OpenSSL 3.5.6 and older Vulnerabilities on Siteminder Access Gateway r12.9
search cancel

OpenSSL 3.5.6 and older Vulnerabilities on Siteminder Access Gateway r12.9

book

Article ID: 447372

calendar_today

Updated On:

Products

SITEMINDER CA Single Sign On Secure Proxy Server (SiteMinder)

Issue/Introduction

Siteminder Access Gateway r12.9 ships with OpenSSL 3.4.0.  There have been a number of Vulnerabilities reported in OpenSSL 3.5.6 and older.  

KB438079 (archived) delivered OpenSSL 3.5.6

This KB delivers OpenSSL 3.5.7 for Siteminder Access Gateway r12.9.

NOTE: Siteminder Access Gateway r12.8.8.1 and older are bundled with OpenSSL 1.0.2.  This KB is not applicable to Access Gateway r12.8.8.1 and older.

Environment

PRODUCT: Symantec Siteminder

COMPONENT: Access Gateway 

VERSION: r12.9 (ONLY)

Cause

The following CVE's have been published for OpenSSL 3.5.6 and older:

CVE-2026-34180 "Heap Buffer Over-read in ASN.1 Content Parsing"

SEVERITY: Low
IMPACTED: OpenSSL 3.5.0 - 3.5.6
Remediated: 3.5.7

----------------------------------

CVE-2026-34181 "PKCS#12 Files with PBMAC1 Are Accepted with Short HMAC Keys"

SEVERITY: Low
IMPACTED: OpenSSL 3.5.0 - 3.5.6
Remediated: 3.5.7

----------------------------------

CVE-2026-34182 "CMS AuthEnvelopedData Processing May Accept Forged Messages"

SEVERITY: Moderate
IMPACTED: OpenSSL 3.5.0 - 3.5.6
Remediated: 3.5.7

----------------------------------

CVE-2026-34183 "Unbounded Memory Growth in the QUIC PATH_CHALLENGE Handler"

SEVERITY: Moderate
IMPACTED: OpenSSL 3.5.0 - 3.5.6
Remediated: 3.5.7

----------------------------------

CVE-2026-42764 "NULL Pointer Dereference in QUIC Server Initial Packet Handling"

SEVERITY: Moderate
IMPACTED: OpenSSL 3.5.0 - 3.5.6
Remediated: 3.5.7

--------------------------------

CVE-2026-42766 "Possible NULL Dereference in Password-Based CMS Decryption"

SEVERITY: Low
IMPACTED: OpenSSL 3.5.0 - 3.5.6
Remediated: 3.5.7

------------------------------

CVE-2026-42767 "NULL Pointer Dereference in CRMF EncryptedValue Decryption"

SEVERITY: Low
IMPACTED: OpenSSL 3.5.0 - 3.5.6
Remediated: 3.5.7

-----------------------------

CVE-2026-42768 "Multi-RecipientInfo Bleichenbacher Oracle in CMS_decrypt() and PKCS7_decrypt()"

SEVERITY: Low
IMPACTED: OpenSSL 3.5.0 - 3.5.6
Remediated: 3.5.7

----------------------------

CVE-2026-42769 "Trust-Anchor Substitution via cert/issuer Typo in CMP rootCaKeyUpdate"

SEVERITY: Low
IMPACTED: OpenSSL 3.5.0 - 3.5.6
Remediated: 3.5.7

---------------------------

CVE-2026-42770 "FFC-DH Peer Validation Uses Attacker-Supplied q"

SEVERITY: Low
IMPACTED: OpenSSL 3.5.0 - 3.5.6
Remediated: 3.5.7

--------------------------

CVE-2026-45445 "AES-OCB IV Ignored on EVP_Cipher() Path"

SEVERITY: Moderate
IMPACTED: OpenSSL 3.5.0 - 3.5.6
Remediated: 3.5.7

--------------------------

CVE-2026-45446 "Incorrect Tag Processing for Empty Messages in AES-GCM-SIV and AES-SIV modes"

SEVERITY: Low
IMPACTED: OpenSSL 3.5.0 - 3.5.6
Remediated: 3.5.7

-------------------------

CVE-2026-45447 "Heap Use-After-Free in the PKCS7_verify() Function"

SEVERITY: Low
IMPACTED: OpenSSL 3.5.0 - 3.5.6
Remediated: 3.5.7

-------------------------

CVE-2026-7383 "Possible Heap Buffer Overflow in ASN.1 Multibyte String Conversion"

SEVERITY: Low
IMPACTED: OpenSSL 3.5.0 - 3.5.6
Remediated: 3.5.7

-------------------------

CVE-2026-9076 "Out-of-Bounds Read in CMS Password-Based Decryption"

SEVERITY: Low
IMPACTED: OpenSSL 3.5.0 - 3.5.6
Remediated: 3.5.7

-------------------------

 

Resolution

Upgrade OpenSSL on Siteminder Access Gateway Server to openSSL 3.5.7 using this KB.

Verifying the OpenSSL version on Siteminder Access Gateway

 

###### UPGRADE INSTRUCTIONS ######

LINUX

NOTE: OpenSSL 3.x for Access Gateway on LINUX applies to Access Gateway 12.9 and higher

1) Copy "openssl_3.5.7_linux_129GA.zip" to the Access Gateway Server

2) Unzip "openssl_3.5.7_linux_129GA.zip"

Unzip openssl_3.5.7_linux_129GA.zip

3) Stop the Access Gateway Server.

4) Navigate to the '<InstallDir>/CA/secure-proxy/' directory.

5) Note the permissions on the contents of the '<InstallDir>/CA/secure-proxy/SSL/bin' directory.

6) Backup either the entire '<InstallDir>/CA/secure-proxy/SSL/bin' directory, or the following files:

<InstallDir>/CA/secure-proxy/SSL/bin/openssl

7) Copy the contents of the '/openssl_3.5.7_linux_129GA/OpenSSL_3.5.7_linux/bin/' folder to the '/<Intall_Dir>/CA/secure-proxy/SSL/bin/ directory.

CONTENTS:

openssl

EXAMPLE: cp -r /openssl_3.5.7_linux_129GA/OpenSSL_3.5.7_linux/bin/* /<InstallDir>/CA/secure-proxy/SSL/bin/

8) Backup either the entire '<InstallDir>/CA/secure-proxy/SSL/lib/' directory, or the following files:

<InstallDir>/CA/secure-proxy/SSL/lib/libcrypto.a
<InstallDir>/CA/secure-proxy/SSL/lib/libcrypto.so
<InstallDir>/CA/secure-proxy/SSL/lib/libcrypto.so.3
<InstallDir>/CA/secure-proxy/SSL/lib/libssl.a
<InstallDir>/CA/secure-proxy/SSL/lib/libssl.so
<InstallDir>/CA/secure-proxy/SSL/lib/libssl.so.3

 

9) Copy the contents of the '/openssl_3.5.7_linux_129GA/OpenSSL_3.5.7_linux/lib' folder to the '/<Intall_Dir>/CA/secure-proxy/SSL/lib/' directory.

CONTENTS:

libcrypto.a
libcrypto.so
libcrypto.so.3
libssl.a
libssl.so
libssl.so.3

EXAMPLE: cp -r /openssl_3.5.7_linux_129GA/OpenSSL_3.5.7_linux/lib/* ./<InstallDir>/CA/secure-proxy/SSL/lib/

10) Re-set the permissions on the copied files.

11) Re-source the environment variables;

. ./ca_sps_env.sh

13) Re-start the Access Gateway.

./proxy-engine/sps-ctl start

 

WINDOWS

NOTE: OpenSSL 3.x for Access Gateway on WINDOWS applies to Access Gateway 12.9 and higher

1) Copy "openssl_3.5.7_win64_129GA.zip" to the Access Gateway Server

2) Unzip "openssl_3.5.7_win64_129GA.zip"

3) Stop the Access Gateway server

4) Browse to the "<Install_Dir>\CA\secure-proxy\SSL\bin\" directory in Access Gateway

Default: <Install_Dir> = C:\Program Files\

5) Back-up either the '<Install_Dir>\CA\secure-proxy\SSL\bin\' directory, or the following files:

<Install_Dir>\CA\secure-proxy\SSL\bin\openssl.exe
<Install_Dir>\CA\secure-proxy\SSL\bin\libcrypto-3-x64.dll
<Install_Dir>\CA\secure-proxy\SSL\bin\libssl-3-x64.dll

6) Copy the contents of 'openssl_3.5.7_win64_129GA\openssl_3.5.7_win64\' folder to the '<Install_Dir>\CA\secure-proxy\SSL\bin\' directory.

CONTENTS:

libcrypto-3-x64.dll
libssl-3-x64.dll
openssl.exe

7) Back-up either the '<Install_Dir>\CA\secure-proxy\httpd\bin\' directory, or the following files:

<Install_Dir>\CA\secure-proxy\httpd\bin\libcrypto-3-x64.dll
<Install_Dir>\CA\secure-proxy\httpd\bin\libssl-3-x64.dll
<Install_Dir>\CA\secure-proxy\httpd\bin\openssl.exe

8) Copy the contents of 'openssl_3.5.7_win64_129GA\openssl_3.5.7_win64\' folder to the '<Install_Dir>\CA\secure-proxy\httpd\bin\' directory.

CONTENTS:

libcrypto-3-x64.dll
libssl-3-x64.dll
openssl.exe

9) Start the Access Gateway server

Additional Information

Vulnerabilities in OpenSSL 3.5.x

Verifying the OpenSSL version on Siteminder Access Gateway

CVE's related to OpenSSL 3.5.6 and older which are remediated with OpenSSL 3.5.7:

CVE-2026-34180
CVE-2026-34181
CVE-2026-34182
CVE-2026-34183
CVE-2026-42764
CVE-2026-42766
CVE-2026-42767
CVE-2026-42768
CVE-2026-42769
CVE-2026-42770
CVE-2026-45445
CVE-2026-45446
CVE-2026-45447
CVE-2026-7383
CVE-2026-9076
CVE-2026-28387
CVE-2026-28388
CVE-2026-28389
CVE-2026-28390
CVE-2026-31789
CVE-2026-31790
CVE-2026-22795
CVE-2026-22796
CVE-2026-2673
CVE-2025-11187
CVE-2025-15467
CVE-2025-15468
CVE-2025-15469
CVE-2025-66199
CVE-2025-68160
CVE-2025-69418
CVE-2025-69419
CVE-2025-69420
CVE-2025-69421
CVE-2025-9230
CVE-2025-9231
CVE-2025-9232
CVE-2025-4575
CVE-2024-12797
CVE-2024-13176

Attachments

openssl_3.5.7_linux_129GA.zip get_app
openssl_3.5.7_win64_129GA.zip get_app
Powered by Wolken Software