Ubuntu alert USN-8847-1 (openssl)

From:
             
 
noreply+usn-bot--- via ubuntu-security-announce <ubuntu-security-announce@lists.ubuntu.com>
To:
             
 
ubuntu-security-announce@lists.ubuntu.com
Subject:
             
 
[USN-8847-1] OpenSSL vulnerabilities
Date:
             
 
Tue, 29 Sep 2026 19:12:55 +0000
Message-ID:
             
 
<E1xBdG3-0003H5-EO@lists.ubuntu.com>
Cc:
             
 
noreply+usn-bot@canonical.com
==========================================================================
Ubuntu Security Notice USN-8847-1
September 29, 2026

openssl vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 26.04 LTS
- Ubuntu 24.04 LTS
- Ubuntu 22.04 LTS

Summary:

Several security issues were fixed in OpenSSL.

Software Description:
- openssl: Secure Socket Layer (SSL) cryptographic library and tools

Details:

It was discovered that OpenSSL incorrectly handled certain certificate
revocation list distribution point names. An attacker could possibly use
this issue to cause OpenSSL to consume excessive memory, resulting in a
denial of service. (CVE-2026-35189)

It was discovered that OpenSSL incorrectly handled QUIC unvalidated
amplification credit accounting. An attacker could possibly use this
issue to cause a denial of service. This issue only affected
Ubuntu 26.04 LTS. (CVE-2026-35191)

It was discovered that OpenSSL incorrectly implemented scalar
multiplication for non-NIST elliptic curves. An attacker could possibly
use this issue to perform a timing side-channel attack and obtain
sensitive information. (CVE-2026-54872)

It was discovered that OpenSSL incorrectly implemented SM2 scalar
multiplication on ARM64 and RISC-V architectures. An attacker could
possibly use this issue to perform a timing side-channel attack and
obtain sensitive information. This issue only affected Ubuntu 26.04 LTS.
(CVE-2026-54875)

It was discovered that OpenSSL incorrectly handled SSL context switching
during a TLS handshake. An attacker could possibly use this issue to
cause an out-of-bounds read, resulting in a denial of service or
obtaining sensitive information. This issue only affected Ubuntu 26.04 LTS.
(CVE-2026-72897)

It was discovered that OpenSSL incorrectly enforced QUIC connection-
level flow control for streams. An attacker could possibly use this
issue to cause OpenSSL to consume excessive memory, resulting in a
denial of service. This issue only affected Ubuntu 26.04 LTS.
(CVE-2026-75804)

It was discovered that OpenSSL incorrectly handled a NULL pointer in
CMP client revocation response processing. An attacker could possibly
use this issue to cause a denial of service. (CVE-2026-75805)

It was discovered that OpenSSL incorrectly handled undersized DTLS 1.2
AEAD records before authentication. An attacker could possibly use this
issue to cause a denial of service. (CVE-2026-75806)

It was discovered that OpenSSL incorrectly implemented SM2 signature
generation. An attacker could possibly use this issue to perform a
timing side-channel attack and obtain sensitive information.
(CVE-2026-77696)

It was discovered that OpenSSL incorrectly handled DTLS retransmission
of handshake messages. An attacker could possibly use this issue to
cause incorrect handshake behavior or a denial of service.
(CVE-2026-84782)

It was discovered that OpenSSL incorrectly handled QUIC
RETIRE_CONNECTION_ID frames. An attacker could possibly use this issue
to cause OpenSSL to consume excessive memory, resulting in a denial of
service. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-84784)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 26.04 LTS
  libssl3t64                      3.5.5-1ubuntu3.6

Ubuntu 24.04 LTS
  libssl3t64                      3.0.13-0ubuntu3.16

Ubuntu 22.04 LTS
  libssl3                         3.0.2-0ubuntu1.30

After a standard system update you need to reboot your computer to make
all the necessary changes.

References:
  https://ubuntu.com/security/notices/USN-8847-1
  CVE-2026-35189, CVE-2026-35191, CVE-2026-54872, CVE-2026-54875,
  CVE-2026-72897, CVE-2026-75804, CVE-2026-75805, CVE-2026-75806,
  CVE-2026-77696, CVE-2026-84782, CVE-2026-84784

Package Information:
  https://launchpad.net/ubuntu/+source/openssl/3.5.5-1ubunt...
  https://launchpad.net/ubuntu/+source/openssl/3.0.13-0ubun...
  https://launchpad.net/ubuntu/+source/openssl/3.0.2-0ubunt...


Attachment: signature.asc (type=application/pgp-signature)
-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEE+8neBLO2Hp/ppPlOcpJm3tlzhgEFAmq8DVEACgkQcpJm3tlz
hgFvpxAAkzvPHQ9LLIZt3zQX2Fe7BXFUPLAJ+sFsytSYpAAxHyz9ZAOYVbEhHLih
hbE4MeoZLx9n+Pel+xKPLU3lLA+uUrY5duoPQuFJNrV+EEFR4DPb9djYp7FLiyd0
IGu4lqJPhr2OimgAIXqbn9zv9MMgdp++B5jBd0pH7yI090e5HoqHRf/N5HSNGz6X
5Lr3LNs7ZKdVDTWW1KIe+x+Hmn3/P8EtuMvyOo3wbUX6IFIA9uIpaioeNHEza3Rh
dRtXhqyPsUhZFIv8nWss9350kTmMz63/c3IlO9Cr2l0h1N4MEY/eP8YkXJiN2Usw
QJjDTfKyK1iNUvF7RIJYiaqd3ADFG9xtKqdz+SdsEqTmJ+xoNSwQkZVpwgN0Smrk
ua8yIdXLfRQz7/5dteYkFz7HX00Uk3/wSrBOM8K71JDVkwL9hCF5GyAUEEE+d/Iv
cm3jhP3XdsdTpKjg1CjKFolQNvZ6Gy9NPP65x2XgnDhaNCtn19l/QSzpGUlfQHQX
KY9CKQmXRMTIK0klp0mrQkcyNbPHrzUkQkzGq3DGcglFCVYmcOQBSF8vwYbHHMr7
VgFkdGUPLqhDQtg/Ip8vVvpJrFQVk7ucPlUZN9FCU10rVo591I9u2nDkkmdpEIki
04PvyiEnju/LhiVqlWTr4a8kiAv1fE6FS7CcB95ua5xPA1VP4Nk=
=lOT4
-----END PGP SIGNATURE-----