openssl, openssl1.0 vulnerabilities (CVE-2024-2511)
USN-8678-1 fixed vulnerabilities in OpenSSL. This update provides the corresponding fix for OpenSSL and OpenSSL 1.0 on Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and Ubuntu 18.04 LTS. In addition, this update also fixes the following issues that were not previously addressed in those releases: It was discovered that OpenSSL incorrectly handled TLS handshake message buffering. A remote attacker could possibly use this issue to cause OpenSSL to consume excessive memory, leading to a denial of service. (LP: #2161371) It was discovered that OpenSSL incorrectly handled session cache management when processing TLSv1.3 sessions. A remote attacker could possibly use this issue to cause OpenSSL to consume excessive memory, leading to a denial of service. This issue only affected OpenSSL 1.1.1 on Ubuntu 18.04 LTS. (CVE-2024-2511) It was discovered that OpenSSL incorrectly handled the SSL_select_next_proto function when called with an empty client protocol list. A remote attacker could possibly use this issue to cause OpenSSL to disclose private memory contents to the peer, leading to a loss of confidentiality. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2024-5535) Original advisory details: It was discovered that OpenSSL incorrectly handled buffering of DTLS records for a future epoch. A remote attacker could possibly use this issue to cause OpenSSL to use excessive resources, leading to a denial of service. (CVE-2026-54874) It was discovered that OpenSSL incorrectly handled CMS key unwrapping. A remote attacker could possibly use this issue to cause a heap buffer overflow, leading to a denial of service or arbitrary code execution. (CVE-2026-63072)
AI Analysis
Technical Summary
This advisory covers four OpenSSL vulnerabilities fixed in Red Hat Enterprise Linux 9. The first (CVE-2024-2511) involves unbounded memory growth during TLSv1.3 session handling. The second (CVE-2024-4603) concerns excessive processing time when validating DSA keys and parameters. The third (CVE-2024-4741) is a use-after-free vulnerability related to SSL_free_buffers. The fourth (CVE-2024-5535) is a buffer overread in SSL_select_next_proto. Red Hat has released updated OpenSSL and openssl-fips-provider packages to address these issues in RHEL 9.5 and Extended Update Support versions. The advisory rates the security impact as low and no known exploits are reported in the wild.
Potential Impact
The vulnerabilities could lead to resource exhaustion (memory growth and excessive CPU time), potential use-after-free memory corruption, and buffer overread conditions within OpenSSL's TLS and cryptographic operations. These issues may affect the stability and security of applications relying on OpenSSL for TLS communications. However, the overall security impact is rated low by Red Hat, and no active exploitation is known.
Mitigation Recommendations
Red Hat has released updated packages for OpenSSL and openssl-fips-provider as part of Red Hat Enterprise Linux 9.5 and Extended Update Support releases. Applying these official updates will remediate the vulnerabilities. Users should follow Red Hat's guidance at https://access.redhat.com/articles/11258 to apply the updates. No additional mitigation steps are required beyond applying the vendor-provided patches.
openssl, openssl1.0 vulnerabilities (CVE-2024-2511)
Description
USN-8678-1 fixed vulnerabilities in OpenSSL. This update provides the corresponding fix for OpenSSL and OpenSSL 1.0 on Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and Ubuntu 18.04 LTS. In addition, this update also fixes the following issues that were not previously addressed in those releases: It was discovered that OpenSSL incorrectly handled TLS handshake message buffering. A remote attacker could possibly use this issue to cause OpenSSL to consume excessive memory, leading to a denial of service. (LP: #2161371) It was discovered that OpenSSL incorrectly handled session cache management when processing TLSv1.3 sessions. A remote attacker could possibly use this issue to cause OpenSSL to consume excessive memory, leading to a denial of service. This issue only affected OpenSSL 1.1.1 on Ubuntu 18.04 LTS. (CVE-2024-2511) It was discovered that OpenSSL incorrectly handled the SSL_select_next_proto function when called with an empty client protocol list. A remote attacker could possibly use this issue to cause OpenSSL to disclose private memory contents to the peer, leading to a loss of confidentiality. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2024-5535) Original advisory details: It was discovered that OpenSSL incorrectly handled buffering of DTLS records for a future epoch. A remote attacker could possibly use this issue to cause OpenSSL to use excessive resources, leading to a denial of service. (CVE-2026-54874) It was discovered that OpenSSL incorrectly handled CMS key unwrapping. A remote attacker could possibly use this issue to cause a heap buffer overflow, leading to a denial of service or arbitrary code execution. (CVE-2026-63072)
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This advisory covers four OpenSSL vulnerabilities fixed in Red Hat Enterprise Linux 9. The first (CVE-2024-2511) involves unbounded memory growth during TLSv1.3 session handling. The second (CVE-2024-4603) concerns excessive processing time when validating DSA keys and parameters. The third (CVE-2024-4741) is a use-after-free vulnerability related to SSL_free_buffers. The fourth (CVE-2024-5535) is a buffer overread in SSL_select_next_proto. Red Hat has released updated OpenSSL and openssl-fips-provider packages to address these issues in RHEL 9.5 and Extended Update Support versions. The advisory rates the security impact as low and no known exploits are reported in the wild.
Potential Impact
The vulnerabilities could lead to resource exhaustion (memory growth and excessive CPU time), potential use-after-free memory corruption, and buffer overread conditions within OpenSSL's TLS and cryptographic operations. These issues may affect the stability and security of applications relying on OpenSSL for TLS communications. However, the overall security impact is rated low by Red Hat, and no active exploitation is known.
Mitigation Recommendations
Red Hat has released updated packages for OpenSSL and openssl-fips-provider as part of Red Hat Enterprise Linux 9.5 and Extended Update Support releases. Applying these official updates will remediate the vulnerabilities. Users should follow Red Hat's guidance at https://access.redhat.com/articles/11258 to apply the updates. No additional mitigation steps are required beyond applying the vendor-provided patches.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2024:9333
- Cve Count
- 4
- Additional Cves
- ["CVE-2024-4603","CVE-2024-4741","CVE-2024-5535"]
- Cvss Version
- null
Threat ID: 6a18be67e29bf47b50386ec5
Added to database: 05/28/2026, 22:15:03 UTC
Last enriched: 08/04/2026, 16:48:10 UTC
Last updated: 09/09/2026, 22:52:01 UTC
Views: 527
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.