{"cves":["CVE-2026-28390","CVE-2026-31790"],"cvss":0.0,"database_specific":{"severity":"MODERATE"},"description":"[20251114-5.0.1.el10_2.2]\n- Replace upstream references [Orabug:36569119]\n\n[20251114-5.el10_2.2]\n- edk2-Revert-OvmfPkg-X86QemuLoadImageLib-flip-default-for-.patch [RHEL-182421]\n- edk2-Bumped-to-OpenSSL-3.5.5-3.patch [RHEL-165699]\n- Resolves: RHEL-182421\n  (edk2/x64: re-enable legacy kernel loader [rhel-10.2.z])\n- Resolves: RHEL-165699\n  (CVE-2026-28390 edk2: OpenSSL: Denial of Service due to NULL pointer dereference in CMS EnvelopedData processing [rhel-10.2])\n\n[20251114-5.el10_2.1]\n- edk2-Bumped-to-OpenSSL-3.5.5-2.patch [RHEL-161573]\n- Resolves: RHEL-161573\n  (CVE-2026-31790 edk2: openssl: Information Disclosure from Uninitialized Memory via Invalid RSA Public Key [rhel-10.2])","id":"ELSA-2026-39297","ovalId":"oval:com.oracle.elsa:def:202639297","source":"oracle_linux","title":"ELSA-2026-39297:  edk2 security, bug fix, and enhancement update (MODERATE)","url":"https://linux.oracle.com/errata/ELSA-2026-39297.html"}