Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

{
  "id": "a0fa2a3ea1997c798b6375d9eec62a26968e3d041dd5e038cc5eed04e7054638",
  "url": "https://osv.dev/vulnerability/RHSA-2026%3A74166",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update",
    "summary": "Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update",
    "evidence": "osv:RHSA-2026:74166",
    "products": [
      {
        "name": {
          "value": "openssl3",
          "evidence": "/affected/0/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "0:3.5.9-0.1.hum1",
            "evidence": "/affected/0/ranges"
          }
        ],
        "affected_versions": []
      },
      {
        "name": {
          "value": "openssl3-devel",
          "evidence": "/affected/1/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "0:3.5.9-0.1.hum1",
            "evidence": "/affected/1/ranges"
          }
        ],
        "affected_versions": []
      },
      {
        "name": {
          "value": "openssl3-devel-engine",
          "evidence": "/affected/2/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "0:3.5.9-0.1.hum1",
            "evidence": "/affected/2/ranges"
          }
        ],
        "affected_versions": []
      },
      {
        "name": {
          "value": "openssl3-libs",
          "evidence": "/affected/3/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "0:3.5.9-0.1.hum1",
            "evidence": "/affected/3/ranges"
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "high",
    "structured": {
      "id": "RHSA-2026:74166",
      "aliases": [
        "RHSA-2026:74166"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "0:3.5.9-0.1.hum1"
                }
              ]
            }
          ],
          "package": {
            "name": "openssl3",
            "purl": "pkg:rpm/redhat/openssl3",
            "ecosystem": "Red Hat:hummingbird:1"
          },
          "database_specific": {
            "source": "https://security.access.redhat.com/data/osv/RHSA-2026:74166.json"
          }
        },
        {
          "ranges": [
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "0:3.5.9-0.1.hum1"
                }
              ]
            }
          ],
          "package": {
            "name": "openssl3-devel",
            "purl": "pkg:rpm/redhat/openssl3-devel",
            "ecosystem": "Red Hat:hummingbird:1"
          },
          "database_specific": {
            "source": "https://security.access.redhat.com/data/osv/RHSA-2026:74166.json"
          }
        },
        {
          "ranges": [
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "0:3.5.9-0.1.hum1"
                }
              ]
            }
          ],
          "package": {
            "name": "openssl3-devel-engine",
            "purl": "pkg:rpm/redhat/openssl3-devel-engine",
            "ecosystem": "Red Hat:hummingbird:1"
          },
          "database_specific": {
            "source": "https://security.access.redhat.com/data/osv/RHSA-2026:74166.json"
          }
        },
        {
          "ranges": [
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "0:3.5.9-0.1.hum1"
                }
              ]
            }
          ],
          "package": {
            "name": "openssl3-libs",
            "purl": "pkg:rpm/redhat/openssl3-libs",
            "ecosystem": "Red Hat:hummingbird:1"
          },
          "database_specific": {
            "source": "https://security.access.redhat.com/data/osv/RHSA-2026:74166.json"
          }
        }
      ],
      "modified": "2026-10-20T10:15:28Z",
      "provider": "osv",
      "upstream": [
        "CVE-2026-35189",
        "CVE-2026-35191",
        "CVE-2026-42772",
        "CVE-2026-54872",
        "CVE-2026-54873",
        "CVE-2026-54875",
        "CVE-2026-72897",
        "CVE-2026-75804",
        "CVE-2026-75805",
        "CVE-2026-75806",
        "CVE-2026-77696",
        "CVE-2026-84782",
        "CVE-2026-84784"
      ],
      "references": [
        "https://access.redhat.com/errata/RHSA-2026:74166",
        "https://images.redhat.com/",
        "https://access.redhat.com/security/cve/CVE-2026-75806",
        "https://access.redhat.com/security/updates/classification/",
        "https://access.redhat.com/security/cve/CVE-2026-54875",
        "https://access.redhat.com/security/cve/CVE-2026-42772",
        "https://access.redhat.com/security/cve/CVE-2026-35189",
        "https://access.redhat.com/security/cve/CVE-2026-35191",
        "https://access.redhat.com/security/cve/CVE-2026-77696",
        "https://access.redhat.com/security/cve/CVE-2026-84784",
        "https://access.redhat.com/security/cve/CVE-2026-75804",
        "https://access.redhat.com/security/cve/CVE-2026-54873",
        "https://access.redhat.com/security/cve/CVE-2026-54872",
        "https://access.redhat.com/security/cve/CVE-2026-75805",
        "https://access.redhat.com/security/cve/CVE-2026-72897",
        "https://access.redhat.com/security/cve/CVE-2026-84782",
        "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_74166.json",
        "https://bugzilla.redhat.com/show_bug.cgi?id=2543242",
        "https://www.cve.org/CVERecord?id=CVE-2026-35189",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-35189",
        "https://github.com/openssl/openssl/commit/2b93c73b2c70ddc4c61c5e4bfaaa6bd71379eb84",
        "https://github.com/openssl/openssl/commit/3842516cc15e8b2cf55747011045e77547e71d89",
        "https://github.com/openssl/openssl/commit/8e0efc7549b7ff8246d40e585e3fd604f728473f",
        "https://github.com/openssl/openssl/commit/c72ae182cac17a82e4246c6ecd4e9c4ec3586ec9",
        "https://openssl-library.org/news/secadv/20260929.txt",
        "https://bugzilla.redhat.com/show_bug.cgi?id=2543257",
        "https://www.cve.org/CVERecord?id=CVE-2026-35191",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-35191",
        "https://github.com/openssl/openssl/commit/0fe4442d4f8ea3af8a174046dae176e0d4717239",
        "https://github.com/openssl/openssl/commit/2de4c35fb13fc58f43fd8dc1d261700472ce72e5",
        "https://github.com/openssl/openssl/commit/e44292e58b090014232ef75bd400393851b24d1a",
        "https://bugzilla.redhat.com/show_bug.cgi?id=2543249",
        "https://www.cve.org/CVERecord?id=CVE-2026-42772",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-42772",
        "https://github.com/openssl/openssl/commit/32d0ed8afe1b8c3e7ece725b44663da3d7087a09",
        "https://github.com/openssl/openssl/commit/ca8402e273af4de5b3f04fa61a0f0c02ce3ae20e",
        "https://github.com/openssl/openssl/commit/eb2becc0a4baea7f3050a247834d0e5c2ebe1773",
        "https://github.com/openssl/openssl/commit/f42ae513bbda513b3c121d54834040ee4a0eae1a",
        "https://bugzilla.redhat.com/show_bug.cgi?id=2543250",
        "https://www.cve.org/CVERecord?id=CVE-2026-54872",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-54872",
        "https://github.com/openssl/openssl/commit/1a5bee8dc57430a2be69cd1ffe7fec6a62f4f179",
        "https://github.com/openssl/openssl/commit/3f7e1363dccec6f7732bb9e9fa471bb6e4aa68cb",
        "https://github.com/openssl/openssl/commit/7d83bc7764999dfd91b83b4f0815b45390422afd",
        "https://github.com/openssl/openssl/commit/8166827a78aad164a07aa86dea2b425403ced471",
        "https://bugzilla.redhat.com/show_bug.cgi?id=2543244",
        "https://www.cve.org/CVERecord?id=CVE-2026-54873",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-54873",
        "https://github.com/openssl/openssl/commit/1f643b8bc735487b500a1f68a7fb3a22d5e38e23",
        "https://github.com/openssl/openssl/commit/279e7ee1392af98785746788168749491c74bd53",
        "https://github.com/openssl/openssl/commit/3ea6213e050e938ecbbf8c4eff32bec2736780eb",
        "https://github.com/openssl/openssl/commit/7127fb10888b49711c63128a09e524c0d2d5d0b2",
        "https://bugzilla.redhat.com/show_bug.cgi?id=2543256",
        "https://www.cve.org/CVERecord?id=CVE-2026-54875",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-54875",
        "https://github.com/openssl/openssl/commit/3f01bbc28f7e08211fcdc797fd43816504f94257",
        "https://github.com/openssl/openssl/commit/469f3e42629f4a0b5631796e20c66c92c138a3e8",
        "https://github.com/openssl/openssl/commit/9794ed473764839275cb701b4850f3c24d929c28",
        "https://github.com/openssl/openssl/commit/dddad955d5ff3e9507619cf4e0f13e9988e2197c",
        "https://bugzilla.redhat.com/show_bug.cgi?id=2543259",
        "https://www.cve.org/CVERecord?id=CVE-2026-72897",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-72897",
        "https://github.com/openssl/openssl/commit/00646e5085a0d12d29e0d2f9b9bc5f7111a50922",
        "https://github.com/openssl/openssl/commit/4135f553c9d3ba4a09fe752f5d30af2a6a092b2e",
        "https://github.com/openssl/openssl/commit/9c54d209486f6b1ad79fe2179c40f13200fa4f61",
        "https://github.com/openssl/openssl/commit/e87ed26b298a74d8ba61a53e9c7bcd1acac6b814",
        "https://bugzilla.redhat.com/show_bug.cgi?id=2543254",
        "https://www.cve.org/CVERecord?id=CVE-2026-75804",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-75804",
        "https://github.com/openssl/openssl/commit/2e8f54666b3fb7b05ff5f58aa6cac9285163654e",
        "https://github.com/openssl/openssl/commit/4533ee8a5686c953ed3b644738ac4bdf20806538",
        "https://github.com/openssl/openssl/commit/64d3102fb5b54311e92517f26ba00169d719e74a",
        "https://github.com/openssl/openssl/commit/f9eaecf5bdd6692da052bc65b0332af2a938ac03",
        "https://bugzilla.redhat.com/show_bug.cgi?id=2543247",
        "https://www.cve.org/CVERecord?id=CVE-2026-75805",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-75805",
        "https://github.com/openssl/openssl/commit/7588db7fef14209c3caa3a101d11a02006b19166",
        "https://github.com/openssl/openssl/commit/7ca0ccb5172a577e9b87267d77bfe21e5481a5e7",
        "https://github.com/openssl/openssl/commit/9eb2a8a9b86136cdb39d6d7d50644dd66941cdc3",
        "https://github.com/openssl/openssl/commit/abf02872a4b71767ecc72293424420f5b009190f",
        "https://bugzilla.redhat.com/show_bug.cgi?id=2543260",
        "https://www.cve.org/CVERecord?id=CVE-2026-75806",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-75806",
        "https://github.com/openssl/openssl/commit/04728a289a823e68137f88da016cb9ede307217d",
        "https://github.com/openssl/openssl/commit/050b275cd671a6eed1d6457642d41a5a77aab972",
        "https://github.com/openssl/openssl/commit/3a4589d015a9049d47b66f186cf50a8711343a1d",
        "https://github.com/openssl/openssl/commit/5af82fefbaf2b5fec2fc0e1d87f112844902f01d",
        "https://bugzilla.redhat.com/show_bug.cgi?id=2543258",
        "https://www.cve.org/CVERecord?id=CVE-2026-77696",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-77696",
        "https://github.com/openssl/openssl/commit/1c4aed808a7aea32d2d013049c2e0d9fef164fc9",
        "https://github.com/openssl/openssl/commit/20b20628d39b2dcc4677194bd68c7c060fa598cb",
        "https://github.com/openssl/openssl/commit/419f5cb519721dceed393dbc524d79e487c72e64",
        "https://github.com/openssl/openssl/commit/6b90445a56b99a328ac1feba058abf976504f440",
        "https://bugzilla.redhat.com/show_bug.cgi?id=2537080",
        "https://www.cve.org/CVERecord?id=CVE-2026-84782",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-84782",
        "https://openssl-library.org/news/vulnerabilities/#CVE-2026-84782",
        "https://bugzilla.redhat.com/show_bug.cgi?id=2543261",
        "https://www.cve.org/CVERecord?id=CVE-2026-84784",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-84784",
        "https://github.com/openssl/openssl/commit/4685c914b0d410b1034f40b547c95bc95e7a380a",
        "https://github.com/openssl/openssl/commit/9a30fe0fba195c14e5b87bf93c0d0fdb70373806",
        "https://github.com/openssl/openssl/commit/dba3c48d653c64fcbc9070a17a0ee2b3e2f3af1f",
        "https://github.com/openssl/openssl/commit/e9e5155833fa968bee50024bf9ca3a185ab599fe"
      ]
    },
    "related_cves": [
      {
        "value": "CVE-2026-35189",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-35191",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-42772",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-54872",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-54873",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-54875",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-72897",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-75804",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-75805",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-75806",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-77696",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-84782",
        "evidence": "/upstream"
      },
      {
        "value": "CVE-2026-84784",
        "evidence": "/upstream"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 378879,
  "published_at": "2026-10-02T10:25:47+00:00"
}