[Git][security-tracker-team/security-tracker][master] CVE-2026-45445/openssl: bullseye not-affected

[Arnaud Rebillout (@arnaudr)]

Arnaud Rebillout pushed to branch master at Debian Security Tracker / security-tracker


Commits:
76474e88 by Arnaud Rebillout at 2026-06-11T13:31:45+07:00
CVE-2026-45445/openssl: bullseye not-affected

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -1689,8 +1689,12 @@ CVE-2026-7383 (Issue summary: A signed integer overflow when sizing the destinat
 CVE-2026-45445 (Issue summary: When an application drives an AES-OCB context through t ...)
 	{DSA-6335-1}
 	- openssl <unfixed> (bug #1139674)
+	[bullseye] - openssl <not-affected> (see below)
 	NOTE: https://openssl-library.org/news/secadv/20260609.txt
 	NOTE: Fixed by: https://github.com/openssl/openssl/commit/323f0b6e7d530a4cb4336d50c88cb70f3ac2a451 (openssl-3.0.21)
+	NOTE: OpenSSL 1.1.1 and 1.0.2 are not affected by this issue: in those
+	NOTE: releases the IV is applied synchronously during cipher initialisation
+	NOTE: and the AES-OCB one-shot rejects data submitted before the IV is set.
 CVE-2026-42764 (Issue summary: Receiving a QUIC initial packet with an invalid token m ...)
 	- openssl <unfixed> (bug #1139674)
 	[trixie] - openssl 3.5.6-1~deb13u2



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/76474e889d7021a92866aa0679bc9bb6dc7fe162

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/76474e889d7021a92866aa0679bc9bb6dc7fe162
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260611/0b526aff/attachment.htm>