Detections
Analytics

Echo: openssl-3.5.0: security update to 3.5.0+e1

high Tenable Self-Hosted Container Security Plugin ID 478544

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Issue summary: In a server or client configuration with RFC7250 Raw Public Keys (RPKs) enabled, and only
 the private key (with no associated certificate) configured locally, a NULL pointer dereference may occur
 when the remote peer solicits raw public keys and also sends the typically omitted
 "signature_algorithms_cert" TLS extension. Impact summary: The impact is limited to a possible Denial of
 Service as a result of an application abort, no data disclosure or remote command execution are possible.
 CWE: CWE-476: NULL Pointer Dereference Description: While a passing comment in sample code in the
 documentation suggests that key-only RPK configurations are supported, the best-practice RPK configuration
 is to always configure a corresponding certificate (possibly self-signed or signed by any convenient CA).
 When the private key is configured along with a matching certificate, the "signature_algorithms_cert"
 extension is handled reliably even without the fix, and peer clients or servers that don't support raw
 public keys may be able to complete a TLS connection by pinning or verifying the corresponding certificate
 or its public key. Deployments that prefer to configure just a private key with no certificate need to
 upgrade to an updated release as noted below. FIPS impact: no No FIPS modules are affected by this issue,
 as the SSL protocol implementation is outside the OpenSSL FIPS module boundary. (CVE-2026-14457)

Solution

Update the openssl-3.5.0 library and its related packages to version 3.5.0+e1 or later.

See Also

https://advisory.echohq.com/cve/CVE-2026-14457

Plugin Details

Severity: High

ID: 478544

Version: Revision 1.1

Type: Local

Published: 11/5/2026

Updated: 11/5/2026

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.72

CVSS v2

Risk Factor: High

Base Score: 7.8

Temporal Score: 5.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C

CVSS Score Source: CVE-2026-14457

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 11/5/2026

Vulnerability Publication Date: 8/5/2026

Reference Information

CVE: CVE-2026-14457