QSN-8678-1: OpenSSL vulnerabilities
2026-08-25

Summary:
Several security issues were fixed in OpenSSL.

Details:
It was discovered that OpenSSL incorrectly handled the QUIC server incoming
channel queue. A remote attacker could possibly use this issue to cause
OpenSSL to use excessive resources, leading to a denial of service. This
issue only affected Ubuntu 26.04 LTS. (CVE-2026-14456)

It was discovered that OpenSSL incorrectly handled signature algorithm
selection when using Raw Public Keys. A remote attacker could possibly use
this issue to cause OpenSSL to crash, resulting in a denial of service.
This issue only affected Ubuntu 26.04 LTS. (CVE-2026-14457)

It was discovered that OpenSSL incorrectly handled QUIC INITIAL packet
processing. A remote attacker could possibly use this issue to cause
OpenSSL to crash, resulting in a denial of service. This issue only
affected Ubuntu 26.04 LTS. (CVE-2026-18798)

It was discovered that OpenSSL incorrectly handled buffering of DTLS
records for a future epoch. A remote attacker could possibly use this issue
to cause OpenSSL to use excessive resources, leading to a denial of
service. (CVE-2026-54874)

It was discovered that OpenSSL incorrectly handled CMS key unwrapping. A
remote attacker could possibly use this issue to cause a heap buffer
overflow, leading to a denial of service or arbitrary code execution.
(CVE-2026-63072)

It was discovered that OpenSSL incorrectly validated the sender
distinguished name in CMP response messages. A remote attacker could
possibly use this issue to cause OpenSSL to crash, resulting in a denial of
service. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-63073)

It was discovered that OpenSSL incorrectly limited the growth of an
internal certificate cache used during CMP operations. A remote attacker
could possibly use this issue to cause OpenSSL to use excessive resources,
leading to a denial of service. (CVE-2026-63074)

It was discovered that OpenSSL incorrectly handled QUIC ACK-only packet
retention. A remote attacker could possibly use this issue to cause OpenSSL
to use excessive resources, leading to a denial of service. This issue only
affected Ubuntu 26.04 LTS. (CVE-2026-63075)

It was discovered that OpenSSL incorrectly handled CMP protection algorithm
validation. A remote attacker could possibly use this issue to cause
OpenSSL to crash, resulting in a denial of service. (CVE-2026-63076)

It was discovered that OpenSSL incorrectly verified authentication tags
when using certain AEAD ciphers via the EVP_Cipher() interface. An attacker
could possibly use this issue to perform AEAD forgery attacks.
(CVE-2026-75803)

Affected QuantaStor releases:
  6.9.1.001 jammy: libssl3 3.0.2-0ubuntu1.30 (fixed in 3.0.2-0ubuntu1.29)
  6.9.1.001 jammy: openssl 3.0.2-0ubuntu1.30 (fixed in 3.0.2-0ubuntu1.29)
  6.9.0.464 jammy: libssl3 3.0.2-0ubuntu1.30 (fixed in 3.0.2-0ubuntu1.29)
  6.9.0.464 jammy: openssl 3.0.2-0ubuntu1.30 (fixed in 3.0.2-0ubuntu1.29)
  6.8.6.015 jammy: libssl3 3.0.2-0ubuntu1.29 (fixed in 3.0.2-0ubuntu1.29)
  6.8.6.015 jammy: openssl 3.0.2-0ubuntu1.29 (fixed in 3.0.2-0ubuntu1.29)
  6.8.5.018 jammy: libssl3 3.0.2-0ubuntu1.26 (fixed in 3.0.2-0ubuntu1.29)
  6.8.5.018 jammy: openssl 3.0.2-0ubuntu1.26 (fixed in 3.0.2-0ubuntu1.29)
  6.8.4.038 jammy: libssl3 3.0.2-0ubuntu1.26 (fixed in 3.0.2-0ubuntu1.29)
  6.8.4.038 jammy: openssl 3.0.2-0ubuntu1.26 (fixed in 3.0.2-0ubuntu1.29)
  6.8.3.018 jammy: libssl3 3.0.2-0ubuntu1.26 (fixed in 3.0.2-0ubuntu1.29)
  6.8.3.018 jammy: openssl 3.0.2-0ubuntu1.26 (fixed in 3.0.2-0ubuntu1.29)
  6.8.2.002 jammy: libssl3 3.0.2-0ubuntu1.25 (fixed in 3.0.2-0ubuntu1.29)
  6.8.2.002 jammy: openssl 3.0.2-0ubuntu1.25 (fixed in 3.0.2-0ubuntu1.29)
  6.8.1.007 jammy: libssl3 3.0.2-0ubuntu1.25 (fixed in 3.0.2-0ubuntu1.29)
  6.8.1.007 jammy: openssl 3.0.2-0ubuntu1.25 (fixed in 3.0.2-0ubuntu1.29)
  6.8.0.205 jammy: libssl3 3.0.2-0ubuntu1.25 (fixed in 3.0.2-0ubuntu1.29)
  6.8.0.205 jammy: openssl 3.0.2-0ubuntu1.25 (fixed in 3.0.2-0ubuntu1.29)

CVEs: CVE-2026-63076, CVE-2026-54874, CVE-2026-63075, CVE-2026-14456, CVE-2026-18798, CVE-2026-14457, CVE-2026-75803, CVE-2026-63073, CVE-2026-63074, CVE-2026-63072

References:
  https://ubuntu.com/security/notices/USN-8678-1