Detections
Analytics

Echo: openssl: security update to 3.5.7-1~deb13u3openssl-3.0.9: security update to 3.0.9+e1openssl-3.1.0: security update to 3.1.0+e1openssl-3.5.0: security update to 3.5.0+e1

low Tenable Self-Hosted Container Security Plugin ID 458279

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Issue summary: The generic elliptic-curve scalar multiplication used for ECDSA and SM2 signature
 operations with curves that do not have a dedicated implementation leaks information about the secret
 nonce through timing. Impact summary: An attacker able to measure signing times may learn information
 about the per-signature secret nonce, which over many signatures can, via a lattice / Hidden Number
 Problem attack, lead to recovery of the private key. CWE: CWE-208: Observable Timing Discrepancy
 Description: The generic elliptic-curve scalar multiplication used for curves that do not have a dedicated
 constant-time implementation pads the secret scalar with non-constant-time BIGNUM operations, so the time
 taken depends on the value of the secret scalar derived from the ECDSA and SM2 nonce. The leak is very
 small; observing it requires a large number of measurements. The effect is largest for curves whose group
 order lies on a machine-word boundary, such as brainpoolP384r1. Applications using ECDSA signing over the
 Brainpool and other generic prime curves, and SM2 signing on platforms that use the generic
 implementation, are vulnerable to this issue. The NIST curves P-256, P-384 and P-521 use dedicated
 constant-time implementations and are not affected. FIPS Impact: no The FIPS modules are not affected: the
 approved NIST curves used in the FIPS provider have dedicated constant-time implementations and do not use
 the affected code path. (CVE-2026-54872)

Solution

Update the openssl-3.0.9 library and its related packages to version 3.0.9+e1 or later.

See Also

https://advisory.echohq.com/cve/CVE-2026-54872

Plugin Details

Severity: Low

ID: 458279

Version: Revision 1.2

Type: Local

Published: 10/2/2026

Updated: 11/5/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 1.2

Percentile: 0.01

CVSS v2

Risk Factor: Low

Base Score: 2.6

Temporal Score: 1.9

Vector: CVSS2#AV:N/AC:H/Au:N/C:P/I:N/A:N

CVSS Score Source: CVE-2026-54872

CVSS v3

Risk Factor: Low

Base Score: 3.7

Temporal Score: 3.2

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 9/30/2026

Vulnerability Publication Date: 9/29/2026

Reference Information

CVE: CVE-2026-54872

IAVA: 2026-A-1072