Detections
Analytics

Echo: openssl: security update to 3.5.5-1~deb13u2

high Tenable Self-Hosted Container Security Plugin ID 464229

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Issue summary: When a delta CRL that contains a Delta CRL Indicator extension is processed a NULL pointer
 dereference might happen if the required CRL Number extension is missing. Impact summary: A NULL pointer
 dereference can trigger a crash which leads to a Denial of Service for an application. When CRL processing
 and delta CRL processing is enabled during X.509 certificate verification, the delta CRL processing does
 not check whether the CRL Number extension is NULL before dereferencing it. When a malformed delta CRL
 file is being processed, this parameter can be NULL, causing a NULL pointer dereference. Exploiting this
 issue requires the X509_V_FLAG_USE_DELTAS flag to be enabled in the verification context, the certificate
 being verified to contain a freshestCRL extension or the base CRL to have the EXFLAG_FRESHEST flag set,
 and an attacker to provide a malformed CRL to an application that processes it. The vulnerability is
 limited to Denial of Service and cannot be escalated to achieve code execution or memory disclosure. For
 that reason the issue was assessed as Low severity according to our Security Policy. The FIPS modules in
 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL
 FIPS module boundary. (CVE-2026-28388)

Solution

Update the openssl library and its related packages to version 3.5.5-1~deb13u2 or later.

See Also

https://advisory.echohq.com/cve/CVE-2026-28388

Plugin Details

Severity: High

ID: 464229

Version: Revision 1.1

Type: Local

Published: 10/2/2026

Updated: 10/2/2026

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.68

CVSS v2

Risk Factor: High

Base Score: 7.8

Temporal Score: 5.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C

CVSS Score Source: CVE-2026-28388

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 4/8/2026

Vulnerability Publication Date: 4/9/2024

Reference Information

CVE: CVE-2026-28388

IAVA: 2026-A-0308-S