Alert GCSA-26239 - Aggiornamento di sicurezza per OpenSSL - 29th September 2026

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

******************************************************************

   alert ID: GCSA-26239
       data: 30 settembre 2026
     titolo: Aggiornamento di sicurezza per OpenSSL - 29th September 2026

******************************************************************

:: Descrizione del problema

   Sono state state rilasciate nuove versioni del software OpenSSL
   con le quali vengono risolte 14 vulnerabilita' di sicurezza,
   di cui una (CVE-2026-84782) di livello "alto".

   Maggiori informazioni sono disponibili alla sezione "Riferimenti".


:: Software interessato

   OpenSSL versioni precedenti alla 4.0.3
   OpenSSL versioni precedenti alla 3.6.5
   OpenSSL versioni precedenti alla 3.5.9
   OpenSSL versioni precedenti alla 3.4.8
   OpenSSL versioni precedenti alla 3.0.23
   OpenSSL versioni precedenti alla 1.1.1zj
   OpenSSL versioni precedenti alla 1.0.2zs


:: Impatto

   Denial of Service (DoS)
   Security Restriction Bypass (SFB)


:: Soluzioni

   Aggiornare OpenSSL alla versione piu' recente,
   tramite gli upgrade del proprio sistema operativo,
   o scaricando il software dal seguente link
   https://www.openssl.org/source/
   https://github.com/openssl/openssl/releases

   Le versioni OpenSSL 1.0.2 e 1.1.1 non sono piu' supportate
   e non devono essere utilizzate in produzione.


:: Riferimenti

   OpenSSL Release Announcement and Security Advisory - 29th September 2026
   https://openssl-library.org/news/secadv/20260929.txt
   https://openssl-library.org/news/vulnerabilities/index.html

   SecurityWeek
   https://www.securityweek.com/high-severity-vulnerabilities-patched-in-openssl-wolfssl/

   Debian Security Advisory
   https://lists.debian.org/debian-security-announce/2026/msg00444.html
   https://security-tracker.debian.org/tracker/DSA-6531-1

   Ubuntu Security Notice
   https://ubuntu.com/security/notices/USN-8847-1

   CVE ID
   https://www.cve.org/CVERecord?id=CVE-2026-35189
   https://www.cve.org/CVERecord?id=CVE-2026-35191
   https://www.cve.org/CVERecord?id=CVE-2026-42772
   https://www.cve.org/CVERecord?id=CVE-2026-54872
   https://www.cve.org/CVERecord?id=CVE-2026-54873
   https://www.cve.org/CVERecord?id=CVE-2026-54875
   https://www.cve.org/CVERecord?id=CVE-2026-72897
   https://www.cve.org/CVERecord?id=CVE-2026-75804
   https://www.cve.org/CVERecord?id=CVE-2026-75805
   https://www.cve.org/CVERecord?id=CVE-2026-75806
   https://www.cve.org/CVERecord?id=CVE-2026-77696
   https://www.cve.org/CVERecord?id=CVE-2026-84782
   https://www.cve.org/CVERecord?id=CVE-2026-84783
   https://www.cve.org/CVERecord?id=CVE-2026-84784


GARR CERT Newsletter subscribe/unsubscribe:
http://www.cert.garr.it/alert/ricevi-gli-alert-di-cert

-----BEGIN PGP SIGNATURE-----

iF0EAREIAB0WIQTGpdiR5MqstacBGHbBnEyTZRJgQgUCarzOvgAKCRDBnEyTZRJg
Qt/wAKC+67XbrxVY3fhLs/xlu7LBFZ2VRQCfS40hoJAh0YO2tWw4arWOdQlA3VU=
=s8O8
-----END PGP SIGNATURE-----