Critical Security Update for mingw-openssl: SSL_select_next_proto Buffer Overread Vulnerability
Summary
ALSA-2026:60329: Low: mingw-openssl security update. Affects mingw32-openssl versions < 1.0.2k-4.el8_10. Fixed in 1.0.2k-4.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The mingw-openssl package provides essential libraries and development tools for secure communications on Windows platforms using the MinGW environment. It includes a variety of cryptographic algorithms and protocols that are crucial for establishing secure connections. However, this package is susceptible to a specific vulnerability that can lead to security breaches if not addressed promptly.
Vulnerability Detail
The vulnerability identified as CVE-2024-5535 involves a buffer overread in the SSL_select_next_proto function of OpenSSL. This flaw can potentially allow an attacker to read beyond the intended memory boundaries, leading to the exposure of sensitive information. The origin of this vulnerability lies in improper handling of protocol negotiation, which can be exploited in certain scenarios, particularly in environments where secure communications are critical.
How To Fix
Minimum fixed version
1.0.2k-4.el8_10
This is the first release that contains the fix.
sudo dnf update mingw32-opensslTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you may consider disabling the use of the affected SSL protocol in your application until the update can be applied. However, this is not a long-term solution and should be addressed as soon as possible.
Conclusion
The mingw-openssl package is critical for secure communications on Windows platforms, but it is currently affected by a buffer overread vulnerability (CVE-2024-5535). It is essential to update to the patched version to mitigate potential security risks. Users are encouraged to monitor their applications for vulnerabilities using tools like Vulert, which can provide real-time alerts without requiring code access.
See every vulnerability recorded for mingw32-openssl →
FAQ
CVE-2024-5535 is a vulnerability in OpenSSL that involves a buffer overread in the SSL_select_next_proto function, which can lead to the exposure of sensitive data.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
If exploited, this vulnerability could allow attackers to read sensitive information from memory, potentially compromising the security of communications.
Yes, a patch is available in the form of an updated version of the mingw-openssl package, specifically version 1.0.2k-4.el8_10.
If immediate updating is not possible, consider disabling the affected SSL protocol as a temporary workaround until you can apply the necessary updates.
