Red Hat Security Advisory: Red Hat Update Infrastructure 5.3 Technology Preview security update

Weakness classes (CWE)

• CWE-325Base

  Missing Cryptographic Step

  The product does not implement a required step in a cryptographic algorithm, resulting in weaker encryption than advertised by the algorithm.

  cwe.mitre.org →

Reanalysis & status changes

Chronological NVD audit events for this CVE — reanalyses, CVSS updates, CPE diffs.

1. CVE Translated2026-07-23 08:10 UTC· nvd@nist.gov
   • Translation: Title: OpenSSL, Description: Resumen del problema: Las implementaciones de AES-SIV (RFC 5297) y AES-GCM-SIV (RFC 8452) manejan incorrectamente la autenticación de AAD (Datos Autenticados Adicionales) con un texto cifrado vacío, permitiendo una falsificación de dichos mensajes. Resumen del impacto: Un atacante puede falsificar mensajes vacíos con AAD arbitrario a la aplicación de la víctima usando estos cifrados. AES-SIV (RFC 5297) y AES-GCM-SIV (RFC 8452) son modos AEAD resistentes al uso indebido de nonce: aceptan una clave, nonce, AAD opcional (bytes que son autenticados pero no cifrados) y texto plano, y producen texto cifrado más una etiqueta de 16 bytes. Al descifrar, 'EVP_DecryptFinal_ex()' está documentado para devolver éxito solo si la etiqueta se verifica con éxito. En la implementación del proveedor de OpenSSL de estos cifrados, la etiqueta esperada se calcula solo cuando la función de descifrado se invoca con datos no vacíos. Si el llamador suministra AAD y luego llama a 'EVP_DecryptFinal_ex()' sin invocar la actualización del texto cifrado, lo que puede ocurrir cuando la longitud del texto cifrado recibido es cero, la etiqueta nunca se recalcula y aún mantiene su valor de todo ceros. Cuando se usa AES-GCM-SIV, un atacante que envía AAD arbitrario, texto cifrado vacío y una etiqueta de todo ceros pasa la autenticación bajo cualquier clave que no conozca, de una sola vez. Cuando se usa AES-SIV, para montar el ataque es necesario que la aplicación reutilice el contexto de descifrado sin restablecer la clave. AES-SIV está implementado desde OpenSSL 3.0. AES-GCM-SIV está implementado desde OpenSSL 3.2. Ningún protocolo implementado en OpenSSL mismo (TLS/CMS/PKCS7/HPKE/QUIC) soporta AES-GCM-SIV o AES-SIV. Para montar un ataque, las aplicaciones deben implementar su propio protocolo y usar la interfaz EVP. También deben omitir la actualización del texto cifrado cuando llega un mensaje con un texto cifrado vacío. Los módulos FIPS en 4.0, 3.6, 3.5, 3.4 y 3.0 no se ven afectados por este problema, ya que estos algoritmos no están aprobados por FIPS y el código afectado está fuera del límite del módulo FIPS de OpenSSL.
2. Initial Analysis2026-06-16 02:57 UTC· nvd@nist.gov
   • CPE Configuration: OR *cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:* versions from (including) 3.0.0 up to (excluding) 3.0.21 *cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:* versions from (including) 3.4.0 up to (excluding) 3.4.6 *cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:* versions from (including) 3.5.0 up to (excluding) 3.5.7 *cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:* versions from (including) 3.6.0 up to (excluding) 3.6.3 *cpe:2.3:a:openssl:openssl:4.0.0:-:*:*:*:*:*:*
   • Reference Type: OpenSSL Software Foundation: https://github.com/openssl/openssl/commit/25b32cd9d41d2bc01b6abc425bb4baf2c2236fdc Types: Patch
   • Reference Type: OpenSSL Software Foundation: https://github.com/openssl/openssl/commit/71e2a5d263518cf5866043bd60ee4994d59e53a3 Types: Patch
   • Reference Type: OpenSSL Software Foundation: https://github.com/openssl/openssl/commit/7fe3f33a3b3a4c487aa4dcdbc87057f66ffd2b85 Types: Patch
3. CVE Modified2026-06-10 08:16 UTC· openssl-security@openssl.org
   • Reference: https://github.com/openssl/openssl/commit/25b32cd9d41d2bc01b6abc425bb4baf2c2236fdc
   • Reference: https://github.com/openssl/openssl/commit/71e2a5d263518cf5866043bd60ee4994d59e53a3
   • Reference: https://github.com/openssl/openssl/commit/7fe3f33a3b3a4c487aa4dcdbc87057f66ffd2b85
   • Reference: https://github.com/openssl/openssl/commit/daca0f48e4a69a2892a62262bad59e62a8a76598

Affected operating systems

• linux

  ubuntu / coreutilsjammy

• linux

  ubuntu / coreutilsnoble

• linux

  ubuntu / coreutilsresolute

• linux

  debian / debian_linux11.0

• linux

  redhat / enterprise_linux10.0

• linux

  redhat / enterprise_linux10.2

• linux

  redhat / enterprise_linux6.0

• linux

  redhat / enterprise_linux7.0

• linux

  redhat / enterprise_linux8.0

• linux

  redhat / enterprise_linux9.0

• linux

  redhat / enterprise_linux9.8

• linux

  redhat / enterprise_linux_for_els10.2

• linux

  redhat / enterprise_linux_for_els8.10

• linux

  redhat / enterprise_linux_for_els9.8

• linux

  redhat / enterprise_linux_for_eus10.2

• linux

  redhat / enterprise_linux_for_eus9.8

• linux

  redhat / enterprise_linux_for_ibm_z_systems10.2

• linux

  redhat / enterprise_linux_for_ibm_z_systems8.0_s390x

• linux

  redhat / enterprise_linux_for_ibm_z_systems9.0_s390x

• linux

  redhat / enterprise_linux_for_ibm_z_systems_els10.2

• linux

  redhat / enterprise_linux_for_ibm_z_systems_els8.10

• linux

  redhat / enterprise_linux_for_ibm_z_systems_els9.8

• linux

  redhat / enterprise_linux_for_ibm_z_systems_eus10.2

• linux

  redhat / enterprise_linux_for_ibm_z_systems_eus9.8

Affected products

Products and version ranges extracted from the vendor/CERT advisory. A range like „<4.14.6“ implies the update recommendation „upgrade to 4.14.6 or later“.

• Apple

  iOS18.7.10

• Apple

  iOS26.6.1

• Apple

  iPadOS18.7.10

• Apple

  iPadOS26.6.1

• Apple

  macOSTahoe 26.6.2

• bitnami

  jre1.9.0

• bitnami

  nginx-gateway0.1.17

• bitnami

  nginx-gateway-fabric1.3.0

• bitnami

  postgresql15.0.0

• bitnami

  postgresql16.0.0

• bitnami

  postgresql17.0.0

• bitnami

  postgresql18.0.0

• bitnami

  python-min3.10.0

• bitnami

  python-min3.11.0

• bitnami

  python-min3.12.0

• bitnami

  python-min3.13.0

• bitnami

  python-min3.14.0

• f5

  dos4.3.0 – 4.7.0

• f5

  dos

• f5

  nginx_gateway_fabric1.3.0 – 1.6.2

• f5

  nginx_gateway_fabric2.0.0 – 2.5.1

• f5

  nginx_ingress_controller3.5.0 – 3.7.2

• f5

  nginx_ingress_controller4.0.0 – 4.0.1

• f5

  nginx_ingress_controller5.0.0 – 5.4.1

References & sources

• https://gitlab.gnome.org/GNOME/libxml2/-/issues/720
• https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.12.7
• https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.11.8
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/INKSSLW5VMZIXHRPZBAW4TJUX5SQKARG/
  vendor-advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VRDJCNQP32LV56KESUQ5SNZKAJWSZZRI/
  vendor-advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5HVUXKYTBWT3G5DEEQX62STJQBY367NL/
  vendor-advisory
• https://lists.debian.org/debian-lts-announce/2025/07/msg00014.html
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5HVUXKYTBWT3G5DEEQX62STJQBY367NL/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/INKSSLW5VMZIXHRPZBAW4TJUX5SQKARG/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VRDJCNQP32LV56KESUQ5SNZKAJWSZZRI/
• https://www.postgresql.org/support/security/CVE-2026-6472/
  euvd
• https://nvd.nist.gov/vuln/detail/CVE-2026-6472
  web
• https://openssl-library.org/news/secadv/20260609.txt
  vendor-advisory
• https://github.com/openssl/openssl/commit/f04b377be3d821741c86d1f4bf84dee09f3d5c3e
  patch
• https://github.com/openssl/openssl/commit/a2ca7b2d73e0ffc1eae183fe6e1741dac767cb4f
  patch
• https://github.com/openssl/openssl/commit/bbb151a83041705d9d001ed2f9c12f5523e1b54d
  patch
• https://github.com/openssl/openssl/commit/dd68364107a58841c0a2546812518b65d3a23abd
  patch
• https://access.redhat.com/errata/RHSA-2026:13274
  euvd
• https://access.redhat.com/security/cve/CVE-2026-3832
  euvd
• https://bugzilla.redhat.com/show_bug.cgi?id=2445762
  euvd

Linked CVEs

• CVE-2026-9547

  A flaw was found in curl.

  criticalCVSSv3 9.1
• CVE-2026-9256

  A flaw was found in the ngx_http_rewrite_module module of NGINX.

  criticalCVSSv3 8.1
• CVE-2026-9076

  A flaw was found in OpenSSL.

  highCVSSv3 7.5
• CVE-2026-8286

  A flaw was found in curl.

  highCVSSv3 8.1
• CVE-2026-7383

  A flaw was found in OpenSSL.

  highCVSSv3 8.1
• CVE-2026-6637

  A flaw was found in PostgreSQL.

  highCVSSv3 8.8
• CVE-2026-6479

  A flaw was found in PostgreSQL.

  highCVSSv3 7.5
• CVE-2026-6478

  A flaw was found in PostgreSQL.

  mediumCVSSv3 6.5
• CVE-2026-6477

  A flaw was found in PostgreSQL libpq.

  highCVSSv3 8.8
• CVE-2026-6475

  A flaw was found in PostgreSQL.

  highCVSSv3 8.8
• CVE-2026-6474

  A flaw was found in PostgreSQL.

  mediumCVSSv3 4.3
• CVE-2026-6473

  A flaw was found in PostgreSQL.

  highCVSSv3 8.8
• CVE-2026-6472

  A flaw was found in PostgreSQL CREATE TYPE handling for multirange types.

  mediumCVSSv3 5.4
• CVE-2026-6238

  A flaw was found in glibc (GNU C Library).

  mediumCVSSv3 6.5
• CVE-2026-60002

  A flaw was found in OpenSSH.

  highCVSSv3 7.7
• CVE-2026-59996

  A flaw was found in OpenSSH, a widely used tool for secure remote access.

  mediumCVSSv3 4.2
• CVE-2026-59858

  A command injection vulnerability in Vim's C omni-completion script allows an attacker to execute arbitrary commands if a user is tricked…

  highCVSSv3 7.8
• CVE-2026-59856

  A flaw was found in Vim, an open-source command-line text editor.

  highCVSSv3 7.8
• CVE-2026-5928

  A flaw was found in glibc (GNU C Library).

  highCVSSv3 7.5
• CVE-2026-58055

  A flaw in nghttp2's nghttpx proxy allows a remote attacker to perform HTTP request smuggling and cross-client response-queue poisoning.

  mediumCVSSv3 5.4
• CVE-2026-58016

  A flaw was found in GLib.

  criticalCVSSv3 9.1
• CVE-2026-58015

  A flaw was found in GLib.

  highCVSSv3 7.5
• CVE-2026-58014

  A flaw was found in GLib.

  highCVSSv3 8.6
• CVE-2026-58013

  A flaw was found in GLib.

  highCVSSv3 8.2