{
  "document": {
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "lang": "en",
    "title": "OpenSSL update in ChargeLink Admin",
    "publisher": {
      "category": "vendor",
      "name": "DEVlink AB",
      "namespace": "https://devlink.se",
      "contact_details": "security@devlink.se"
    },
    "distribution": {
      "tlp": {
        "label": "WHITE"
      }
    },
    "aggregate_severity": {
      "text": "Low"
    },
    "notes": [
      {
        "category": "summary",
        "text": "ChargeLink Admin 1.0.3 replaces the bundled OpenSSL 3.5.6 with 3.5.9. Two low-severity OpenSSL issues (CVE-2026-34180, CVE-2026-7383) could be reached in 1.0.0 by displaying a crafted certificate file."
      },
      {
        "category": "legal_disclaimer",
        "text": "Provided as is to help users secure their installations."
      }
    ],
    "references": [
      {
        "category": "self",
        "summary": "DEVLINK-SA-2026-001",
        "url": "https://devlink.se/security/advisories/DEVLINK-SA-2026-001/"
      },
      {
        "category": "external",
        "summary": "DEVlink coordinated vulnerability disclosure policy",
        "url": "https://devlink.se/security/"
      }
    ],
    "tracking": {
      "id": "DEVLINK-SA-2026-001",
      "status": "final",
      "version": "3",
      "initial_release_date": "2026-10-12T00:00:00.000Z",
      "current_release_date": "2026-10-12T00:00:00.000Z",
      "revision_history": [
        {
          "date": "2026-09-26T00:00:00.000Z",
          "number": "1",
          "summary": "Draft: fixed in ChargeLink Admin 1.0.1."
        },
        {
          "date": "2026-10-01T00:00:00.000Z",
          "number": "2",
          "summary": "Draft: remediation points to ChargeLink Admin 1.0.2 (1.0.1 was not distributed)."
        },
        {
          "date": "2026-10-12T00:00:00.000Z",
          "number": "3",
          "summary": "Initial publication. Remediation points to ChargeLink Admin 1.0.3, signed by DEVlink AB, the first distributed fixed release (1.0.1 and 1.0.2 were not distributed)."
        }
      ],
      "generator": {
        "engine": {
          "name": "DEVlink compliance tooling",
          "version": "1.0.0"
        },
        "date": "2026-10-12T00:00:00.000Z"
      }
    }
  },
  "product_tree": {
    "branches": [
      {
        "category": "vendor",
        "name": "DEVlink AB",
        "branches": [
          {
            "category": "product_name",
            "name": "ChargeLink Admin",
            "branches": [
              {
                "category": "product_version",
                "name": "1.0.0",
                "product": {
                  "name": "DEVlink ChargeLink Admin 1.0.0",
                  "product_id": "CLA-1.0.0"
                }
              },
              {
                "category": "product_version",
                "name": "1.0.1",
                "product": {
                  "name": "DEVlink ChargeLink Admin 1.0.1",
                  "product_id": "CLA-1.0.1"
                }
              },
              {
                "category": "product_version",
                "name": "1.0.2",
                "product": {
                  "name": "DEVlink ChargeLink Admin 1.0.2",
                  "product_id": "CLA-1.0.2"
                }
              },
              {
                "category": "product_version",
                "name": "1.0.3",
                "product": {
                  "name": "DEVlink ChargeLink Admin 1.0.3",
                  "product_id": "CLA-1.0.3"
                }
              }
            ]
          }
        ]
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-34180",
      "title": "Heap buffer over-read in ASN.1 content parsing (OpenSSL)",
      "notes": [
        {
          "category": "description",
          "text": "OpenSSL before 3.5.7 can read beyond a heap buffer while parsing crafted DER-encoded ASN.1 content."
        },
        {
          "category": "general",
          "title": "Reachability in ChargeLink Admin",
          "text": "ChargeLink Admin uses OpenSSL only to create certificates and to display certificate files. The issue can only be triggered by displaying a crafted certificate that an operator imports. It affects the short-lived OpenSSL process, not the console, its data or the ChargeLink engine."
        }
      ],
      "product_status": {
        "known_affected": [
          "CLA-1.0.0"
        ],
        "fixed": [
          "CLA-1.0.1",
          "CLA-1.0.2",
          "CLA-1.0.3"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Install ChargeLink Admin 1.0.3 (security-only update, free of charge for every licence covering 1.0.0; signed by DEVlink AB). Installer ChargeLinkAdminSetup-1.0.3.exe, SHA-256 4C5778D0FE60B43F78021F680592BB52864B554FE1C93AFA1A20C2A7BAE26391.",
          "product_ids": [
            "CLA-1.0.0"
          ],
          "url": "https://devlink.se/security/advisories/DEVLINK-SA-2026-001/"
        },
        {
          "category": "workaround",
          "details": "Until updated, import certificates only from trusted sources.",
          "product_ids": [
            "CLA-1.0.0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low: out-of-bounds read or crash of the OpenSSL process that displays a crafted certificate.",
          "product_ids": [
            "CLA-1.0.0"
          ]
        }
      ],
      "references": [
        {
          "category": "external",
          "summary": "OpenSSL vulnerabilities",
          "url": "https://openssl-library.org/news/vulnerabilities/"
        }
      ]
    },
    {
      "cve": "CVE-2026-7383",
      "title": "ASN.1 multibyte string conversion (OpenSSL)",
      "notes": [
        {
          "category": "description",
          "text": "OpenSSL before 3.5.7 can mishandle memory when converting crafted ASN.1 multibyte strings."
        },
        {
          "category": "general",
          "title": "Reachability in ChargeLink Admin",
          "text": "ChargeLink Admin uses OpenSSL only to create certificates and to display certificate files. The issue can only be triggered by displaying a crafted certificate that an operator imports. It affects the short-lived OpenSSL process, not the console, its data or the ChargeLink engine."
        }
      ],
      "product_status": {
        "known_affected": [
          "CLA-1.0.0"
        ],
        "fixed": [
          "CLA-1.0.1",
          "CLA-1.0.2",
          "CLA-1.0.3"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Install ChargeLink Admin 1.0.3 (security-only update, free of charge for every licence covering 1.0.0; signed by DEVlink AB). Installer ChargeLinkAdminSetup-1.0.3.exe, SHA-256 4C5778D0FE60B43F78021F680592BB52864B554FE1C93AFA1A20C2A7BAE26391.",
          "product_ids": [
            "CLA-1.0.0"
          ],
          "url": "https://devlink.se/security/advisories/DEVLINK-SA-2026-001/"
        },
        {
          "category": "workaround",
          "details": "Until updated, import certificates only from trusted sources.",
          "product_ids": [
            "CLA-1.0.0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low: out-of-bounds read or crash of the OpenSSL process that displays a crafted certificate.",
          "product_ids": [
            "CLA-1.0.0"
          ]
        }
      ],
      "references": [
        {
          "category": "external",
          "summary": "OpenSSL vulnerabilities",
          "url": "https://openssl-library.org/news/vulnerabilities/"
        }
      ]
    }
  ]
}