Red Hat Security Advisory: compat-openssl10 security update
The OpenSSL toolkit provides support for secure communications between machines. This version of OpenSSL package contains only the libraries and is provided for compatibility with previous releases and software that does not support compilation with OpenSSL-1.1. Security Fix(es): * openssl: Heap Use-After-Free in OpenSSL PKCS7_verify() (CVE-2026-45447) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
AI Analysis
Technical Summary
CVE-2026-45447 is a heap use-after-free vulnerability in OpenSSL's PKCS7_verify() function triggered by processing specially crafted PKCS#7 or S/MIME signed messages containing an empty ASN.1 SET in the SignedData digestAlgorithms field. This causes improper memory deallocation, which can lead to application crashes, memory corruption, or potentially remote code execution. The vulnerability specifically impacts applications using OpenSSL PKCS#7 APIs, while those using CMS APIs are unaffected. Red Hat's advisory indicates no current mitigation or fix meeting their standards is available, and the flaw is rated with a CVSS v3 base score of 8.1 (high severity).
Potential Impact
The vulnerability can be exploited remotely without authentication by sending a specially crafted PKCS#7 or S/MIME signed message to an affected application. Successful exploitation may result in denial of service (application crashes), memory corruption, or potentially remote code execution. This impacts confidentiality, integrity, and availability of affected systems. Only applications using OpenSSL PKCS#7 APIs are affected; those using CMS APIs are not impacted.
Mitigation Recommendations
Red Hat currently states that no mitigation is available or that existing options do not meet their criteria for ease of use, deployment, applicability, or stability. Users should monitor Red Hat advisories for updates and consider upgrading to fixed versions once available. Customers with Red Hat Technical Account Managers can seek direct guidance. Until a fix is released, avoid processing untrusted PKCS#7 or S/MIME signed messages if possible.
Red Hat Security Advisory: compat-openssl10 security update
Description
The OpenSSL toolkit provides support for secure communications between machines. This version of OpenSSL package contains only the libraries and is provided for compatibility with previous releases and software that does not support compilation with OpenSSL-1.1. Security Fix(es): * openssl: Heap Use-After-Free in OpenSSL PKCS7_verify() (CVE-2026-45447) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-45447 is a heap use-after-free vulnerability in OpenSSL's PKCS7_verify() function triggered by processing specially crafted PKCS#7 or S/MIME signed messages containing an empty ASN.1 SET in the SignedData digestAlgorithms field. This causes improper memory deallocation, which can lead to application crashes, memory corruption, or potentially remote code execution. The vulnerability specifically impacts applications using OpenSSL PKCS#7 APIs, while those using CMS APIs are unaffected. Red Hat's advisory indicates no current mitigation or fix meeting their standards is available, and the flaw is rated with a CVSS v3 base score of 8.1 (high severity).
Potential Impact
The vulnerability can be exploited remotely without authentication by sending a specially crafted PKCS#7 or S/MIME signed message to an affected application. Successful exploitation may result in denial of service (application crashes), memory corruption, or potentially remote code execution. This impacts confidentiality, integrity, and availability of affected systems. Only applications using OpenSSL PKCS#7 APIs are affected; those using CMS APIs are not impacted.
Mitigation Recommendations
Red Hat currently states that no mitigation is available or that existing options do not meet their criteria for ease of use, deployment, applicability, or stability. Users should monitor Red Hat advisories for updates and consider upgrading to fixed versions once available. Customers with Red Hat Technical Account Managers can seek direct guidance. Until a fix is released, avoid processing untrusted PKCS#7 or S/MIME signed messages if possible.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2026:36215
- Cve Count
- 1
- Additional Cves
- []
- Cvss Version
- 3.1
Threat ID: 6a4e4efdc9d9e3dbe328d0ce
Added to database: 07/08/2026, 13:22:05 UTC
Last enriched: 08/16/2026, 18:33:39 UTC
Last updated: 08/22/2026, 10:52:09 UTC
Views: 104
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.