CVE-2026-93eed17997: Fedora 43 OpenSSL 3.5.9 Rebase — Patching, Verification, and Exposure Audit Guide

Fedora has issued a security notice for Fedora 43 shipping a rebase of the system's OpenSSL packages to version 3.5.9, tracked under advisory CVE-2026-93eed17997 (source advisory). OpenSSL is not a typical application package — it is the cryptographic foundation beneath TLS termination, certificate validation, secure package transport, and a long tail of linked services including httpd, nginx, OpenSSH clients, curl, and countless third-party binaries. When the distribution rebases OpenSSL, the blast radius of not patching is the entire trust stack of the host.

Rebase advisories like this one are frequently understated in severity conversations because they bundle upstream fixes rather than spotlighting a single headline exploit. That framing is dangerous. An OpenSSL rebase exists because upstream shipped security-relevant corrections, and any workload still running the prior 3.5.x build on Fedora 43 is carrying whatever weakness motivated the rebase. If your Fedora 43 systems are internet-facing, terminate TLS, or handle authentication material, treat this as a priority patch cycle — not a routine maintenance window.

Technical Analysis

Affected Products and Platforms

Why a Rebase Matters from a Defender's Perspective

A rebase moves the entire OpenSSL package set to a new upstream release line. Two defensive implications follow:

1. Bundled fixes. Rebase releases typically roll up upstream security patches, correctness fixes in cryptographic operations, and hardening changes. The advisory references CVE-2026-93eed17997 as the driving issue for this update. Until patched, every process dynamically linked against the system libssl.so.3 / libcrypto.so.3 inherits the vulnerable code path.
2. Linkage traps. Applying dnf update openssl updates the on-disk libraries, but running processes that loaded the old library at start continue executing the vulnerable code until restarted. This is the single most common failure mode we see in IR retainer work after OpenSSL patching: the package manager reports the fixed version, but long-lived daemons (web servers, VPN gateways, mail transfer agents, custom TLS services) are still mapped to the old .so in memory. Vulnerability scanners that only check package versions will show green while the actual attack surface remains exposed.

Exploitation Status

At the time of this writing, the advisory documents the rebase and associated CVE fix without confirming in-the-wild exploitation. That said, OpenSSL weaknesses historically attract rapid researcher attention and proof-of-concept development once a fixed diff is public — the delta between 3.5.8 and 3.5.9 tells anyone with git exactly where the defect lived. The correct defensive posture is to assume the window between patch availability and working exploit code is short, and to patch before that window closes rather than after exploitation is confirmed.

Detection & Response

This is a vulnerability-management event, not an intrusion campaign — so detection content here focuses on finding unpatched hosts, identifying processes still mapped to stale OpenSSL libraries, and confirming remediation actually took effect. These are the queries and rules I would hand to a SOC team responsible for a mixed fleet that includes Fedora 43 build runners, edge proxies, or developer workstations.

Sigma Rules

The most reliable post-patch signal on Linux is detecting services still running with deleted (old) OpenSSL library mappings — i.e., processes that loaded libssl/libcrypto before the update and were never restarted. On Linux this is best surfaced via auditd/exec telemetry around library access and package-manager activity. The rules below target (1) OpenSSL package modification events and (2) processes executing with references to deleted OpenSSL shared libraries, which is the indicator of an incomplete remediation.

---
title: OpenSSL Package Modification on Fedora Linux
id: 3f7c2a91-6e4b-4d58-9a21-8c0f5b7d2e44
status: experimental
description: Detects package manager operations touching OpenSSL packages on Fedora/RHEL-family systems. Useful for correlating patch deployment timelines and detecting unexpected downgrade or removal attempts.
references:
  - https://linuxsecurity.com/advisories/fedora/fedora-43-openssl-2026-93eed17997
author: Security Arsenal
date: 2026/02/11
tags:
  - attack.defense_evasion
  - attack.t1072
logsource:
  category: process_creation
  product: linux
detection:
  selection_pkgmgr:
    Image|endswith:
      - '/dnf'
      - '/dnf5'
      - '/rpm'
      - '/yum'
  selection_args:
    CommandLine|contains:
      - 'openssl'
  condition: all of selection_*
falsepositives:
  - Routine patching activity by administrators or configuration management
level: low
---
title: Process Running with Deleted OpenSSL Shared Library
id: 9b1e4d63-2a78-4f95-bc30-6d7a1f8e5c29
status: experimental
description: Detects processes whose memory maps reference a deleted libssl or libcrypto shared object, indicating the service was not restarted after an OpenSSL update and is still executing the vulnerable code path. Requires auditd or EDR telemetry capturing open/exec of library paths, or lsof-based monitoring forwarded to the SIEM.
references:
  - https://linuxsecurity.com/advisories/fedora/fedora-43-openssl-2026-93eed17997
author: Security Arsenal
date: 2026/02/11
tags:
  - attack.persistence
  - attack.t1574
logsource:
  category: file_event
  product: linux
detection:
  selection:
    TargetFilename|contains:
      - 'libssl.so.3 (deleted)'
      - 'libcrypto.so.3 (deleted)'
      - 'libssl.so (deleted)'
      - 'libcrypto.so (deleted)'
  condition: selection
falsepositives:
  - Short-lived processes that exit naturally before restart windows complete
level: high

KQL — Microsoft Sentinel / Defender

Even Linux fleets are commonly hunted through Sentinel via Syslog/CEF ingestion or Defender for Endpoint on Linux. The first query finds hosts reporting an OpenSSL version older than 3.5.9 in Syslog or heartbeat-style inventory messages; the second hunts Defender-on-Linux process events for daemons that have not restarted since the package update timestamp.

// Hunt 1: Fedora 43 hosts reporting a pre-3.5.9 OpenSSL version via Syslog ingestion
Syslog
| where TimeGenerated > ago(7d)
| where SyslogMessage has "openssl"
| extend OpenSSLVersion = extract(@"openssl[^0-9]*(3\.5\.[0-9]+)", 1, SyslogMessage)
| where isnotempty(OpenSSLVersion)
| extend VersionParts = split(OpenSSLVersion, ".")
| extend PatchLevel = toint(VersionParts[2])
| where PatchLevel < 9
| summarize LastSeen = max(TimeGenerated), SampleMessage = any(SyslogMessage) by Computer, OpenSSLVersion
| order by LastSeen desc;

// Hunt 2: TLS-linked daemons started BEFORE the last openssl package update (not restarted = still vulnerable in memory)
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where FileName in~ ("nginx", "httpd", "apache2", "haproxy", "postfix", "dovecot", "stunnel", "openvpn", "curl")
| join kind=inner (
    DeviceProcessEvents
    | where FileName in~ ("dnf", "dnf5", "rpm") and ProcessCommandLine has "openssl"
    | summarize LastOpenSSLUpdate = max(TimeGenerated) by DeviceId
) on DeviceId
| where TimeGenerated < LastOpenSSLUpdate
| summarize LastProcessStart = max(TimeGenerated), LastOpenSSLUpdate = any(LastOpenSSLUpdate) by DeviceName, FileName
| extend RemediationGap = LastOpenSSLUpdate - LastProcessStart
| order by RemediationGap desc

Velociraptor VQL

This artifact enumerates running processes and checks their memory maps for deleted OpenSSL libraries — the definitive test of whether a service restart is still outstanding after patching.

-- Hunt for processes still mapped to deleted (pre-patch) OpenSSL shared libraries
-- A hit means the package is updated on disk but the running service still executes the vulnerable code
SELECT Pid, Name, Exe, Username,
       read_file(filename=format(format="/proc/%v/maps", args=Pid), length=2000000) AS Maps
FROM pslist()
WHERE read_file(filename=format(format="/proc/%v/maps", args=Pid), length=2000000) =~ 'lib(ssl|crypto)\\.so[^\\n]*\\(deleted\\)'

Remediation & Verification Script

#!/usr/bin/env bash
# Fedora 43 OpenSSL 3.5.9 remediation + verification (CVE-2026-93eed17997)
# Run with sudo. Safe to re-run; idempotent.

set -euo pipefail

TARGET_VERSION="3.5.9"

echo "[+] Current OpenSSL package version:"
rpm -q openssl openssl-libs || true
openssl version -a | head -2

echo "[+] Applying Fedora 43 OpenSSL update..."
dnf upgrade --refresh -y openssl openssl-libs

echo "[+] Post-patch version check:"
INSTALLED=$(rpm -q --queryformat '%{VERSION}' openssl)
echo "    Installed: ${INSTALLED}"
if [[ "${INSTALLED}" != "${TARGET_VERSION}"* ]]; then
  echo "[!] WARNING: installed version does not match expected ${TARGET_VERSION} — investigate mirror/repo state."
  exit 1
fi

echo "[+] Identifying processes still using DELETED (old) OpenSSL libraries:"
STALE=0
for pid in $(ls /proc | grep -E '^[0-9]+$'); do
  if grep -qsE 'lib(ssl|crypto)\.so.*\(deleted\)' "/proc/${pid}/maps" 2>/dev/null; then
    COMM=$(cat "/proc/${pid}/comm" 2>/dev/null || echo "unknown")
    echo "    STALE: PID ${pid} (${COMM})"
    STALE=1
  fi
done

if [[ "${STALE}" -eq 1 ]]; then
  echo "[+] Restarting services that depend on OpenSSL..."
  # needs-restarting ships with dnf-utils / dnf-plugins-core on Fedora
  dnf needs-restarting -s || true
  echo "[!] Re-run this script after restarts to confirm zero stale mappings."
else
  echo "[+] No stale OpenSSL library mappings found. Remediation complete."
fi

echo "[+] Statically linked / bundled OpenSSL audit (binaries NOT covered by this patch):"
find /usr/local /opt -type f -executable 2>/dev/null | while read -r bin; do
  if strings "${bin}" 2>/dev/null | grep -qE "OpenSSL 3\.5\.[0-8][^0-9]"; then
    echo "    REVIEW: ${bin} embeds an older OpenSSL build"
  fi
done

Remediation

1. Patch immediately on all Fedora 43 systems: sudo dnf upgrade --refresh openssl openssl-libs. Confirm the result with rpm -q openssl — expected version is 3.5.9.
2. Restart dependent services or reboot. Patching the package does not patch running processes. Use dnf needs-restarting -s (restart services) or needs-restarting -r (check whether a full reboot is required). For edge TLS terminators, VPN concentrators, and mail infrastructure, schedule the restart in the same maintenance window as the patch — not later.
3. Audit for bundled and statically linked OpenSSL. Containers, vendor appliances installed under /opt, and language runtimes with vendored crypto (some Node.js, Python, and Go builds) do not inherit the system fix. Rebuild container images from a patched Fedora 43 base and redeploy.
4. Validate externally. After patching and restarts, re-scan TLS endpoints (testssl.sh, openssl s_client, or your scanner of record) and confirm the vulnerability scan finding clears based on service behavior, not just package version.
5. Track the advisory. Monitor the official advisory and Fedora update channels for follow-on rebuilds of dependent packages. If CISA adds CVE-2026-93eed17997 to the Known Exploited Vulnerabilities catalog, federal and KEV-aligned remediation deadlines will apply — check your BOD 22-01 binding operational directive obligations if you operate in or adjacent to the federal space.
6. Feed version inventory into your VM program. If you cannot answer "how many Fedora 43 hosts do we have, and which run TLS services?" in under an hour, that is an asset-inventory gap to close alongside this patch cycle.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub