Detections
Analytics

Echo: openssl-3.5.0: security update to 3.5.0+e1

high Tenable Self-Hosted Container Security Plugin ID 478489

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Issue Summary: The PKCS#12 file processing fails to perform sufficient input validation for files that use
 Password-Based Message Authentication Code 1 (PBMAC1) integrity mechanism allowing a certificate and
 private key forgery. Impact Summary: An attacker impersonating a user can cause a service reading PKCS#12
 files to accept forged certificates and private keys with a 1 in 256 probability. If a service accepting
 PKCS#12 files is using passwords for authenticating the received files, the attacker can create
 unencrypted PKCS#12 files that use PBMAC1 authentication that specifies an HMAC key of only one byte,
 allowing them to craft a file that will be accepted with a 1 in 256 probability. That would then cause the
 service to accept a certificate and private key controlled by the attacker. The FIPS modules are not
 affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary. (CVE-2026-34181)

Solution

Update the openssl-3.5.0 library and its related packages to version 3.5.0+e1 or later.

See Also

https://advisory.echohq.com/cve/CVE-2026-34181

Plugin Details

Severity: High

ID: 478489

Version: Revision 1.1

Type: Local

Published: 11/5/2026

Updated: 11/5/2026

Risk Information

VPR

Risk Factor: Medium

Score: 4.3

Percentile: 53.64

CVSS v2

Risk Factor: High

Base Score: 7.1

Temporal Score: 5.3

Vector: CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:N

CVSS Score Source: CVE-2026-34181

CVSS v3

Risk Factor: High

Base Score: 7.4

Temporal Score: 6.4

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 11/5/2026

Vulnerability Publication Date: 6/9/2026

Reference Information

CVE: CVE-2026-34181