Newsheise Security

OpenSSL 4.1: Mehr Tempo für die Post-Quanten-Kryptografie

Share

Teaser from the source

OpenSSL 4.1.0 ist erschienen und bringt Unterstützung für DTLS 1.3, GREASE und Optimierungen für Post-Quanten-Verfahren.

This is the RSS-feed teaser. Read the full article at the original source.

Read at heise Security

Other advisories

MediumCVE-2026-84782OpenSSL: Mehrere Schwachstellen
HighCVE-2026-42768OpenSSL: Mehrere Schwachstellen
HighCVE-2025-15469OpenSSL: Mehrere Schwachstellen
HighCVE-2026-28387OpenSSL: Mehrere Schwachstellen
Not ratedosv:ROOT-APP-PYPI-CVE-2026-27459CVE-2026-27459 in pyOpenSSL - Patched by Root
Not ratedosv:SUSE-RU-2026:5018-1Recommended update for openssl-3
Not ratedosv:ECHO-f62c-6c16-552eGHSA-p85m-gvr3-788c: hostname verification skipped on the OpenSSL client path with a plain X509TrustManager when trust-manager wrapping is unavailable (Java 25+). Upstream's fix (in https://github.com/netty/netty/commit/9e05192391, 4.1.137.Final) only adds a check at context creation for an endpoint identification algorithm set with SslContextBuilder.endpointIdentificationAlgorithm(...), which netty added in 4.1.112.Final (0deca94aa1); 4.1.74.Final has no such setting. The other way to ask for hostname verification, SSLParameters on the engine, is the same in 4.1.74.Final and in fixed 4.1.137.Final (it sets SSL_CVERIFY_REQUIRED and leaves the check to the trust manager), and the fix does not change it. CVE-2026-50010, patched above, covers wrapping plain trust managers.
Not ratedosv:CLEANSTART-2025-ZT05905OpenSSL DSA signature algorithm has been shown to be vulnerable to a timing side channel attack

Other news entries

Source: https://www.heise.de/news/OpenSSL-4-1-Mehr-Tempo-fuer-die-Post-Quanten-Kryptografie-11499979.html

ID