[Git][security-tracker-team/security-tracker][master] Add new openssl issues

[Salvatore Bonaccorso (@carnil)]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
85dd09bc by Salvatore Bonaccorso at 2026-09-29T19:28:27+02:00
Add new openssl issues

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -1,3 +1,52 @@
+CVE-2026-84782 [DTLS Retransmits Handshake Messages From a Stale Buffer Offset]
+	- openssl <unfixed>
+	NOTE: https://openssl-library.org/news/secadv/20260929.txt
+CVE-2026-84783 [Use-After-Free in X.509 Extension Cache Under Concurrent Use]
+	- openssl <not-affected> (Vulnerable code not present)
+	NOTE: https://openssl-library.org/news/secadv/20260929.txt
+CVE-2026-35189 [Excessive Memory Allocation in Relative CRLDP Processing]
+	- openssl <unfixed>
+	NOTE: https://openssl-library.org/news/secadv/20260929.txt
+CVE-2026-35191 [QUIC Unvalidated Amplification Credit may be Over Accounted]
+	- openssl <unfixed>
+	[bookworm] - openssl <not-affected> (Vulnerable code not present)
+	NOTE: https://openssl-library.org/news/secadv/20260929.txt
+CVE-2026-42772 [Potential CPU DoS via O(n^2) Fragment Reassembly in QUIC]
+	- openssl <unfixed>
+	[bookworm] - openssl <not-affected> (Vulnerable code not present)
+	NOTE: https://openssl-library.org/news/secadv/20260929.txt
+CVE-2026-54872 [Timing Side-Channel in Scalar Multiplication for Non-NIST EC Curves]
+	- openssl <unfixed>
+	NOTE: https://openssl-library.org/news/secadv/20260929.txt
+CVE-2026-54873 [QUIC STREAM Fragment Metadata DoS]
+	- openssl <unfixed>
+	[bookworm] - openssl <not-affected> (Vulnerable code not present)
+	NOTE: https://openssl-library.org/news/secadv/20260929.txt
+CVE-2026-54875 [Non-Constant-Time SM2 Scalar Multiplication on ARM64 and RISC-V]
+	- openssl <unfixed>
+	[bookworm] - openssl <not-affected> (Vulnerable code not present)
+	NOTE: https://openssl-library.org/news/secadv/20260929.txt
+CVE-2026-72897 [Out-of-Bounds Access After SSL_set_SSL_CTX() During a Handshake]
+	- openssl <unfixed>
+	[bookworm] - openssl <not-affected> (Vulnerable code not present)
+	NOTE: https://openssl-library.org/news/secadv/20260929.txt
+CVE-2026-75804 [QUIC Connection-Level Flow Control is Not Enforced for Streams]
+	- openssl <unfixed>
+	[bookworm] - openssl <not-affected> (Vulnerable code not present)
+	NOTE: https://openssl-library.org/news/secadv/20260929.txt
+CVE-2026-75805 [NULL Pointer Dereference in CMP Client Revocation Response Handling]
+	- openssl <unfixed>
+	NOTE: https://openssl-library.org/news/secadv/20260929.txt
+CVE-2026-75806 [Unauthenticated and Undersized DTLS 1.2 AEAD Record Causes DoS]
+	- openssl <unfixed>
+	NOTE: https://openssl-library.org/news/secadv/20260929.txt
+CVE-2026-77696 [Timing Side-Channel in SM2 Signature Generation]
+	- openssl <unfixed>
+	NOTE: https://openssl-library.org/news/secadv/20260929.txt
+CVE-2026-84784 [QUIC: Unbounded RETIRE_CONNECTION_ID Backlog]
+	- openssl <unfixed>
+	[bookworm] - openssl <not-affected> (Vulnerable code not present)
+	NOTE: https://openssl-library.org/news/secadv/20260929.txt
 CVE-2026-XXXX [groff issues]
 	- groff 1.24.2-1
 	[trixie] - groff <no-dsa> (Minor issue)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/85dd09bc9130e0728f91ab9660357797fd6cbce0

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/85dd09bc9130e0728f91ab9660357797fd6cbce0
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260929/f1ca7456/attachment-0001.htm>