{"schema_version":"1.7.2","id":"OESA-2025-2327","modified":"2025-09-26T13:08:35Z","published":"2025-09-26T13:08:35Z","upstream":["CVE-2024-41996"],"summary":"openssl security update","details":"The OpenSSL Project is a collaborative effort to develop a robust, commercial-grade, fully featured, and Open Source toolkit implementing the Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1) protocols as well as a full-strength general purpose cryptography library. The project is managed by a worldwide community of volunteers that use the Internet to communicate, plan, and develop the OpenSSL tookit and its related documentation.\r\n\r\nSecurity Fix(es):\n\nValidating the order of the public keys in the Diffie-Hellman Key Agreement Protocol, when an approved safe prime is used, allows remote attackers (from the client side) to trigger unnecessarily expensive server-side DHE modular-exponentiation calculations. The client may cause asymmetric resource consumption. The basic attack scenario is that the client must claim that it can only communicate with DHE, and the server must be configured to allow DHE and validate the order of the public key.(CVE-2024-41996)","affected":[{"package":{"ecosystem":"openEuler:24.03-LTS","name":"openssl","purl":"pkg:rpm/openEuler/openssl&distro=openEuler-24.03-LTS"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.12-22.oe2403"}]}],"ecosystem_specific":{"aarch64":["openssl-3.0.12-22.oe2403.aarch64.rpm","openssl-debuginfo-3.0.12-22.oe2403.aarch64.rpm","openssl-debugsource-3.0.12-22.oe2403.aarch64.rpm","openssl-devel-3.0.12-22.oe2403.aarch64.rpm","openssl-libs-3.0.12-22.oe2403.aarch64.rpm","openssl-perl-3.0.12-22.oe2403.aarch64.rpm"],"noarch":["openssl-help-3.0.12-22.oe2403.noarch.rpm"],"src":["openssl-3.0.12-22.oe2403.src.rpm"],"x86_64":["openssl-3.0.12-22.oe2403.x86_64.rpm","openssl-debuginfo-3.0.12-22.oe2403.x86_64.rpm","openssl-debugsource-3.0.12-22.oe2403.x86_64.rpm","openssl-devel-3.0.12-22.oe2403.x86_64.rpm","openssl-libs-3.0.12-22.oe2403.x86_64.rpm","openssl-perl-3.0.12-22.oe2403.x86_64.rpm"]}}],"references":[{"type":"ADVISORY","url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2327"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-41996"}],"database_specific":{"severity":"High"}}