openssl-3 (SUSE:Linux Enterprise Module for Basesystem 15 SP6) — known CVEs & security advisories

Known CVE vulnerabilities and GitHub Security Advisories affecting the SUSE:Linux Enterprise Module for Basesystem 15 SP6 package openssl-3, with affected version ranges, CVSS severity, EPSS exploit prediction, and CISA KEV status.

CVEs (9)

• CVE-2024-5535 — CVSS 9.1 (critical): Issue summary: Calling the OpenSSL API function SSL_select_next_proto with an empty supported client protocols buffer may cause a crash or…
• CVE-2024-41996 — CVSS 7.5 (high): Validating the order of the public keys in the Diffie-Hellman Key Agreement Protocol, when an approved safe prime is used, allows remote…
• CVE-2025-9230 — CVSS 7.5 (high): Issue summary: An application trying to decrypt CMS messages encrypted using password based encryption can trigger an out-of-bounds read…
• CVE-2024-4741 — CVSS 7.5 (high): Issue summary: Calling the OpenSSL API function SSL_free_buffers may cause memory to be accessed that was previously freed in some…
• CVE-2024-6119 — CVSS 7.5 (high): Issue summary: Applications performing certificate name checks (e.g., TLS clients checking server certificates) may attempt to read an…
• CVE-2023-50782 — CVSS 7.5 (high): A flaw was found in the python-cryptography package. This issue may allow a remote attacker to decrypt captured messages in TLS servers…
• CVE-2024-4603 — CVSS 5.3 (medium): Issue summary: Checking excessively long DSA keys or parameters may be very slow. Impact summary: Applications that use the functions…
• CVE-2025-27587 — CVSS 5.3 (medium): OpenSSL 3.0.0 through 3.3.2 on the PowerPC architecture is vulnerable to a Minerva attack, exploitable by measuring the time of signing of…
• CVE-2024-13176 — CVSS 4.1 (medium): Issue summary: A timing side-channel which could potentially allow recovering the private key exists in the ECDSA signature computation…