Detections
Analytics

Echo: openssl: security update to 3.5.7-1~deb13u3openssl-3.0.9: security update to 3.0.9+e1openssl-3.1.0: security update to 3.1.0+e1openssl-3.5.0: security update to 3.5.0+e1

low Tenable Self-Hosted Container Security Plugin ID 455376

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Issue summary: SM2 signature generation uses non-constant-time arithmetic on secret values, forming a
 timing side-channel. Impact summary: An attacker able to measure SM2 signing times may learn information
 about the per-signature secret nonce, which over many signatures can, via a lattice / Hidden Number
 Problem attack, lead to recovery of the private key. CWE: CWE-208: Observable Timing Discrepancy
 Description: SM2 signature generation computes the signature value using variable-time BIGNUM operations
 on the secret nonce and the private key, so the time taken to produce an SM2 signature depends on these
 secret values, forming a timing side-channel. Applications performing SM2 signature generation are
 affected on all platforms. FIPS Impact: no SM2 is not a FIPS algorithm. (CVE-2026-77696)

Solution

Update the openssl-3.0.9 library and its related packages to version 3.0.9+e1 or later.

See Also

https://advisory.echohq.com/cve/CVE-2026-77696

Plugin Details

Severity: Low

ID: 455376

Version: Revision 1.3

Type: Local

Published: 10/1/2026

Updated: 11/5/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 1.2

Percentile: 0.01

CVSS v2

Risk Factor: Low

Base Score: 2.6

Temporal Score: 1.9

Vector: CVSS2#AV:N/AC:H/Au:N/C:P/I:N/A:N

CVSS Score Source: CVE-2026-77696

CVSS v3

Risk Factor: Low

Base Score: 3.7

Temporal Score: 3.2

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 9/30/2026

Vulnerability Publication Date: 9/29/2026

Reference Information

CVE: CVE-2026-77696

IAVA: 2026-A-1072