Detections
Analytics

Echo: openssl-3.5.0: security update to 3.5.0+e1

medium Tenable Self-Hosted Container Security Plugin ID 478502

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Issue Summary: An error in the callback used to verify the certificate provided in a Root CA key update
 Certificate Management Protocol (CMP) message response rendered the certificate validation ineffectual,
 which could lead to escalation of credentials from the Registration Authority (RA) level to the root
 Certification Authority (root CA) level. Impact Summary: The Registration Autority could replace the root
 CA certificate for the CMP clients with an arbitrary root CA certificate. One of the parts of the
 Certificate Management Protocol (CMP), specified in RFC 9810, is Root Certification Authority (root CA)
 key Rollover, which is sent by the server in a message with type 'id-it-rootCaKeyUpdate'. As part of these
 messages, 'newWithOld' certificate, the new root CA certificate signed with the old root CA key, is
 provided, and verifying its signature is crucial for transferring the trust from the old CA key to the new
 one. The 'id-it-rootCaKeyUpdate' messages are expected to be processed with
 OSSL_CMP_get1_rootCaKeyUpdate(), that is expected to verify the 'newWithOld' certificate. A typo in the
 certificate chain building code led to adding an incorrect certificate ('newWithOld' instead of 'oldRoot')
 to the certificate chain, rendering the certificate verification process ineffectual (only the issuer name
 and the algorithm OIDs were verified by other parts of the verification code). An attacker who already has
 credentials that satisfy the CMP message protection checks can generate a new key pair and use a crafted
 self-signed certificate in its 'id-it-rootCaKeyUpdate' CMP messages which affected CMP clients would
 accept as a new trust anchor. Significant preconditions for the attack (having valid RA-level credentials)
 are the reason the issue was assigned Low severity. The FIPS modules are not affected by this issue, as
 the affected code is outside the OpenSSL FIPS module boundary. (CVE-2026-42769)

Solution

Update the openssl-3.5.0 library and its related packages to version 3.5.0+e1 or later.

See Also

https://advisory.echohq.com/cve/CVE-2026-42769

Plugin Details

Severity: Medium

ID: 478502

Version: Revision 1.1

Type: Local

Published: 11/5/2026

Updated: 11/5/2026

Risk Information

VPR

Risk Factor: Medium

Score: 5

Percentile: 93.19

CVSS v2

Risk Factor: Medium

Base Score: 6.2

Temporal Score: 4.6

Vector: CVSS2#AV:N/AC:H/Au:M/C:C/I:C/A:N

CVSS Score Source: CVE-2026-42769

CVSS v3

Risk Factor: Medium

Base Score: 5.3

Temporal Score: 4.6

Vector: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 11/5/2026

Vulnerability Publication Date: 6/9/2026

Reference Information

CVE: CVE-2026-42769