SUSE-RU-2026:5150-1: Recommended update for openssl-3
Published Nov 9, 2026
·Updated
This update for openssl-3 fixes the following issues:
- Allow to bypass the strict tag initialization and length enforcement added in the fix for CVE-2026-34182 when the env variable OPENSSLALLOWCMSUNAUTHENTICATEDAEAD is defined and set to a non-zero value. (bsc#1281325)
Affected Software
2 affected componentsFixes available
suse/openssl-3<3.1.4-150600.5.70.1
3.1.4-150600.5.70.1
suse/openssl-3<3.1.4-150600.5.70.1
3.1.4-150600.5.70.1
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
suse/openssl-3to a version that resolves this vulnerability.Fixed in 3.1.4-150600.5.70.1 - Configuration
Define OPENSSL_ALLOW_CMS_UNAUTHENTICATED_AEAD and set it to a non-zero value to bypass strict tag initialization and length enforcement.
OpenSSL 3 OPENSSL_ALLOW_CMS_UNAUTHENTICATED_AEAD = non-zero
Event History
Nov 9, 2026
Advisory Published
via OSV·05:43 PM
Data Sourced
via OSV·05:43 PM
DescriptionAffected Software