RHSA-2026:60329: Low: mingw-openssl security update
Low: mingw-openssl security update
Other sources
The OpenSSL toolkit provides support for secure communications between machines. OpenSSL includes a certificate management tool and shared libraries which provide various cryptographic algorithms and protocols. This package contains Windows (MinGW) libraries and development tools.Security Fix(es): openssl: SSLselectnextproto buffer overread (CVE-2024-5535) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/mingw-opensslto a version that resolves this vulnerability.Fixed in 1.0.2k-4.el8_10 - Upgrade
Upgrade
redhat/mingw32-opensslto a version that resolves this vulnerability.Fixed in 1.0.2k-4.el8_10 - Upgrade
Upgrade
redhat/mingw32-openssl-debuginfoto a version that resolves this vulnerability.Fixed in 1.0.2k-4.el8_10 - Upgrade
Upgrade
redhat/mingw64-opensslto a version that resolves this vulnerability.Fixed in 1.0.2k-4.el8_10 - Upgrade
Upgrade
redhat/mingw64-openssl-debuginfoto a version that resolves this vulnerability.Fixed in 1.0.2k-4.el8_10
Event History
Frequently Asked Questions
Which deployments are relevant to this update?
The update applies to the listed Red Hat CodeReady Linux Builder for x86_64 MinGW OpenSSL packages, including mingw-openssl and the mingw32 and mingw64 OpenSSL and debuginfo packages. These are Windows (MinGW) libraries and development tools rather than the native OpenSSL package identified in the provided data.
What flaw is addressed?
The update addresses CVE-2024-5535, a buffer overread in OpenSSL's SSL_select_next_proto functionality.