Detections
Analytics

Echo: openssl-3.0.9: security update to 3.0.9+e1openssl-3.1.0: security update to 3.1.0+e1openssl-3.5.0: security update to 3.5.0+e1

medium Tenable Self-Hosted Container Security Plugin ID 478553

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Issue summary: The implementations of AES-SIV (RFC 5297) and AES-GCM-SIV (RFC 8452) mishandle the
 authentication of AAD (Additional Authenticated Data) with an empty ciphertext allowing a forgery of such
 messages. Impact summary: An attacker can forge empty messages with arbitrary AAD to the victim's
 application using these ciphers. AES-SIV (RFC 5297) and AES-GCM-SIV (RFC 8452) are nonce-misuse-resistant
 AEAD modes: they accept a key, nonce, optional AAD (bytes that are authenticated but not encrypted), and
 plaintext, and produces ciphertext plus a 16-byte tag. On decrypt, `EVP_DecryptFinal_ex()` is documented
 to return success only if the tag is verified succesfully. In OpenSSL's provider implementation of these
 ciphers, the expected tag is computed only when decryption function is invoked with non-empty data. If the
 caller supplies AAD and then calls `EVP_DecryptFinal_ex()` without invocation of the ciphertext update,
 which can happen when the received ciphertext length is zero, the tag is never recalculated and still
 holds its all-zeros value. When AES-GCM-SIV is used, an attacker who sends arbitrary AAD, empty
 ciphertext, and all-zeros tag passes authentication under any key they do not know, single-shot. When AES-
 SIV is used, for mounting the attack it's necessary for the application to reuse the decryption context
 without resetting the key. AES-SIV is implemented since OpenSSL 3.0. AES-GCM-SIV is implemented since
 OpenSSL 3.2. No protocols implemented in OpenSSL itself (TLS/CMS/PKCS7/HPKE/QUIC) support either AES-GCM-
 SIV or AES-SIV. To mount an attack, the applications must implement their own protocol and use the EVP
 interface. Also they must skip the ciphertext update when a message with an empty ciphertext arrives. The
 FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this issue, as these algorithms are not
 FIPS approved and the affected code is outside the OpenSSL FIPS module boundary. (CVE-2026-45446)

Solution

Update the openssl-3.0.9 library and its related packages to version 3.0.9+e1 or later.

See Also

https://advisory.echohq.com/cve/CVE-2026-45446

Plugin Details

Severity: Medium

ID: 478553

Version: Revision 1.1

Type: Local

Published: 11/5/2026

Updated: 11/5/2026

Risk Information

VPR

Risk Factor: Low

Score: 2.1

Percentile: 7.76

CVSS v2

Risk Factor: Medium

Base Score: 5

Temporal Score: 3.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:N

CVSS Score Source: CVE-2026-45446

CVSS v3

Risk Factor: Medium

Base Score: 4.8

Temporal Score: 4.2

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 11/5/2026

Vulnerability Publication Date: 6/9/2026

Reference Information

CVE: CVE-2026-45446