IT-Sentinel

« BACK_TO_HOME

PUBLISHED

2026-01-27 16:16

MODIFIED

2026-01-27 16:16

EPSS (Prob. Exploit)

0.13%

Top 97.2%

DATA SOURCES:

NVD 🔗 2026-01-27 RED HAT 🔗 2026-02-01 CWE MITRE 🔗 2026-11-01 FIRST EPSS 🔗 2026-11-08 OSV 🔗 2026-11-08 MSRC 🔗 2026-11-02

> DESCRIPTION

Issue summary: When using the low-level OCB API directly with AES-NI or other hardware-accelerated code paths, inputs whose length is not a multiple of 16 bytes can leave the final partial block unencrypted and unauthenticated. Impact summary: The trailing 1-15 bytes of a message may be exposed in cleartext on encryption and are not covered by the authentication tag, allowing an attacker to read or tamper with those bytes without detection. The low-level OCB encrypt and decrypt routines in the hardware-accelerated stream path process full 16-byte blocks but do not advance the input/output pointers. The subsequent tail-handling code then operates on the original base pointers, effectively reprocessing the beginning of the buffer while leaving the actual trailing bytes unprocessed. The authentication checksum also excludes the true tail bytes. However, typical OpenSSL consumers using EVP are not affected because the higher-level EVP and provider OCB implementations split inputs so that full blocks and trailing partial blocks are processed in separate calls, avoiding the problematic code path. Additionally, TLS does not use OCB ciphersuites. The vulnerability only affects applications that call the low-level CRYPTO_ocb128_encrypt() or CRYPTO_ocb128_decrypt() functions directly with non-block-aligned lengths in a single call on hardware-accelerated builds. For these reasons the issue was assessed as Low severity. The FIPS modules in 3.6, 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this issue, as OCB mode is not a FIPS-approved algorithm. OpenSSL 3.6, 3.5, 3.4, 3.3, 3.0 and 1.1.1 are vulnerable to this issue. OpenSSL 1.0.2 is not affected by this issue.

> AFFECTED_PRODUCTS

Red Hat - Red Hat Enterprise Linux 10

Version: 3.5.1

Red Hat - Red Hat Enterprise Linux 9

Version: 3.5.1

> WEAKNESSES

CWE-325

> CWE DETAILED DESCRIPTIONS

CWE-325: Missing Cryptographic Step - The product does not implement a required step in a cryptographic algorithm, resulting in weaker encryption than advertised by the algorithm.

> RED HAT SECURITY ADVISORIES

RHSA-2026:1473 IMPORTANT

Red Hat Security Advisory: openssl security update

An update for openssl is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (...

RHSA-2026:1472 IMPORTANT

Red Hat Security Advisory: openssl security update

An update for openssl is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System...

RHSA-2026:2485 IMPORTANT

Red Hat Security Advisory: Insights proxy Container Image

Initial GA Release of Red Hat Insights proxy

RHSA-2026:2563 IMPORTANT

Red Hat Security Advisory: Red Hat Update Infrastructure 5 security update

The latest release of Red Hat Update Infrastructure. For more details, see the product documentation.

RHSA-2026:3228 IMPORTANT

Red Hat Security Advisory: Cost Management Metrics Operator Update

Cost Management Metrics Operator version 4.3.1 release.

RHSA-2026:4943 IMPORTANT

Red Hat Security Advisory: Red Hat Update Infrastructure 5.1 security update

The latest release of Red Hat Update Infrastructure. For more details, see the product documentation.

RHSA-2026:71542 IMPORTANT

Red Hat Security Advisory: openssl security update

An update for openssl is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vul...

RHSA-2026:82372 IMPORTANT

Red Hat Security Advisory: cert-manager Operator for Red Hat OpenShift 1.18.2

cert-manager Operator for Red Hat OpenShift 1.18.2

RHSA-2026:82354 IMPORTANT

Red Hat Security Advisory: cert-manager Operator for Red Hat OpenShift 1.18.2

cert-manager Operator for Red Hat OpenShift 1.18.2

RHSA-2026:82347 IMPORTANT

Red Hat Security Advisory: cert-manager Operator for Red Hat OpenShift 1.18.2

cert-manager Operator for Red Hat OpenShift 1.18.2

RHSA-2026:82857 IMPORTANT

Red Hat Security Advisory: cert-manager Operator for Red Hat OpenShift 1.18.2

cert-manager Operator for Red Hat OpenShift 1.18.2

RHSA-2026:83617 IMPORTANT

Red Hat Security Advisory: openssl security update

An update for openssl is now available for Red Hat Enterprise Linux 9.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vuln...

RHSA-2026:84572 IMPORTANT

Red Hat Security Advisory: openssl security update

An update for openssl is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A C...

RHSA-2026:84573 IMPORTANT

Red Hat Security Advisory: openssl security update

An update for openssl is now available for Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A C...

RHSA-2026:91249 CRITICAL

Red Hat Security Advisory: Red Hat AI Base Images 3.5.5 (Neuron)

Red Hat AI Base Images 3.5.5 (Neuron) is now available.

RHSA-2026:91248 CRITICAL

Red Hat Security Advisory: Red Hat AI Base Images 3.4.6 (Neuron)

Red Hat AI Base Images 3.4.6 (Neuron) is now available.

RHSA-2026:91246 CRITICAL

Red Hat Security Advisory: Red Hat AI Base Images 3.5.5 (ROCm 7.14)

Red Hat AI Base Images 3.5.5 (ROCm 7.14) is now available.

RHSA-2026:91245 CRITICAL

Red Hat Security Advisory: Red Hat AI Base Images 3.4.6 (Spyre)

Red Hat AI Base Images 3.4.6 (Spyre) is now available.

RHSA-2026:91244 CRITICAL

Red Hat Security Advisory: Red Hat AI Base Images 3.4.6 (ROCm 6.4)

Red Hat AI Base Images 3.4.6 (ROCm 6.4) is now available.

RHSA-2026:91243 CRITICAL

Red Hat Security Advisory: Red Hat AI Base Images 3.0.7 (TPU)

Red Hat AI Base Images 3.0.7 (TPU) is now available.

RHSA-2026:91242 CRITICAL

Red Hat Security Advisory: Red Hat AI Base Images 3.5.5 (Spyre)

Red Hat AI Base Images 3.5.5 (Spyre) is now available.

RHSA-2026:91241 CRITICAL

Red Hat Security Advisory: Red Hat AI Base Images 3.4.6 (CPU)

Red Hat AI Base Images 3.4.6 (CPU) is now available.

RHSA-2026:91238 CRITICAL

Red Hat Security Advisory: Red Hat AI Base Images 3.5.5 (CUDA 13.0)

Red Hat AI Base Images 3.5.5 (CUDA 13.0) is now available.

RHSA-2026:91237 CRITICAL

Red Hat Security Advisory: Red Hat AI Base Images 3.5.5 (CUDA 12.9)

Red Hat AI Base Images 3.5.5 (CUDA 12.9) is now available.

RHSA-2026:91236 CRITICAL

Red Hat Security Advisory: Red Hat AI Base Images 3.0.7 (CUDA)

Red Hat AI Base Images 3.0.7 (CUDA) is now available.

RHSA-2026:91235 CRITICAL

Red Hat Security Advisory: Red Hat AI Base Images 3.4.6 (CUDA 13.0)

Red Hat AI Base Images 3.4.6 (CUDA 13.0) is now available.

RHSA-2026:91234 CRITICAL

Red Hat Security Advisory: Red Hat AI Base Images 3.4.6 (Gaudi)

Red Hat AI Base Images 3.4.6 (Gaudi) is now available.

RHSA-2026:91233 CRITICAL

Red Hat Security Advisory: Red Hat AI Base Images 3.4.6 (TPU)

Red Hat AI Base Images 3.4.6 (TPU) is now available.

RHSA-2026:91232 CRITICAL

Red Hat Security Advisory: Red Hat AI Base Images 3.0.7 (CPU)

Red Hat AI Base Images 3.0.7 (CPU) is now available.

RHSA-2026:91224 CRITICAL

Red Hat Security Advisory: Red Hat AI Base Images 3.5.5 (Rubin)

Red Hat AI Base Images 3.5.5 (Rubin) is now available.

RHSA-2026:91219 CRITICAL

Red Hat Security Advisory: Red Hat AI Base Images 3.0.7 (ROCm)

Red Hat AI Base Images 3.0.7 (ROCm) is now available.

RHSA-2026:91218 CRITICAL

Red Hat Security Advisory: Red Hat AI Base Images 3.4.6 (CUDA 12.9)

Red Hat AI Base Images 3.4.6 (CUDA 12.9) is now available.

RHSA-2026:91217 CRITICAL

Red Hat Security Advisory: Red Hat AI Base Images 3.4.6 (ROCm 7.1)

Red Hat AI Base Images 3.4.6 (ROCm 7.1) is now available.

RHSA-2026:91207 CRITICAL

Red Hat Security Advisory: Red Hat AI Base Images 3.5.5 (Gaudi)

Red Hat AI Base Images 3.5.5 (Gaudi) is now available.

RHSA-2026:91206 CRITICAL

Red Hat Security Advisory: Red Hat AI Base Images 3.0.7 (Spyre)

Red Hat AI Base Images 3.0.7 (Spyre) is now available.

RHSA-2026:91204 CRITICAL

Red Hat Security Advisory: Red Hat AI Base Images 3.5.5 (CPU)

Red Hat AI Base Images 3.5.5 (CPU) is now available.

RHSA-2026:91202 CRITICAL

Red Hat Security Advisory: Red Hat AI Base Images 3.5.5 (TPU)

Red Hat AI Base Images 3.5.5 (TPU) is now available.

RHSA-2026:94468 CRITICAL

Red Hat Security Advisory: Red Hat AI Base Images 3.4.7 (CUDA 13.0)

Red Hat AI Base Images 3.4.7 (CUDA 13.0) is now available.

RHSA-2026:94459 CRITICAL

Red Hat Security Advisory: Red Hat AI Base Images 3.0.8 (CPU)

Red Hat AI Base Images 3.0.8 (CPU) is now available.

RHSA-2026:94476 CRITICAL

Red Hat Security Advisory: Red Hat AI Base Images 3.0.8 (CUDA)

Red Hat AI Base Images 3.0.8 (CUDA) is now available.

RHSA-2026:94474 CRITICAL

Red Hat Security Advisory: Red Hat AI Base Images 3.5.6 (CUDA 12.9)

Red Hat AI Base Images 3.5.6 (CUDA 12.9) is now available.

> RED HAT SEVERITY ASSESSMENT

THREAT SEVERITY

Low

> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)

Unauthenticated/unencrypted trailing bytes with low-level OCB function calls

AFFECTED PACKAGES:

Unknown / Unknown

45 versions affected

> HISTORIQUE DES MODIFICATIONS

Première apparition

27/01/2026 16:16

Source: NVD

📊 ENRICHISSEMENT 01/02/2026 06:45

CWE

Champ modifié: Description CWE

Ancienne valeur:

N/A

Nouvelle valeur:

CWE-325: Missing Cryptographic Step - The product does not implement a required step in a cryptographic algorithm, resulting in weaker encryption than advertised by the algorithm.

📊 ENRICHISSEMENT 01/02/2026 05:01

REDHAT

Champ modifié: Sévérité Red Hat

Ancienne valeur:

{ "severity_scale": null, "threat_severity": "Low" }

Nouvelle valeur:

{ "threat_severity": "Low", "severity_scale": null }

📊 ENRICHISSEMENT 28/01/2026 23:30

REDHAT

Champ modifié: Sévérité Red Hat

Ancienne valeur:

{ "severity_scale": null, "threat_severity": "Low" }

Nouvelle valeur:

{ "threat_severity": "Low", "severity_scale": null }

📊 ENRICHISSEMENT 28/01/2026 22:30

REDHAT

Champ modifié: Sévérité Red Hat

Ancienne valeur:

{ "severity_scale": null, "threat_severity": "Low" }

Nouvelle valeur:

{ "threat_severity": "Low", "severity_scale": null }

📊 ENRICHISSEMENT 28/01/2026 21:30

REDHAT

Champ modifié: Sévérité Red Hat

Ancienne valeur:

{ "severity_scale": null, "threat_severity": "Low" }

Nouvelle valeur:

{ "threat_severity": "Low", "severity_scale": null }

📊 ENRICHISSEMENT 28/01/2026 20:30

REDHAT

Champ modifié: Sévérité Red Hat

Ancienne valeur:

{ "severity_scale": null, "threat_severity": "Low" }

Nouvelle valeur:

{ "threat_severity": "Low", "severity_scale": null }

📊 ENRICHISSEMENT 28/01/2026 19:30

REDHAT

Champ modifié: Sévérité Red Hat

Ancienne valeur:

{ "severity_scale": null, "threat_severity": "Low" }

Nouvelle valeur:

{ "threat_severity": "Low", "severity_scale": null }

📊 ENRICHISSEMENT 28/01/2026 18:30

REDHAT

Champ modifié: Sévérité Red Hat

Ancienne valeur:

{ "severity_scale": null, "threat_severity": "Low" }

Nouvelle valeur:

{ "threat_severity": "Low", "severity_scale": null }

📊 ENRICHISSEMENT 28/01/2026 17:30

REDHAT

Champ modifié: Sévérité Red Hat

Ancienne valeur:

{ "severity_scale": null, "threat_severity": "Low" }

Nouvelle valeur:

{ "threat_severity": "Low", "severity_scale": null }

📊 ENRICHISSEMENT 28/01/2026 16:30

REDHAT

Champ modifié: Sévérité Red Hat

Ancienne valeur:

{ "severity_scale": null, "threat_severity": "Low" }

Nouvelle valeur:

{ "threat_severity": "Low", "severity_scale": null }

📊 ENRICHISSEMENT 28/01/2026 15:30

REDHAT

Champ modifié: Sévérité Red Hat

Ancienne valeur:

{ "severity_scale": null, "threat_severity": "Low" }

Nouvelle valeur:

{ "threat_severity": "Low", "severity_scale": null }

📊 ENRICHISSEMENT 28/01/2026 14:30

REDHAT

Champ modifié: Sévérité Red Hat

Ancienne valeur:

{ "severity_scale": null, "threat_severity": "Low" }

Nouvelle valeur:

{ "threat_severity": "Low", "severity_scale": null }

📊 ENRICHISSEMENT 28/01/2026 13:30

REDHAT

Champ modifié: Sévérité Red Hat

Ancienne valeur:

{ "severity_scale": null, "threat_severity": "Low" }

Nouvelle valeur:

{ "threat_severity": "Low", "severity_scale": null }

📊 ENRICHISSEMENT 28/01/2026 12:30

REDHAT

Champ modifié: Sévérité Red Hat

Ancienne valeur:

{ "severity_scale": null, "threat_severity": "Low" }

Nouvelle valeur:

{ "threat_severity": "Low", "severity_scale": null }

📊 ENRICHISSEMENT 28/01/2026 11:30

REDHAT

Champ modifié: Sévérité Red Hat

Ancienne valeur:

{ "severity_scale": null, "threat_severity": "Low" }

Nouvelle valeur:

{ "threat_severity": "Low", "severity_scale": null }

📊 ENRICHISSEMENT 28/01/2026 10:30

REDHAT

Champ modifié: Sévérité Red Hat

Ancienne valeur:

{ "severity_scale": null, "threat_severity": "Low" }

Nouvelle valeur:

{ "threat_severity": "Low", "severity_scale": null }

📊 ENRICHISSEMENT 28/01/2026 09:30

REDHAT

Champ modifié: Sévérité Red Hat

Ancienne valeur:

{ "severity_scale": null, "threat_severity": "Low" }

Nouvelle valeur:

{ "threat_severity": "Low", "severity_scale": null }

📊 ENRICHISSEMENT 28/01/2026 08:30

REDHAT

Champ modifié: Sévérité Red Hat

Ancienne valeur:

{ "severity_scale": null, "threat_severity": "Low" }

Nouvelle valeur:

{ "threat_severity": "Low", "severity_scale": null }

📊 ENRICHISSEMENT 28/01/2026 07:30

REDHAT

Champ modifié: Sévérité Red Hat

Ancienne valeur:

{ "severity_scale": null, "threat_severity": "Low" }

Nouvelle valeur:

{ "threat_severity": "Low", "severity_scale": null }

📊 ENRICHISSEMENT 28/01/2026 06:30

REDHAT

Champ modifié: Sévérité Red Hat

Ancienne valeur:

{ "severity_scale": null, "threat_severity": "Low" }

Nouvelle valeur:

{ "threat_severity": "Low", "severity_scale": null }

📊 ENRICHISSEMENT 28/01/2026 05:30

REDHAT

Champ modifié: Sévérité Red Hat

Ancienne valeur:

{ "severity_scale": null, "threat_severity": "Low" }

Nouvelle valeur:

{ "threat_severity": "Low", "severity_scale": null }

📊 ENRICHISSEMENT 28/01/2026 04:30

REDHAT

Champ modifié: Sévérité Red Hat

Ancienne valeur:

{ "severity_scale": null, "threat_severity": "Low" }

Nouvelle valeur:

{ "threat_severity": "Low", "severity_scale": null }

📊 ENRICHISSEMENT 28/01/2026 03:30

REDHAT

Champ modifié: Sévérité Red Hat

Ancienne valeur:

{ "severity_scale": null, "threat_severity": "Low" }

Nouvelle valeur:

{ "threat_severity": "Low", "severity_scale": null }

📊 ENRICHISSEMENT 28/01/2026 02:30

REDHAT

Champ modifié: Sévérité Red Hat

Ancienne valeur:

{ "severity_scale": null, "threat_severity": "Low" }

Nouvelle valeur:

{ "threat_severity": "Low", "severity_scale": null }

📊 ENRICHISSEMENT 28/01/2026 01:30

REDHAT

Champ modifié: Sévérité Red Hat

Ancienne valeur:

{ "severity_scale": null, "threat_severity": "Low" }

Nouvelle valeur:

{ "threat_severity": "Low", "severity_scale": null }

📊 ENRICHISSEMENT 28/01/2026 00:30

REDHAT

Champ modifié: Sévérité Red Hat

Ancienne valeur:

N/A

Nouvelle valeur:

{ "threat_severity": "Low", "severity_scale": null }

📊 ENRICHISSEMENT 28/01/2026 00:30

REDHAT

Champ modifié: Red Hat

Ancienne valeur:

Non

Nouvelle valeur:

Oui

Total des modifications: 27 Dernière mise à jour: 9 months ago

> REFERENCES

https://github.com/openssl/openssl/commit/372fc5c77529695b05b4f5b5187691a57ef5df...

https://github.com/openssl/openssl/commit/4016975d4469cd6b94927c607f7c511385f928...

https://github.com/openssl/openssl/commit/52d23c86a54adab5ee9f80e48b242b52c4cc23...

https://github.com/openssl/openssl/commit/a7589230356d908c0eca4b969ec4f62106f4f5...

https://github.com/openssl/openssl/commit/ed40856d7d4ba6cb42779b6770666a65f19cb9...

https://openssl-library.org/news/secadv/20260127.txt

« BACK_TO_HOME

> CVE-2025-69418

> DESCRIPTION

> AFFECTED_PRODUCTS

> WEAKNESSES

> CWE DETAILED DESCRIPTIONS

> RED HAT SECURITY ADVISORIES

> RED HAT SEVERITY ASSESSMENT

> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)

> HISTORIQUE DES MODIFICATIONS

> REFERENCES