SUSE-RU-2026:5018-1: Recommended update for openssl-3

Q: What configuration is required for the bypass to be possible?

The environment variable OPENSSL_ALLOW_CMS_UNAUTHENTICATED_AEAD must be defined and set to a non-zero value. Under that condition, strict tag initialization and length enforcement can be bypassed.

Q: Are installations without this environment variable affected by this specific bypass?

The advisory identifies the bypass only when OPENSSL_ALLOW_CMS_UNAUTHENTICATED_AEAD is defined with a non-zero value. It does not state that the bypass applies when the variable is unset or set to zero.

Q: What can be done before applying the update?

Remove OPENSSL_ALLOW_CMS_UNAUTHENTICATED_AEAD from the relevant process environment, or set it to zero. Check service definitions, startup scripts, containers, and other launch environments that may set the variable.

Published Nov 2, 2026

Updated

This update for openssl-3 fixes the following issues:

- Allow to bypass the strict tag initialization and length enforcement added in the fix for CVE-2026-34182 when the env variable OPENSSLALLOWCMSUNAUTHENTICATEDAEAD is defined and set to a non-zero value. (bsc#1281325)