The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-25237 advisory.

    - Patch asn1_d2i_read_bio to read headers without blocking       Resolves: RHEL-169991

    Fix CVE-2026-7383, CVE-2026-9076, CVE-2026-34180, CVE-2026-34181,     CVE-2026-34183, CVE-2026-42764, CVE-2026-42766, CVE-2026-42767, CVE-2026-42768,     CVE-2026-42769, CVE-2026-42770, CVE-2026-45445, CVE-2026-45446, CVE-2026-45447,     CVE-2026-34182.
    Resolves: RHEL-179267     Resolves: RHEL-179281     Resolves: RHEL-179537     Resolves: RHEL-179542     Resolves: RHEL-179545     Resolves: RHEL-179550     Resolves: RHEL-179553     Resolves: RHEL-179626     Resolves: RHEL-179658     Resolves: RHEL-179675     Resolves: RHEL-179682     Resolves: RHEL-179685     Resolves: RHEL-179689     Resolves: RHEL-179693     Resolves: RHEL-179697

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1339:14 advisory.

    * openssl: OpenSSL: Heap buffer overflow due to signed integer overflow in Unicode output sizing     (CVE-2026-7383)
      * openssl: OpenSSL: Denial of Service due to heap out-of-bounds read in CMS password-based decryption     (CVE-2026-9076)
      * openssl: OpenSSL: Heap buffer over-read in ASN.1 decoding can lead to denial of service or information     disclosure. (CVE-2026-34180)
      * openssl: PKCS#12 Files with PBMAC1 Are Accepted with Short HMAC Keys (CVE-2026-34181)
      * openssl: CMS AuthEnvelopedData Processing May Accept Forged Messages (CVE-2026-34182)
      * openssl: Unbounded Memory Growth in the QUIC PATH_CHALLENGE Handler (CVE-2026-34183)
      * openssl: NULL pointer dereference in QUIC server initial packet handling (CVE-2026-42764)
      * openssl: Possible NULL Dereference in Password-Based CMS Decryption (CVE-2026-42766)
      * openssl: NULL Pointer Dereference in CRMF EncryptedValue Decryption (CVE-2026-42767)
      * openssl: Multi-RecipientInfo Bleichenbacher Oracle in CMS_decrypt() and PKCS7_decrypt()     (CVE-2026-42768)
      * openssl: Trust-Anchor Substitution via cert/issuer Typo in CMP rootCaKeyUpdate (CVE-2026-42769)
      * openssl: FFC-DH Peer Validation Uses Attacker-Supplied q (CVE-2026-42770)
      * openssl: AES-OCB IV Ignored on EVP_Cipher() Path (CVE-2026-45445)
      * openssl: Incorrect Tag Processing for Empty Messages in AES-GCM-SIV and AES-SIV modes (CVE-2026-45446)
      * openssl: Heap Use-After-Free in OpenSSL PKCS7_verify() (CVE-2026-45447)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the openssl package has been released.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:25239 advisory.

    OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS)     protocols, as well as a full-strength general-purpose cryptography library.

    Security Fix(es):

    * openssl: OpenSSL: Heap buffer overflow due to signed integer overflow in Unicode output sizing     (CVE-2026-7383)

    * openssl: OpenSSL: Denial of Service due to heap out-of-bounds read in CMS password-based decryption     (CVE-2026-9076)

    * openssl: OpenSSL: Heap buffer over-read in ASN.1 decoding can lead to denial of service or information     disclosure. (CVE-2026-34180)

    * openssl: PKCS#12 Files with PBMAC1 Are Accepted with Short HMAC Keys (CVE-2026-34181)

    * openssl: CMS AuthEnvelopedData Processing May Accept Forged Messages (CVE-2026-34182)

    * openssl: Unbounded Memory Growth in the QUIC PATH_CHALLENGE Handler (CVE-2026-34183)

    * openssl: NULL pointer dereference in QUIC server initial packet handling (CVE-2026-42764)

    * openssl: Possible NULL Dereference in Password-Based CMS Decryption (CVE-2026-42766)

    * openssl: NULL Pointer Dereference in CRMF EncryptedValue Decryption (CVE-2026-42767)

    * openssl: Multi-RecipientInfo Bleichenbacher Oracle in CMS_decrypt() and PKCS7_decrypt() (CVE-2026-42768)

    * openssl: Trust-Anchor Substitution via cert/issuer Typo in CMP rootCaKeyUpdate (CVE-2026-42769)

    * openssl: FFC-DH Peer Validation Uses Attacker-Supplied q (CVE-2026-42770)

    * openssl: AES-OCB IV Ignored on EVP_Cipher() Path (CVE-2026-45445)

    * openssl: Incorrect Tag Processing for Empty Messages in AES-GCM-SIV and AES-SIV modes (CVE-2026-45446)

    * openssl: Heap Use-After-Free in OpenSSL PKCS7_verify() (CVE-2026-45447)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
330462	Oracle Linux 10 : openssl (ELSA-2026-25237)	Nessus	Oracle Linux Local Security Checks	2026/7/28	2026/7/28	critical
329278	MiracleLinux 9 : openssl-3.5.5-4.el9_8.ML.1 (AXSA:2026-1339:14)	Nessus	Miracle Linux Local Security Checks	2026/7/24	2026/7/24	critical
332414	Photon OS 5.0: Openssl PHSA-2026-5.0-92-0874	Nessus	PhotonOS Local Security Checks	2026/8/5	2026/8/8	high
320634	RHEL 9 : openssl (RHSA-2026:25239)	Nessus	Red Hat Local Security Checks	2026/6/11	2026/6/12	critical

检测

插件搜索

critical

critical

high

critical