Detections
Analytics

Echo: openssl: security update to 3.5.7-1~deb13u3

medium Tenable Cloud Security Plugin ID 462220

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Issue summary: A certificate with many nameRelativeToCRLIssuer CRL distribution points causes
 disproportionate heap growth when OpenSSL caches X.509 extensions. Impact summary: Receiving a crafted
 certificate from a malicious peer can lead to significant memory pressure and possible Denial of Service
 in clients or in servers that solicit client certificates. CWE: CWE-770: Allocation of Resources Without
 Limits or Throttling Description: A certificate or a set of certificates that fits under the limit for
 size of certificates accepted from the peer (~100 KiB) can result in allocation of several hundred MiB of
 resident memory on the receiving side during a normal TLS handshake. This may be enough to crash the
 client or server, if multiple concurrent connections lead to similarly large memory allocations. The fix
 postpones processing of the CRL distribution points extensions in certificates to the time when the
 processed value is required for CRL processing. This avoids keeping large memory allocations for a long
 time when such certificates are received. FIPS impact: no The affected code is outside the FIPS module
 boundary. (CVE-2026-35189)

Solution

Update the openssl library and its related packages to version 3.5.7-1~deb13u3 or later.

See Also

https://advisory.echohq.com/cve/CVE-2026-35189

Plugin Details

Severity: Medium

ID: 462220

Version: Revision 1.1

Type: Local

Published: 10/2/2026

Updated: 10/2/2026

Risk Information

VPR

Risk Factor: Low

Score: 1.2

Percentile: 0.01

CVSS v2

Risk Factor: Medium

Base Score: 5

Temporal Score: 3.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P

CVSS Score Source: CVE-2026-35189

CVSS v3

Risk Factor: Medium

Base Score: 5.3

Temporal Score: 4.6

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 9/30/2026

Vulnerability Publication Date: 9/29/2026

Reference Information

CVE: CVE-2026-35189

IAVA: 2026-A-1072