Skip to main content
CVE-2024-2511VulnerabilityPublished 11/12/2024Updated 10/21/2026

Red Hat Security Advisory: openssl and openssl-fips-provider security update

Affects Red Hat Product Security Red HatSource GCVE Database

0

Mentioned vulnerabilities

Not known to be exploited · 52% EPSS · patch available : patch Red Hat Product Security Red Hat as a priority.

Data as of 10/25/2026, 04:40:09 UTC

Exploit forecast

Likely to be exploited

52.4% EPSS · Low severity · No CVSS score from NVD or the CNA

Exploitation

Not in CISA KEV, no exploitation reported

EPSS
52.4% chance of exploitation in 30 days – higher than 98% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch
Available

What to do

Affected software

ProductAffectedFixed in
Red Hat Product Security Red HatAffected
  • >=9.0.0 <9.5.0
  • >=9.6.0 <9.8.0
  • Red Hat
  • Red Hat Enterprise Linux
  • Red Hat Enterprise Linux AppStream (v. 9)
  • Red Hat Enterprise Linux BaseOS (v. 9)
  • src
  • <1.0.1f-1ubuntu2.27+esm16
  • <1.0.2g-1ubuntu4.20+esm18
  • <1.1.1-1ubuntu2.1~18.04.23+esm10
  • <1.0.2n-1ubuntu5.13+esm6
  • <1.1.1f-1ubuntu2.24+esm5
  • SUSE
  • i686
  • openssl-devel-1:3.2.2-6.el9_5.i686
  • openssl-fips-provider-0:3.0.7-6.el9_5.i686
  • openssl-libs-1:3.2.2-6.el9_5.i686
Fixed in
  • 9.5.0
  • 9.8.0
  • 1.0.1f-1ubuntu2.27+esm16
  • 1.0.2g-1ubuntu4.20+esm18
  • 1.1.1-1ubuntu2.1~18.04.23+esm10
  • 1.0.2n-1ubuntu5.13+esm6
  • 1.1.1f-1ubuntu2.24+esm5

AI-suggested

Red Hat has released updated packages for OpenSSL and openssl-fips-provider as part of Red Hat Enterprise Linux 9.5 and Extended Update Support releases. Applying these official updates will remediate the vulnerabilities. Users should follow Red Hat's guidance at https://access.redhat.com/articles/11258 to apply the updates. No additional mitigation steps are required beyond applying the vendor-provided patches.

Description

USN-8678-1 fixed vulnerabilities in OpenSSL. This update provides the corresponding fix for OpenSSL and OpenSSL 1.0 on Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and Ubuntu 18.04 LTS. In addition, this update also fixes the following issues that were not previously addressed in those releases: It was discovered that OpenSSL incorrectly handled TLS handshake message buffering. A remote attacker could possibly use this issue to cause OpenSSL to consume excessive memory, leading to a denial of service. (LP: #2161371) It was discovered that OpenSSL incorrectly handled session cache management when processing TLSv1.3 sessions. A remote attacker could possibly use this issue to cause OpenSSL to consume excessive memory, leading to a denial of service. This issue only affected OpenSSL 1.1.1 on Ubuntu 18.04 LTS. (CVE-2024-2511) It was discovered that OpenSSL incorrectly handled the SSL_select_next_proto function when called with an empty client protocol list. A remote attacker could possibly use this issue to cause OpenSSL to disclose private memory contents to the peer, leading to a loss of confidentiality. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2024-5535) Original advisory details: It was discovered that OpenSSL incorrectly handled buffering of DTLS records for a future epoch. A remote attacker could possibly use this issue to cause OpenSSL to use excessive resources, leading to a denial of service. (CVE-2026-54874) It was discovered that OpenSSL incorrectly handled CMS key unwrapping. A remote attacker could possibly use this issue to cause a heap buffer overflow, leading to a denial of service or arbitrary code execution. (CVE-2026-63072)

Impact

The vulnerabilities could lead to resource exhaustion (memory growth and excessive CPU time), potential use-after-free memory corruption, and buffer overread conditions within OpenSSL's TLS and cryptographic operations. These issues may affect the stability and security of applications relying on OpenSSL for TLS communications. However, the overall security impact is rated low by Red Hat, and no active exploitation is known.

Summary

This advisory covers four OpenSSL vulnerabilities fixed in Red Hat Enterprise Linux 9. The first (CVE-2024-2511) involves unbounded memory growth during TLSv1.3 session handling. The second (CVE-2024-4603) concerns excessive processing time when validating DSA keys and parameters. The third (CVE-2024-4741) is a use-after-free vulnerability related to SSL_free_buffers. The fourth (CVE-2024-5535) is a buffer overread in SSL_select_next_proto. Red Hat has released updated OpenSSL and openssl-fips-provider packages to address these issues in RHEL 9.5 and Extended Update Support versions. The advisory rates the security impact as low and no known exploits are reported in the wild.

Weaknesses

References

Community reviews

Loading reviews…