Rocky 8 CVE-2024-9143 & Rocky 9 CVE-2025-32728

Rocky Linux Help & Support
,
1

During security scan we found out that following vulnerabilities are present on openssl & openssh packages:
CVE-2024-9143 & Rocky 9 CVE-2025-32728

Couldn’t find their remediation in the change log of packages. When is Rocky linux going to release resolution for this

2

Red Hat says: cve-details
That is:

  • openssl in any RHEL is not affected
  • CVE has low impact and therefore fix is deferred for the other (affected) components

Rocky has what RHEL has and therefore, openssl in Rocky is not affected and no fix is required.
Your “security scan” does not actually verify that component has/hasn’t vulnerability, nor it does know that the component in RHEL/Rocky differs from upstream.

The CVE-2025-32728 cve-details has moderate impact but Red Hat has deferred fix. They do describe a mitigation to avoid the issue for time being.

Rocky has what RHEL has and therefore Rocky will (most likely) not release a fixed version before RHEL has released one.

1 Like
3

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.