818094743f6882b5a6c8ce17312eacea2a91a30940d8a3 compat-openssl10-debugsource-1.0.2o-4.el8_8.1.ppc64le.rpm SHA-256: 2421e4d475ee9b585da4b22fb87d40e62dec488eedb252fdcf93cd000c919953 Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 8.8 SRPM compat-openssl10-1.0.2o-4.el8_8.1.src.rpm SHA-256: a54759fa59a1f533a71b65de720afb4af107d51a9297a2202264a78f0b575dc7 x86_64 compat-openssl10-1.0.2o-4.el8_8.1.i686.rpm SHA-256: e3b07e1c2fb0b16cc0953c55e330a73caa6027436647e422bc9a037b27841ced compat-openssl10-1.0.2o-4.el8_8.1.x86_64.rpm SHA-256: 14cf36bcc6d9b02ee9b70127365fc3d5cdf208c5012a4f265264e1ed7047c35a compat-openssl10-debuginfo-1.0.2o-4.el8_8.1.i686.rpm SHA-256: a4e14aa4ad814ab498c1191f58c6aff8ddc7a1ef9ef8e00e660ce93e54578f41 compat-openssl10-debuginfo-1.0.2o-4.el8_8.1.x86_64.rpm SHA-256: c94f61d7ee1228dc03f9337429472317a846bcefc8878d85e88fcbbc7c5399e0 compat-openssl10-debugsource-1.0.2o-4.el8_8.1.i686.rpm SHA-256: 635f30f9600fbaf8d23808b71b22adae96536fed1c5e54f7d4c85b211adb293b compat-openssl10-debugsource-1.0.2o-4.el8_8.1.x86_64.rpm SHA-256: ee98c748db7b3afbd628022ea8deba4ec9d4bc217a729f0993973c3964a16fe3 The Red Hat security contact is secalert@redhat.com . More contact details at https://access.redhat.com/security/team/contact/ .