CVE-2026-28389
Publication date 7 April 2026
Last updated 8 April 2026
Ubuntu priority
Description
Possible NULL dereference when processing CMS KeyAgreeRecipientInfo
Read the notes from the security team
Why is this CVE low priority?
OpenSSL developers have rated this issue as being low severity
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| openssl | 25.10 questing |
Fixed 3.5.3-1ubuntu3.3
|
| 24.04 LTS noble |
Fixed 3.0.13-0ubuntu3.9
|
|
| 22.04 LTS jammy |
Fixed 3.0.2-0ubuntu1.23
|
|
| 20.04 LTS focal |
Vulnerable
|
|
| 18.04 LTS bionic |
Vulnerable
|
|
| 16.04 LTS xenial |
Vulnerable
|
|
| 14.04 LTS trusty |
Not affected
|
|
| openssl-fips | 25.10 questing | Not in release |
| 24.04 LTS noble | Not in release | |
| 22.04 LTS jammy | Not in release | |
| openssl1.0 | 25.10 questing | Not in release |
| 24.04 LTS noble | Not in release | |
| 22.04 LTS jammy | Not in release | |
| 18.04 LTS bionic |
Vulnerable
|
|
| nodejs | 25.10 questing |
Not affected
|
| 24.04 LTS noble |
Not affected
|
|
| 22.04 LTS jammy |
Vulnerable
|
|
| 20.04 LTS focal |
Not affected
|
|
| 18.04 LTS bionic |
Needs evaluation
|
|
| 16.04 LTS xenial |
Needs evaluation
|
|
| 14.04 LTS trusty |
Not affected
|
|
| edk2 | 25.10 questing |
Needs evaluation
|
| 24.04 LTS noble |
Needs evaluation
|
|
| 22.04 LTS jammy |
Needs evaluation
|
|
| 20.04 LTS focal |
Needs evaluation
|
|
| 18.04 LTS bionic |
Needs evaluation
|
|
| 16.04 LTS xenial |
Needs evaluation
|
Notes
mdeslaur
edk2 in jammy embeds OpenSSL 1.1.1j edk2 in noble embeds OpenSSL 3.0.9 edk2 in plucky embeds OpenSSL 3.4.0 edk2 in questing embeds OpenSSL 3.4.0 3.6, 3.5, 3.4, 3.3, 3.0, 1.1.1 and 1.0.2 are vulnerable to this issue.
References
Related Ubuntu Security Notices (USN)
- USN-8155-1
- OpenSSL vulnerabilities
- 8 April 2026