This advisory covers four security vulnerabilities in OpenSSL as packaged by Red Hat for Red Hat Enterprise Linux 9. The vulnerabilities include unbounded memory growth during TLSv1.3 session handling (CVE-2024-2511), excessive processing time when validating DSA keys (CVE-2024-4603), a use-after-free condition in SSL_free_buffers (CVE-2024-4741), and a buffer overread in SSL_select_next_proto (CVE-2024-5535). Red Hat has released updated packages for OpenSSL and openssl-fips-provider to address these issues. The advisory references Red Hat Enterprise Linux 9.5 release notes and provides links for applying the updates. No CVSS scores are provided by Red Hat, but the overall severity is rated low.

The vulnerabilities may cause resource exhaustion (memory growth and excessive CPU time), potential use-after-free memory corruption, and buffer overread conditions within OpenSSL's TLS and cryptographic operations. These issues could affect the stability and security of applications relying on OpenSSL for TLS communications on Red Hat Enterprise Linux 9. However, Red Hat rates the overall security impact as low, and there are no known exploits in the wild at this time.

Red Hat has released updated OpenSSL and openssl-fips-provider packages as part of Red Hat Enterprise Linux 9.5 to address these vulnerabilities. Users should apply these official updates promptly to remediate the issues. Refer to the Red Hat advisory RHSA-2024:9333 and the article https://access.redhat.com/articles/11258 for detailed update instructions. No additional mitigations are indicated by Red Hat beyond applying the provided patches.