{"id":"CLSA-2026-1779094874","summary":"Fix CVE(s): CVE-2026-28388, CVE-2026-28389","details":"   * SECURITY UPDATE: NULL pointer dereference in check_delta_base() when a\n     delta CRL is processed without the required CRL Number extension and\n     X509_V_FLAG_USE_DELTAS is enabled, leading to a denial of service.\n     - debian/patches/CVE-2026-28388.patch: add NULL check for\n       delta-\u003ecrl_number before ASN1_INTEGER_cmp() in check_delta_base()\n     - CVE-2026-28388\n   * SECURITY UPDATE: NULL pointer dereference in dh_cms_set_shared_info()\n     and ecdh_cms_set_shared_info() when a CMS EnvelopedData message uses\n     KeyAgreeRecipientInfo with a KeyEncryptionAlgorithmIdentifier whose\n     optional parameter field is omitted, leading to a denial of service.\n     - debian/patches/CVE-2026-28389.patch: check alg-\u003eparameter for NULL\n       before accessing its type field in dh_cms_set_shared_info() and\n       ecdh_cms_set_shared_info()\n     - CVE-2026-28389","modified":"2026-06-04T09:46:54.126511575Z","published":"2026-05-18T09:01:19Z","upstream":["CVE-2026-28388","CVE-2026-28389"],"references":[{"type":"ADVISORY","url":"https://errata.tuxcare.com/els_os/ubuntu16.04els/CLSA-2026-1779094874.html"}],"affected":[{"package":{"name":"libssl-dev","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/libssl-dev?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2g-1ubuntu4.21+tuxcare.els15"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1779094874.json"}},{"package":{"name":"libssl-doc","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/libssl-doc?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2g-1ubuntu4.21+tuxcare.els15"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1779094874.json"}},{"package":{"name":"libssl1.0.0","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/libssl1.0.0?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2g-1ubuntu4.21+tuxcare.els15"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1779094874.json"}},{"package":{"name":"openssl","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/openssl?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2g-1ubuntu4.21+tuxcare.els15"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1779094874.json"}}],"schema_version":"1.7.5"}