SUSE-RU-2026:5149-1: Recommended update for openssl-3

Q: What configuration changes are introduced by this update?

The update builds OpenSSL with enable-sslkeylog support, enabling use of the SSLKEYLOGFILE environment variable. It also adds an environment-variable override for strict CMS unauthenticated AEAD tag initialization and length enforcement.

Q: When can the CMS authentication checks be bypassed?

The bypass is enabled only when OPENSSL_ALLOW_CMS_UNAUTHENTICATED_AEAD is defined and set to a non-zero value. The update otherwise retains the strict checks introduced for CVE-2026-34182.

Published Nov 9, 2026

Updated

This update for openssl-3 fixes the following issues:

- Build with enable-sslkeylog to support the SSLKEYLOGFILE environment variable usage. (jsc#PED-17079)

- Allow to bypass the strict tag initialization and length enforcement added in the fix for CVE-2026-34182 when the env variable OPENSSLALLOWCMSUNAUTHENTICATEDAEAD is defined and set to a non-zero value. (bsc#1281325)

Affected Software

1 affected componentFixes available

suse/openssl-3<3.5.0-150700.5.56.1

3.5.0-150700.5.56.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade suse/openssl-3 to a version that resolves this vulnerability.
Fixed in 3.5.0-150700.5.56.1
Configuration
Build OpenSSL 3 with enable-sslkeylog to support SSLKEYLOGFILE.
openssl-3 enable-sslkeylog = enabled

Event History

Nov 9, 2026

Advisory Published

via OSV·05:43 PM

Data Sourced

via OSV·05:43 PM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-34182

Frequently Asked Questions

What configuration changes are introduced by this update?

The update builds OpenSSL with enable-sslkeylog support, enabling use of the SSLKEYLOGFILE environment variable. It also adds an environment-variable override for strict CMS unauthenticated AEAD tag initialization and length enforcement.

When can the CMS authentication checks be bypassed?

The bypass is enabled only when OPENSSL_ALLOW_CMS_UNAUTHENTICATED_AEAD is defined and set to a non-zero value. The update otherwise retains the strict checks introduced for CVE-2026-34182.

SUSE-RU-2026:5149-1: Recommended update for openssl-3

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

What configuration changes are introduced by this update?

When can the CMS authentication checks be bypassed?

Company

Resources

Contact

Frequently Asked Questions

What configuration changes are introduced by this update?

When can the CMS authentication checks be bypassed?