==========================================================================
Ubuntu Security Notice USN-8155-1
April 08, 2026

openssl vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 25.10
- Ubuntu 24.04 LTS
- Ubuntu 22.04 LTS

Summary:

Several security issues were fixed in OpenSSL.

Software Description:
- openssl: Secure Socket Layer (SSL) cryptographic library and tools

Details:

Viktor Dukhovni discovered that OpenSSL incorrectly negotiated the expected
preferred key exchange group when used as a TLS 1.3 server. This could
result in a less preferred key exchange being used, contrary to
expectations. This issue only affected Ubuntu 25.10. (CVE-2026-2673)

Igor Morgenstern discovered that OpenSSL incorrectly handled certain memory
operations when used as a DANE client. A remote attacker could use this
issue to cause OpenSSL to crash, resulting in a denial of service, or
possibly execute arbitrary code. (CVE-2026-28387)

Igor Morgenstern discovered that OpenSSL incorrectly handled certain memory
operations when processing a delta CRL. A remote attacker could possibly
use this issue to cause OpenSSL to crash, resulting in a denial of service.
(CVE-2026-28388)

Nathan Sportsman, Daniel Rhea, and Jaeho Nam discovered that OpenSSL
incorrectly handled certain memory operations when processing a crafted CMS
EnvelopedData message with KeyAgreeRecipientInfo. A remote attacker could
possibly use this issue to cause OpenSSL to crash, resulting in a denial
of service. (CVE-2026-28389)

Muhammad Daffa, Joshua Rogers, and Chanho Kim discovered that OpenSSL
incorrectly handled processing of a crafted CMS EnvelopedData message with
KeyTransportRecipientInfo. A remote attacker could possibly use this issue
to cause OpenSSL to crash, resulting in a denial of service.
(CVE-2026-28390)

Quoc Tran discovered that OpenSSL incorrectly handled hexadecimal
conversion on 32-bit platforms. A remote attacker could use this issue to
cause OpenSSL to crash, resulting in a denial of service, or possibly
execute arbitrary code. (CVE-2026-31789)

Simo Sorce discovered that OpenSSL incorrectly handled failures in RSA KEM
RSASVE Encapsulation. A remote attacker could possibly use this issue to
obtain sensitive information. (CVE-2026-31790)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 25.10
  libssl3t64                      3.5.3-1ubuntu3.3
  openssl                         3.5.3-1ubuntu3.3

Ubuntu 24.04 LTS
  libssl3t64                      3.0.13-0ubuntu3.9
  openssl                         3.0.13-0ubuntu3.9

Ubuntu 22.04 LTS
  libssl3                         3.0.2-0ubuntu1.23
  openssl                         3.0.2-0ubuntu1.23

After a standard system update you need to reboot your computer to make
all the necessary changes.

References:
  https://ubuntu.com/security/notices/USN-8155-1
  CVE-2026-2673, CVE-2026-28387, CVE-2026-28388, CVE-2026-28389,
  CVE-2026-28390, CVE-2026-31789, CVE-2026-31790

Package Information:
  https://launchpad.net/ubuntu/+source/openssl/3.5.3-1ubuntu3.3
  https://launchpad.net/ubuntu/+source/openssl/3.0.13-0ubuntu3.9
  https://launchpad.net/ubuntu/+source/openssl/3.0.2-0ubuntu1.23