{
  "document": {
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "lang": "en",
    "title": "OpenSSL update in the Node.js runtime of ChargeLink Admin and the DEVlink Licence Server",
    "publisher": {
      "category": "vendor",
      "name": "DEVlink AB",
      "namespace": "https://devlink.se",
      "contact_details": "security@devlink.se"
    },
    "distribution": {
      "tlp": {
        "label": "WHITE"
      }
    },
    "aggregate_severity": {
      "text": "Low"
    },
    "notes": [
      {
        "category": "summary",
        "text": "ChargeLink Admin 1.1.0 bundles Node.js 24.22.1 with OpenSSL 3.5.9, which fixes CVE-2026-35189 (Low). Admin 1.0.0 to 1.0.3 and DEVlink Licence Server 1.0.0 to 1.0.2 bundle Node.js 24.19.0 (OpenSSL 3.5.7) or 24.21.0 (OpenSSL 3.5.8). A fixed Licence Server (1.0.3) is in preparation."
      },
      {
        "category": "legal_disclaimer",
        "text": "Provided as is to help users secure their installations."
      }
    ],
    "references": [
      {
        "category": "self",
        "summary": "DEVLINK-SA-2026-002",
        "url": "https://devlink.se/security/advisories/DEVLINK-SA-2026-002/"
      },
      {
        "category": "external",
        "summary": "DEVLINK-SA-2026-001 (OpenSSL in ChargeLink Admin 1.0.0)",
        "url": "https://devlink.se/security/advisories/DEVLINK-SA-2026-001/"
      },
      {
        "category": "external",
        "summary": "DEVlink coordinated vulnerability disclosure policy",
        "url": "https://devlink.se/security/"
      }
    ],
    "tracking": {
      "id": "DEVLINK-SA-2026-002",
      "status": "final",
      "version": "1",
      "initial_release_date": "2026-10-29T00:00:00.000Z",
      "current_release_date": "2026-10-29T00:00:00.000Z",
      "revision_history": [
        {
          "date": "2026-10-29T00:00:00.000Z",
          "number": "1",
          "summary": "Initial publication. ChargeLink Admin fixed in 1.1.0, a free update for every affected customer; DEVlink Licence Server fix in preparation (1.0.3), this advisory will be revised when it ships."
        }
      ],
      "generator": {
        "engine": {
          "name": "DEVlink compliance tooling",
          "version": "1.0.0"
        },
        "date": "2026-10-29T00:00:00.000Z"
      }
    }
  },
  "product_tree": {
    "branches": [
      {
        "category": "vendor",
        "name": "DEVlink AB",
        "branches": [
          {
            "category": "product_name",
            "name": "ChargeLink Admin",
            "branches": [
              {
                "category": "product_version",
                "name": "1.0.0",
                "product": {
                  "name": "DEVlink ChargeLink Admin 1.0.0",
                  "product_id": "CLA-1.0.0"
                }
              },
              {
                "category": "product_version",
                "name": "1.0.1",
                "product": {
                  "name": "DEVlink ChargeLink Admin 1.0.1",
                  "product_id": "CLA-1.0.1"
                }
              },
              {
                "category": "product_version",
                "name": "1.0.2",
                "product": {
                  "name": "DEVlink ChargeLink Admin 1.0.2",
                  "product_id": "CLA-1.0.2"
                }
              },
              {
                "category": "product_version",
                "name": "1.0.3",
                "product": {
                  "name": "DEVlink ChargeLink Admin 1.0.3",
                  "product_id": "CLA-1.0.3"
                }
              },
              {
                "category": "product_version",
                "name": "1.1.0",
                "product": {
                  "name": "DEVlink ChargeLink Admin 1.1.0",
                  "product_id": "CLA-1.1.0"
                }
              }
            ]
          },
          {
            "category": "product_name",
            "name": "DEVlink Licence Server",
            "branches": [
              {
                "category": "product_version",
                "name": "1.0.0",
                "product": {
                  "name": "DEVlink Licence Server 1.0.0",
                  "product_id": "DLS-1.0.0"
                }
              },
              {
                "category": "product_version",
                "name": "1.0.1",
                "product": {
                  "name": "DEVlink Licence Server 1.0.1",
                  "product_id": "DLS-1.0.1"
                }
              },
              {
                "category": "product_version",
                "name": "1.0.2",
                "product": {
                  "name": "DEVlink Licence Server 1.0.2",
                  "product_id": "DLS-1.0.2"
                }
              }
            ]
          }
        ]
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-35189",
      "title": "Excessive memory allocation in relative CRL distribution point processing (OpenSSL)",
      "notes": [
        {
          "category": "description",
          "text": "OpenSSL 3.5 before 3.5.9 can allocate excessive memory while processing a relative CRL distribution point in a crafted X.509 certificate."
        },
        {
          "category": "general",
          "title": "Reachability",
          "text": "Availability only. Reaching the issue needs an authenticated engineer or administrator who imports a crafted certificate, or a crafted certificate chain from an update source the administrator configured. The ChargeLink engine is not affected. Since ChargeLink Admin 1.0.2, its separate openssl.exe is 3.5.9; this advisory covers the OpenSSL inside the bundled Node.js runtime."
        }
      ],
      "product_status": {
        "known_affected": [
          "CLA-1.0.0",
          "CLA-1.0.1",
          "CLA-1.0.2",
          "CLA-1.0.3",
          "DLS-1.0.0",
          "DLS-1.0.1",
          "DLS-1.0.2"
        ],
        "fixed": [
          "CLA-1.1.0"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Install ChargeLink Admin 1.1.0 (signed by DEVlink AB). It is a free update for every affected customer: free of charge, and it runs under every licence that covers 1.0.0 to 1.0.3, including perpetual licences without maintenance. Installer ChargeLinkAdminSetup-1.1.0.exe, SHA-256 169F0DDB7427793F83E3A64D0E9ABEFF27230259C0E4E3DA8202B8E155D9048B.",
          "product_ids": [
            "CLA-1.0.0",
            "CLA-1.0.1",
            "CLA-1.0.2",
            "CLA-1.0.3"
          ],
          "url": "https://devlink.se/security/advisories/DEVLINK-SA-2026-002/"
        },
        {
          "category": "none_available",
          "details": "Fix in preparation: DEVlink Licence Server 1.0.3 (Node.js 24.22.1). This advisory will be revised when it ships.",
          "product_ids": [
            "DLS-1.0.0",
            "DLS-1.0.1",
            "DLS-1.0.2"
          ]
        },
        {
          "category": "workaround",
          "details": "Until updated, import certificates only from trusted sources, and configure only update sources you trust.",
          "product_ids": [
            "CLA-1.0.0",
            "CLA-1.0.1",
            "CLA-1.0.2",
            "CLA-1.0.3",
            "DLS-1.0.0",
            "DLS-1.0.1",
            "DLS-1.0.2"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low: excessive memory use (availability) while a crafted certificate is processed.",
          "product_ids": [
            "CLA-1.0.0",
            "CLA-1.0.1",
            "CLA-1.0.2",
            "CLA-1.0.3",
            "DLS-1.0.0",
            "DLS-1.0.1",
            "DLS-1.0.2"
          ]
        }
      ],
      "references": [
        {
          "category": "external",
          "summary": "OpenSSL vulnerabilities",
          "url": "https://openssl-library.org/news/vulnerabilities/"
        }
      ]
    }
  ]
}