# Rocky 8 CVE-2024-9143 & Rocky 9 CVE-2025-32728

**URL:** <https://forums.rockylinux.org/t/rocky-8-cve-2024-9143-rocky-9-cve-2025-32728/19414>\
**Category:** Rocky Linux Help & Support\
**Tags:** rocky-linux-8, rocky-linux-9\
**Created:** [August 14, 2025, 8:50am UTC](https://forums.rockylinux.org/t/rocky-8-cve-2024-9143-rocky-9-cve-2025-32728/19414 "2025-08-14T08:50:09Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![MSA](https://avatars.discourse-cdn.com/v4/letter/m/ce7236/32.png) [@MSA](https://forums.rockylinux.org/u/MSA)\
**Post date:** [August 14, 2025, 8:50am UTC](https://forums.rockylinux.org/t/rocky-8-cve-2024-9143-rocky-9-cve-2025-32728/19414/1 "2025-08-14T08:50:09Z")

</div>

During security scan we found out that following vulnerabilities are present on openssl & openssh packages:  
CVE-2024-9143 & Rocky 9 CVE-2025-32728

Couldn’t find their remediation in the change log of packages. When is Rocky linux going to release resolution for this

---

<div class="post-metadata">

**Author:** ![jlehtone](https://avatars.discourse-cdn.com/v4/letter/j/e9a140/32.png) [@jlehtone](https://forums.rockylinux.org/u/jlehtone)\
**Post date:** [August 14, 2025, 11:46am UTC](https://forums.rockylinux.org/t/rocky-8-cve-2024-9143-rocky-9-cve-2025-32728/19414/2 "2025-08-14T11:46:59Z")

</div>

> [@MSA](#):
>
> CVE-2024-9143

Red Hat says: [cve-details](https://access.redhat.com/security/cve/cve-2024-9143)  
That is:

- openssl in any RHEL is _not affected_
- CVE has _low impact_ and therefore _fix is deferred_ for the other (affected) components

Rocky has what RHEL has and therefore, openssl in Rocky is not affected and no fix is required.  
Your “security scan” does not actually verify that component has/hasn’t vulnerability, nor it does know that the component in RHEL/Rocky differs from upstream.

The CVE-2025-32728 [cve-details](https://access.redhat.com/security/cve/cve-2025-32728) has _moderate impact_ but Red Hat has deferred fix. They do describe a _mitigation_ to avoid the issue for time being.

Rocky has what RHEL has and therefore Rocky will (most likely) not release a fixed version before RHEL has released one.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex020/uploads/rockylinux/original/1X/91b7219eec10e30013422e4df76c1d898711a5d5.svg) [@system](https://forums.rockylinux.org/u/system)\
**Post date:** [October 13, 2025, 11:47am UTC](https://forums.rockylinux.org/t/rocky-8-cve-2024-9143-rocky-9-cve-2025-32728/19414/3 "2025-10-13T11:47:35Z")

</div>

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.