AWS drs: DRS agent 6.42.25 fixes OpenSSL and Bouncy Castle CVEs
Summary
Adds release notes for agent version 6.42.25: Oracle Linux 10 support, Failback Client S3 endpoint resolution change, and bundled OpenSSL 3.0.22 and Bouncy Castle 1.85 upgrades that fix multiple named CVEs.
Security assessment
The diff explicitly states bundled OpenSSL and Bouncy Castle libraries were upgraded to address named security vulnerabilities, i.e. concrete remediation of cryptographic library flaws in the shipped agent.
Evidence
+ * Updates the bundled OpenSSL version to 3.0.22 to address security vulnerabilities: CVE-2026-63072, CVE-2026-63076, CVE-2026-54874, CVE-2026-63074, and CVE-2026-75803.
Diff
diff --git a/drs/latest/userguide/drs-agent-release-notes.md b/drs/latest/userguide/drs-agent-release-notes.md index 6cd2bff..9d3b4be 100644 --- a//drs/latest/userguide/drs-agent-release-notes.md +++ b//drs/latest/userguide/drs-agent-release-notes.md @@ -14,0 +15,8 @@ Agent Version | Details | Release date +6.42.25 | + + * Added support for Oracle Linux 10. See [Supported Linux operating systems](./Supported-Operating-Systems-Linux.html). + * The Failback Client no longer prompts for a custom S3 endpoint. It resolves Amazon S3 using the DNS configuration of the server that you are failing back to. + * Updates the bundled OpenSSL version to 3.0.22 to address security vulnerabilities: CVE-2026-63072, CVE-2026-63076, CVE-2026-54874, CVE-2026-63074, and CVE-2026-75803. + * Updates the bundled Bouncy Castle libraries to version 1.85 to address security vulnerabilities, including CVE-2026-8763, CVE-2026-59650, CVE-2026-58062, CVE-2026-59639, CVE-2026-12802, CVE-2026-59642, and CVE-2026-59645. + +| September 2026