VuXML ID | Description |
00b0d8cd-7097-11e2-98d9-003067c2616f | OpenSSL -- TLS 1.1, 1.2 denial of service
OpenSSL security team reports:
A flaw in the OpenSSL handling of CBC mode ciphersuites in TLS 1.1
and TLS 1.2 on AES-NI supporting platforms can be exploited in a
DoS attack.
A flaw in the OpenSSL handling of OCSP response verification can
be exploited in a denial of service attack.
Discovery 2013-02-05 Entry 2013-02-06 openssl
< 1.0.1_6
CVE-2012-2686
CVE-2013-0166
CVE-2013-0169
http://www.openssl.org/news/secadv_20120510.txt
|
012809ce-83f3-11ea-92ab-00163e433440 | OpenSSL remote denial of service vulnerability
Problem Description:
Server or client applications that call the SSL_check_chain()
function during or after a TLS 1.3 handshake may crash due to a NULL
pointer dereference as a result of incorrect handling of the
"signature_algorithms_cert" TLS extension. The crash occurs if an
invalid or unrecognized signature algorithm is received from the
peer.
Impact:
A malicious peer could exploit the NULL pointer dereference crash,
causing a denial of service attack.
Discovery 2020-04-21 Entry 2020-04-21 Modified 2020-04-22 FreeBSD
ge 12.1 lt 12.1_4
openssl
ge 1.1.1,1 lt 1.1.1g,1
CVE-2020-1967
SA-20:11.openssl
https://www.openssl.org/news/secadv/20200421.txt
|
01d729ca-1143-11e6-b55e-b499baebfeaf | OpenSSL -- multiple vulnerabilities
OpenSSL reports:
Memory corruption in the ASN.1 encoder
Padding oracle in AES-NI CBC MAC check
EVP_EncodeUpdate overflow
EVP_EncryptUpdate overflow
ASN.1 BIO excessive memory allocation
EBCDIC overread (OpenSSL only)
Discovery 2016-05-03 Entry 2016-05-03 Modified 2016-08-09 openssl
< 1.0.2_11
linux-c6-openssl
< 1.0.1e_8
libressl
ge 2.3.0 lt 2.3.4
< 2.2.7
libressl-devel
< 2.3.4
FreeBSD
ge 10.3 lt 10.3_2
ge 10.2 lt 10.2_16
ge 10.1 lt 10.1_33
ge 9.3 lt 9.3_41
https://www.openssl.org/news/secadv/20160503.txt
https://marc.info/?l=openbsd-tech&m=146228598730414
CVE-2016-2105
CVE-2016-2106
CVE-2016-2107
CVE-2016-2108
CVE-2016-2109
CVE-2016-2176
SA-16:17.openssl
|
03175e62-5494-11e4-9cc1-bc5ff4fb5e7b | OpenSSL -- multiple vulnerabilities
The OpenSSL Project reports:
A flaw in the DTLS SRTP extension parsing code allows an
attacker, who sends a carefully crafted handshake message,
to cause OpenSSL to fail to free up to 64k of memory causing
a memory leak. This could be exploited in a Denial Of Service
attack. This issue affects OpenSSL 1.0.1 server implementations
for both SSL/TLS and DTLS regardless of whether SRTP is used
or configured. Implementations of OpenSSL that have been
compiled with OPENSSL_NO_SRTP defined are not affected.
[CVE-2014-3513].
When an OpenSSL SSL/TLS/DTLS server receives a session
ticket the integrity of that ticket is first verified.
In the event of a session ticket integrity check failing,
OpenSSL will fail to free memory causing a memory leak.
By sending a large number of invalid session tickets an
attacker could exploit this issue in a Denial Of Service
attack. [CVE-2014-3567].
OpenSSL has added support for TLS_FALLBACK_SCSV to allow
applications to block the ability for a MITM attacker to
force a protocol downgrade.
Some client applications (such as browsers) will reconnect
using a downgraded protocol to work around interoperability
bugs in older servers. This could be exploited by an active
man-in-the-middle to downgrade connections to SSL 3.0 even
if both sides of the connection support higher protocols.
SSL 3.0 contains a number of weaknesses including POODLE
[CVE-2014-3566].
When OpenSSL is configured with "no-ssl3" as a build option,
servers could accept and complete a SSL 3.0 handshake, and
clients could be configured to send them. [CVE-2014-3568].
Discovery 2014-10-15 Entry 2014-10-15 Modified 2016-08-09 openssl
ge 1.0.1 lt 1.0.1_16
mingw32-openssl
ge 1.0.1 lt 1.0.1j
linux-c6-openssl
< 1.0.1e_1
FreeBSD
ge 8.4 lt 8.4_17
ge 9.1 lt 9.1_20
ge 9.2 lt 9.2_13
ge 9.3 lt 9.3_3
ge 10.0 lt 10.0_10
SA-14:23.openssl
CVE-2014-3513
CVE-2014-3566
CVE-2014-3567
CVE-2014-3568
https://www.openssl.org/news/secadv_20141015.txt
|
075952fe-267e-11e5-9d03-3c970e169bc2 | openssl -- alternate chains certificate forgery vulnerability
OpenSSL reports:
During certificate verification, OpenSSL (starting from version
1.0.1n and 1.0.2b) will attempt to find an alternative certificate
chain if the first attempt to build such a chain fails. An error
in the implementation of this logic can mean that an attacker could
cause certain checks on untrusted certificates to be bypassed,
such as the CA flag, enabling them to use a valid leaf certificate
to act as a CA and "issue" an invalid certificate.
Discovery 2015-07-09 Entry 2015-07-09 openssl
ge 1.0.2_2 lt 1.0.2_4
mingw32-openssl
ge 1.0.2b lt 1.0.2d
CVE-2015-1793
https://www.openssl.org/news/secadv_20150709.txt
|
077c2dca-8f9a-11db-ab33-000e0c2e438a | openssl -- Incorrect PKCS#1 v1.5 padding validation in crypto(3)
Problem Description
When verifying a PKCS#1 v1.5 signature, OpenSSL ignores any
bytes which follow the cryptographic hash being signed. In
a valid signature there will be no such bytes.
Impact
OpenSSL will incorrectly report some invalid signatures as
valid. When an RSA public exponent of 3 is used, or more
generally when a small public exponent is used with a
relatively large modulus (e.g., a public exponent of 17 with
a 4096-bit modulus), an attacker can construct a signature
which OpenSSL will accept as a valid PKCS#1 v1.5 signature.
Workaround
No workaround is available.
Discovery 2006-09-06 Entry 2006-12-19 Modified 2016-08-09 FreeBSD
ge 6.1 lt 6.1_6
ge 6.0 lt 6.0_11
ge 5.5 lt 5.5_4
ge 5.4 lt 5.4_18
ge 5.3 lt 5.3_33
< 4.11_21
openssl
gt 0.9.8 lt 0.9.8c_9
< 0.9.7k_0
CVE-2006-4339
SA-06:19.openssl
|
0b8d7194-ca88-11e3-9d8d-c80aa9043978 | OpenSSL -- Remote Data Injection / DoS
Applications that use SSL_MODE_RELEASE_BUFFERS, such as nginx, are
prone to a race condition which may allow a remote attacker to
inject random data into other connections.
Discovery 2010-02-09 Entry 2014-04-23 Modified 2016-08-09 openssl
ge 1.0.1 lt 1.0.1_11
mingw32-openssl
ge 1.0.1 le 1.0.1g
FreeBSD
ge 10.0 lt 10.0_2
https://rt.openssl.org/Ticket/Display.html?id=2167
http://www.tedunangst.com/flak/post/analysis-of-openssl-freelist-reuse
SA-14:09.openssl
CVE-2010-5298
|
0ca24682-3f03-11e6-b3c8-14dae9d210b8 | openssl -- denial of service
Mitre reports:
OpenSSL through 1.0.2h incorrectly uses pointer arithmetic
for heap-buffer boundary checks, which might allow remote attackers to
cause a denial of service (integer overflow and application crash) or
possibly have unspecified other impact by leveraging unexpected malloc
behavior, related to s3_srvr.c, ssl_sess.c, and t1_lib.c.
Discovery 2016-06-01 Entry 2016-06-30 openssl
< 1.0.2_14
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2177
ihttps://bugzilla.redhat.com/show_bug.cgi?id=1341705
https://www.openssl.org/blog/blog/2016/06/27/undefined-pointer-arithmetic/
CVE-2016-2177
|
0f37d765-c5d4-11db-9f82-000e0c2e438a | OpenSSL -- Multiple problems in crypto(3)
Problem Description:
Several problems have been found in OpenSSL:
- During the parsing of certain invalid ASN1 structures an
error condition is mishandled, possibly resulting in an
infinite loop.
- A buffer overflow exists in the SSL_get_shared_ciphers
function.
- A NULL pointer may be dereferenced in the SSL version 2
client code.
In addition, many applications using OpenSSL do not perform
any validation of the lengths of public keys being used.
Impact:
Servers which parse ASN1 data from untrusted sources may be
vulnerable to a denial of service attack.
An attacker accessing a server which uses SSL version 2 may
be able to execute arbitrary code with the privileges of that
server.
A malicious SSL server can cause clients connecting using
SSL version 2 to crash.
Applications which perform public key operations using
untrusted keys may be vulnerable to a denial of service
attack.
Workaround:
No workaround is available, but not all of the
vulnerabilities mentioned affect all applications.
Discovery 2006-09-28 Entry 2007-02-26 Modified 2016-08-09 openssl
< 0.9.7l_0
ge 0.9.8 lt 0.9.8d_0
FreeBSD
ge 6.1 lt 6.1_9
ge 6.0 lt 6.0_14
ge 5.5 lt 5.5_7
ge 5.4 lt 5.4_21
ge 5.3 lt 5.3_36
ge 4.11 lt 4.11_24
CVE-2006-2937
CVE-2006-2938
CVE-2006-2940
CVE-2006-3738
CVE-2006-4343
SA-06:23.openssl
|
0fcd3af0-a0fe-11e6-b1cf-14dae9d210b8 | FreeBSD -- OpenSSL Remote DoS vulnerability
Problem Description:
Due to improper handling of alert packets, OpenSSL would
consume an excessive amount of CPU time processing undefined
alert messages.
Impact:
A remote attacker who can initiate handshakes with an
OpenSSL based server can cause the server to consume a lot
of computation power with very little bandwidth usage, and
may be able to use this technique in a leveraged Denial of
Service attack.
Discovery 2016-11-02 Entry 2016-11-02 Modified 2017-02-22 FreeBSD
ge 10.3 lt 10.3_12
ge 10.2 lt 10.2_25
ge 10.1 lt 10.1_42
ge 9.3 lt 9.3_50
openssl
< 1.0.2i,1
openssl-devel
< 1.1.0a
linux-c6-openssl
< 1.0.1e_13
linux-c7-openssl-libs
< 1.0.1e_3
CVE-2016-8610
SA-16:35.openssl
http://seclists.org/oss-sec/2016/q4/224
|
10dee731-c069-11ee-9190-84a93843eb75 | OpenSSL -- Multiple vulnerabilities
The OpenSSL project reports:
Excessive time spent checking invalid RSA public keys (CVE-2023-6237)
PKCS12 Decoding crashes (CVE-2024-0727)
Discovery 2024-01-30 Entry 2024-01-31 openssl
< 3.0.13,1
openssl-quictls
< 3.0.13
openssl31
< 3.1.5
openssl31-quictls
< 3.1.5
openssl32
< 3.2.1
CVE-2024-0727
CVE-2023-6237
https://www.openssl.org/news/secadv/20240125.txt
https://www.openssl.org/news/secadv/20240115.txt
https://www.openssl.org/news/openssl-3.0-notes.html
https://www.openssl.org/news/openssl-3.1-notes.html
https://www.openssl.org/news/openssl-3.2-notes.html
|
1959e847-d4f0-11e3-84b0-0018fe623f2b | OpenSSL -- NULL pointer dereference / DoS
OpenBSD and David Ramos reports:
Applications that use SSL_MODE_RELEASE_BUFFERS, such as nginx/apache,
are prone to a race condition which may allow a remote attacker to
crash the current service.
Discovery 2014-05-02 Entry 2014-05-03 Modified 2016-08-09 openssl
ge 1.0.1 lt 1.0.1_12
FreeBSD
ge 10.0 lt 10.0_3
http://www.openwall.com/lists/oss-security/2014/05/02/5
https://rt.openssl.org/Ticket/Display.html?user=guest&pass=guest&id=3321
SA-14:10.openssl
CVE-2014-0198
|
1aaaa5c6-804d-11ec-8be6-d4c9ef517024 | OpenSSL -- BN_mod_exp incorrect results on MIPS
The OpenSSL project reports:
BN_mod_exp may produce incorrect results on MIPS (Moderate)
There is a carry propagation bug in the MIPS32 and MIPS64 squaring
procedure. Many EC algorithms are affected, including some of the
TLS 1.3 default curves. Impact was not analyzed in detail, because the
pre-requisites for attack are considered unlikely and include reusing
private keys. Analysis suggests that attacks against RSA and DSA as a
result of this defect would be very difficult to perform and are not
believed likely. Attacks against DH are considered just feasible
(although very difficult) because most of the work necessary to deduce
information about a private key may be performed offline. The amount
of resources required for such an attack would be significant.
However, for an attack on TLS to be meaningful, the server would have
to share the DH private key among multiple clients, which is no longer
an option since CVE-2016-0701.
Discovery 2022-01-28 Entry 2022-01-28 openssl
< 1.1.1m,1
openssl-devel
< 3.0.1
openssl-quictls
< 3.0.1
CVE-2021-4160
https://www.openssl.org/news/secadv/20220128.txt
|
1ba034fb-ca38-11ed-b242-d4c9ef517024 | OpenSSL -- Excessive Resource Usage Verifying X.509 Policy Constraints
The OpenSSL project reports:
Severity: Low
A security vulnerability has been identified in all supported versions
of OpenSSL related to the verification of X.509 certificate chains
that include policy constraints. Attackers may be able to exploit this
vulnerability by creating a malicious certificate chain that triggers
exponential use of computational resources, leading to a denial-of-service
(DoS) attack on affected systems.
Discovery 2023-03-23 Entry 2023-03-24 Modified 2023-07-19 openssl
< 1.1.1t,1_1
openssl30
< 3.0.8_1
openssl31
< 3.1.0_1
openssl-quic
< 3.0.8_1
virtualbox-ose
< 6.1.46
CVE-2023-0464
https://www.openssl.org/news/secadv/20230322.txt
|
1d56cfc5-3970-11eb-929d-d4c9ef517024 | OpenSSL -- NULL pointer de-reference
The OpenSSL project reports:
EDIPARTYNAME NULL pointer de-reference (High)
The X.509 GeneralName type is a generic type for representing
different types of names. One of those name types is known as
EDIPartyName. OpenSSL provides a function GENERAL_NAME_cmp which
compares different instances of a GENERAL_NAME to see if they
are equal or not. This function behaves incorrectly when both
GENERAL_NAMEs contain an EDIPARTYNAME. A NULL pointer
dereference and a crash may occur leading to a possible denial
of service attack.
Discovery 2020-12-08 Entry 2020-12-08 Modified 2020-12-15 openssl
ge 1.0.2,1 lt 1.1.1i,1
FreeBSD
ge 12.2 lt 12.2_2
ge 12.1 lt 12.1_12
ge 11.4 lt 11.4_6
https://www.openssl.org/news/secadv/20201208.txt
CVE-2020-1971
SA-20:33.openssl
|
2ecb7b20-d97e-11e0-b2e2-00215c6a37bb | OpenSSL -- multiple vulnerabilities
OpenSSL Team reports:
Two security flaws have been fixed in OpenSSL 1.0.0e
Under certain circumstances OpenSSL's internal certificate
verification routines can incorrectly accept a CRL whose
nextUpdate field is in the past. (CVE-2011-3207)
OpenSSL server code for ephemeral ECDH ciphersuites is not
thread-safe, and furthermore can crash if a client violates
the protocol by sending handshake messages in incorrect
order. (CVE-2011-3210)
Discovery 2011-09-06 Entry 2011-09-07 Modified 2014-04-10 openssl
ge 1.0.0 lt 1.0.0_6
ge 0.9.8 lt 1.0.0
linux-f10-openssl
ge 0.9.8 lt 0.9.8r
CVE-2011-3207
CVE-2011-3210
http://www.openssl.org/news/secadv_20110906.txt
|
3042c33a-f237-11df-9d02-0018fe623f2b | openssl -- TLS extension parsing race condition
OpenSSL Team reports:
Rob Hulswit has found a flaw in the OpenSSL TLS server extension
code parsing which on affected servers can be exploited in a buffer
overrun attack.
Any OpenSSL based TLS server is vulnerable if it is multi-threaded
and uses OpenSSL's internal caching mechanism. Servers that are
multi-process and/or disable internal session caching are NOT
affected.
In particular the Apache HTTP server (which never uses OpenSSL
internal caching) and Stunnel (which includes its own workaround)
are NOT affected.
Discovery 2010-10-08 Entry 2010-11-17 openssl
< 1.0.0_2
CVE-2010-3864
http://openssl.org/news/secadv_20101116.txt
|
3679fd10-c5d1-11e5-b85f-0018fe623f2b | openssl -- multiple vulnerabilities
OpenSSL project reports:
- Historically OpenSSL only ever generated DH parameters based on "safe"
primes. More recently (in version 1.0.2) support was provided for
generating X9.42 style parameter files such as those required for RFC 5114
support. The primes used in such files may not be "safe". Where an
application is using DH configured with parameters based on primes that are
not "safe" then an attacker could use this fact to find a peer's private
DH exponent. This attack requires that the attacker complete multiple
handshakes in which the peer uses the same private DH exponent. For example
this could be used to discover a TLS server's private DH exponent if it's
reusing the private DH exponent or it's using a static DH ciphersuite.
OpenSSL provides the option SSL_OP_SINGLE_DH_USE for ephemeral DH (DHE) in
TLS. It is not on by default. If the option is not set then the server
reuses the same private DH exponent for the life of the server process and
would be vulnerable to this attack. It is believed that many popular
applications do set this option and would therefore not be at risk.
(CVE-2016-0701)
- A malicious client can negotiate SSLv2 ciphers that have been disabled on
the server and complete SSLv2 handshakes even if all SSLv2 ciphers have
been disabled, provided that the SSLv2 protocol was not also disabled via
SSL_OP_NO_SSLv2.
(CVE-2015-3197)
Discovery 2016-01-22 Entry 2016-01-28 Modified 2016-08-09 openssl
< 1.0.2_7
mingw32-openssl
ge 1.0.1 lt 1.0.2f
FreeBSD
ge 10.2 lt 10.2_12
ge 10.1 lt 10.1_29
ge 9.3 lt 9.3_36
SA-16:11.openssl
CVE-2016-0701
CVE-2015-3197
https://www.openssl.org/news/secadv/20160128.txt
|
3bb451fc-db64-11e7-ac58-b499baebfeaf | OpenSSL -- multiple vulnerabilities
The OpenSSL project reports:
- Read/write after SSL object in error state (CVE-2017-3737)
OpenSSL 1.0.2 (starting from version 1.0.2b) introduced an "error
state" mechanism. The intent was that if a fatal error occurred
during a handshake then OpenSSL would move into the error state and
would immediately fail if you attempted to continue the handshake.
This works as designed for the explicit handshake functions
(SSL_do_handshake(), SSL_accept() and SSL_connect()), however due to
a bug it does not work correctly if SSL_read() or SSL_write() is
called directly. In that scenario, if the handshake fails then a
fatal error will be returned in the initial function call. If
SSL_read()/SSL_write() is subsequently called by the application for
the same SSL object then it will succeed and the data is passed
without being decrypted/encrypted directly from the SSL/TLS record
layer.
- rsaz_1024_mul_avx2 overflow bug on x86_64 (CVE-2017-3738)
There is an overflow bug in the AVX2 Montgomery multiplication
procedure used in exponentiation with 1024-bit moduli. No EC
algorithms are affected. Analysis suggests that attacks against
RSA and DSA as a result of this defect would be very difficult to
perform and are not believed likely. Attacks against DH1024 are
considered just feasible, because most of the work necessary to
deduce information about a private key may be performed offline.
The amount of resources required for such an attack would be
significant. However, for an attack on TLS to be meaningful, the
server would have to share the DH1024 private key among multiple
clients, which is no longer an option since CVE-2016-0701.
Discovery 2017-12-07 Entry 2017-12-07 openssl
gt 1.0.2 lt 1.0.2n
https://www.openssl.org/news/secadv/20171207.txt
CVE-2017-3737
CVE-2017-3738
|
425b9538-ce5f-11ed-ade3-d4c9ef517024 | OpenSSL -- Multiple vulnerabilities
The OpenSSL project reports:
Severity: low
Applications that use a non-default option when verifying certificates may be
vulnerable to an attack from a malicious CA to circumvent certain checks.
The function X509_VERIFY_PARAM_add0_policy() is documented to
implicitly enable the certificate policy check when doing certificate
verification. However the implementation of the function does not
enable the check which allows certificates with invalid or incorrect
policies to pass the certificate verification.
Discovery 2023-03-28 Entry 2023-03-29 openssl
< 1.1.1t,1_2
openssl30
< 3.0.8_2
openssl31
< 3.1.0_2
openssl-quic
< 3.0.8_2
CVE-2023-0465
CVE-2023-0466
https://www.openssl.org/news/secadv/20230328.txt
|
43eaa656-80bc-11e6-bf52-b499baebfeaf | OpenSSL -- multiple vulnerabilities
OpenSSL reports:
High: OCSP Status Request extension unbounded memory growth
SSL_peek() hang on empty record
SWEET32 Mitigation
OOB write in MDC2_Update()
Malformed SHA512 ticket DoS
OOB write in BN_bn2dec()
OOB read in TS_OBJ_print_bio()
Pointer arithmetic undefined behaviour
Constant time flag not preserved in DSA signing
DTLS buffered message DoS
DTLS replay protection DoS
Certificate message OOB reads
Excessive allocation of memory in tls_get_message_header()
Excessive allocation of memory in dtls1_preprocess_fragment()
NB: LibreSSL is only affected by CVE-2016-6304
Discovery 2016-09-22 Entry 2016-09-22 Modified 2016-10-11 openssl-devel
ge 1.1.0 lt 1.1.0_1
openssl
< 1.0.2i,1
linux-c6-openssl
< 1.0.1e_11
FreeBSD
ge 10.3 lt 10.3_8
ge 10.2 lt 10.2_21
ge 10.1 lt 10.1_38
ge 9.3 lt 9.3_46
https://www.openssl.org/news/secadv/20160922.txt
CVE-2016-6304
CVE-2016-6305
CVE-2016-2183
CVE-2016-6303
CVE-2016-6302
CVE-2016-2182
CVE-2016-2180
CVE-2016-2177
CVE-2016-2178
CVE-2016-2179
CVE-2016-2181
CVE-2016-6306
CVE-2016-6307
CVE-2016-6308
SA-16:26.openssl
|
4a4712ae-7299-11ee-85eb-84a93843eb75 | OpenSSL -- potential loss of confidentiality
SO-AND-SO reports:
Moderate severity: A bug has been identified in the processing
of key and initialisation vector (IV) lengths. This can lead to
potential truncation or overruns during the initialisation of
some symmetric ciphers.
Discovery 2023-10-24 Entry 2023-10-24 openssl
< 3.0.12,1
openssl31
< 3.1.4
openssl-quictls
< 3.0.12
CVE-2023-5363
https://www.openssl.org/news/secadv/20231024.txt
|
4c8d1d72-9b38-11e5-aece-d050996490d0 | openssl -- multiple vulnerabilities
OpenSSL project reports:
- BN_mod_exp may produce incorrect results on x86_64
(CVE-2015-3193)
- Certificate verify crash with missing PSS parameter
(CVE-2015-3194)
- X509_ATTRIBUTE memory leak (CVE-2015-3195)
- Race condition handling PSK identify hint
(CVE-2015-3196)
- Anon DH ServerKeyExchange with 0 p parameter
(CVE-2015-1794)
Discovery 2015-12-03 Entry 2015-12-05 Modified 2016-08-09 openssl
< 1.0.2_5
mingw32-openssl
ge 1.0.1 lt 1.0.2e
linux-c6-openssl
< 1.0.1e_7
FreeBSD
ge 10.2 lt 10.2_8
ge 10.1 lt 10.1_25
ge 9.3 lt 9.3_31
SA-15:26.openssl
CVE-2015-1794
CVE-2015-3193
CVE-2015-3194
CVE-2015-3195
CVE-2015-3196
https://www.openssl.org/news/secadv/20151203.txt
|
4e536c14-9791-11e4-977d-d050992ecde8 | OpenSSL -- multiple vulnerabilities
OpenSSL project reports:
DTLS segmentation fault in dtls1_get_record (CVE-2014-3571)
DTLS memory leak in dtls1_buffer_record (CVE-2015-0206)
no-ssl3 configuration sets method to NULL (CVE-2014-3569)
ECDHE silently downgrades to ECDH [Client] (CVE-2014-3572)
RSA silently downgrades to EXPORT_RSA [Client] (CVE-2015-0204)
DH client certificates accepted without verification [Server] (CVE-2015-0205)
Certificate fingerprints can be modified (CVE-2014-8275)
Bignum squaring may produce incorrect results (CVE-2014-3570)
Discovery 2015-01-08 Entry 2015-01-08 Modified 2016-08-09 openssl
ge 1.0.1 lt 1.0.1_17
mingw32-openssl
ge 1.0.1 lt 1.0.1k
linux-c6-openssl
< 1.0.1e_3
FreeBSD
ge 10.1 lt 10.1_4
ge 10.0 lt 10.0_16
ge 9.3 lt 9.3_8
ge 8.4 lt 8.4_22
SA-15:01.openssl
CVE-2014-3569
CVE-2014-3570
CVE-2014-3571
CVE-2014-3572
CVE-2014-8275
CVE-2015-0204
CVE-2015-0205
CVE-2015-0206
https://www.openssl.org/news/secadv_20150108.txt
|
4eeb93bf-f204-11ec-8fbd-d4c9ef517024 | OpenSSL -- Command injection vulnerability
The OpenSSL project reports:
Circumstances where the c_rehash script does not properly
sanitise shell metacharacters to prevent command injection were
found by code review.
Discovery 2022-06-21 Entry 2022-06-22 openssl
< 1.1.1p,1
openssl-devel
< 3.0.4
openssl-quictls
< 3.0.4
CVE-2022-2068
https://www.openssl.org/news/secadv/20220621.txt
|
5631ae98-be9e-11e3-b5e3-c80aa9043978 | OpenSSL -- Remote Information Disclosure
OpenSSL Reports:
A missing bounds check in the handling of the TLS heartbeat extension can be
used to reveal up to 64k of memory to a connected client or server.
Affected users should upgrade to OpenSSL 1.0.1g. Users unable to immediately
upgrade can alternatively recompile OpenSSL with -DOPENSSL_NO_HEARTBEATS.
The bug allows anyone on the Internet to read the memory of the
systems protected by the vulnerable versions of the OpenSSL software.
This compromises the secret keys used to identify the service
providers and to encrypt the traffic, the names and passwords of the
users and the actual content. This allows attackers to eavesdrop
communications, steal data directly from the services and users and
to impersonate services and users.
The code used to handle the Heartbeat Extension does not do
sufficient boundary checks on record length, which allows reading
beyond the actual payload.
Discovery 2014-04-07 Entry 2014-04-07 Modified 2014-04-11 openssl
ge 1.0.1 lt 1.0.1_10
mingw32-openssl
ge 1.0.1 lt 1.0.1g
FreeBSD
ge 10.0 lt 10.0_1
CVE-2014-0160
SA-14:06.openssl
https://www.openssl.org/news/secadv_20140407.txt
https://www.openssl.org/news/vulnerabilities.html#2014-0076
http://www.heartbleed.com
|
5a668ab3-8d86-11eb-b8d6-d4c9ef517024 | OpenSSL -- Multiple vulnerabilities
The OpenSSL project reports:
High: CA certificate check bypass with X509_V_FLAG_X509_STRICT
(CVE-2021-3450) The X509_V_FLAG_X509_STRICT flag enables
additional security checks of the certificates present in a
certificate chain. It is not set by default.
High: NULL pointer deref in signature_algorithms processing
(CVE-2021-3449) An OpenSSL TLS server may crash if sent a
maliciously crafted renegotiation ClientHello message from a client.
If a TLSv1.2 renegotiation ClientHello omits the
signature_algorithms extension (where it was present in the initial
ClientHello), but includes a signature_algorithms_cert extension
then a NULL pointer dereference will result, leading to a crash and
a denial of service attack.
Discovery 2021-03-25 Entry 2021-03-26 Modified 2021-04-07 openssl
< 1.1.1k,1
FreeBSD
ge 12.2 lt 12.2_5
https://www.openssl.org/news/secadv/20210325.txt
CVE-2021-3449
CVE-2021-3450
SA-21:07.openssl
|
5aaa257e-772d-11e3-a65a-3c970e169bc2 | openssl -- multiple vulnerabilities
OpenSSL development team reports:
Major changes between OpenSSL 1.0.1e and OpenSSL 1.0.1f [6 Jan 2014]:
- Fix for TLS record tampering bug [CVE-2013-4353]
- Fix for TLS version checking bug [CVE-2013-6449]
- Fix for DTLS retransmission bug [CVE-2013-6450]
Discovery 2014-01-06 Entry 2014-01-06 Modified 2016-08-09 openssl
< 1.0.1_9
SA-14:03.openssl
CVE-2013-4353
CVE-2013-6449
CVE-2013-6450
http://www.openssl.org/news/openssl-1.0.1-notes.html
|
5ac53801-ec2e-11e3-9cf3-3c970e169bc2 | OpenSSL -- multiple vulnerabilities
The OpenSSL Project reports:
An attacker using a carefully crafted handshake can force
the use of weak keying material in OpenSSL SSL/TLS clients
and servers. This can be exploited by a Man-in-the-middle
(MITM) attack where the attacker can decrypt and modify
traffic from the attacked client and server. [CVE-2014-0224]
By sending an invalid DTLS handshake to an OpenSSL DTLS
client the code can be made to recurse eventually crashing
in a DoS attack. [CVE-2014-0221]
A buffer overrun attack can be triggered by sending invalid
DTLS fragments to an OpenSSL DTLS client or server. This is
potentially exploitable to run arbitrary code on a vulnerable
client or server. [CVE-2014-0195]
OpenSSL TLS clients enabling anonymous ECDH ciphersuites are
subject to a denial of service attack. [CVE-2014-3470]
Discovery 2014-06-05 Entry 2014-06-05 openssl
ge 1.0.1 lt 1.0.1_13
mingw32-openssl
ge 1.0.1 lt 1.0.1h
FreeBSD
ge 8.0 lt 8.4_12
ge 9.1 lt 9.1_15
ge 9.2 lt 9.2_8
ge 10.0 lt 10.0_5
CVE-2014-0195
CVE-2014-0221
CVE-2014-0224
CVE-2014-3470
SA-14:14.openssl
http://www.openssl.org/news/secadv_20140605.txt
|
5c5f19ce-43af-11e1-89b4-001ec9578670 | OpenSSL -- DTLS Denial of Service
The OpenSSL Team reports:
A flaw in the fix to CVE-2011-4108 can be exploited in a
denial of service attack. Only DTLS applications using OpenSSL
1.0.0f and 0.9.8s are affected.
Discovery 2012-01-18 Entry 2012-01-20 openssl
< 1.0.0_9
CVE-2012-0050
http://www.openssl.org/news/secadv_20120118.txt
|
60e26a40-3b25-11da-9484-00123ffe8333 | openssl -- potential SSL 2.0 rollback
Vulnerability:
Such applications are affected if they use the option
SSL_OP_MSIE_SSLV2_RSA_PADDING. This option is implied by use of
SSL_OP_ALL, which is intended to work around various bugs in
third-party software that might prevent interoperability. The
SSL_OP_MSIE_SSLV2_RSA_PADDING option disables a verification step in
the SSL 2.0 server supposed to prevent active protocol-version
rollback attacks. With this verification step disabled, an attacker
acting as a "man in the middle" can force a client and a server to
negotiate the SSL 2.0 protocol even if these parties both support
SSL 3.0 or TLS 1.0. The SSL 2.0 protocol is known to have severe
cryptographic weaknesses and is supported as a fallback only.
Applications using neither SSL_OP_MSIE_SSLV2_RSA_PADDING nor
SSL_OP_ALL are not affected. Also, applications that disable
use of SSL 2.0 are not affected.
Discovery 2005-10-11 Entry 2005-10-12 Modified 2005-10-25 openssl
openssl-overwrite-base
le 0.9.7g
ge 0.9.8 le 0.9.8_1
ge 0.9.*_20050325 le 0.9.*_20051011
openssl-beta
openssl-beta-overwrite-base
le 0.9.8_1
ge 0.9.*_20050325 le 0.9.*_20051011
compat5x-alpha
compat5x-amd64
compat5x-i386
compat5x-sparc64
< 5.4.0.8
FreeBSD
< 4.10_19
ge 4.11 lt 4.11_13
ge 5.3 lt 5.3_23
ge 5.4 lt 5.4_8
SA-05:21.openssl
CVE-2005-2969
http://www.openssl.org/news/secadv_20051011.txt
|
60eb344e-6eb1-11e1-8ad7-00e0815b8da8 | OpenSSL -- CMS and S/MIME Bleichenbacher attack
The OpenSSL Team reports:
A weakness in the OpenSSL CMS and PKCS #7 code can be exploited
using Bleichenbacher's attack on PKCS #1 v1.5 RSA padding
also known as the million message attack (MMA).
Only users of CMS, PKCS #7, or S/MIME decryption operations are
affected. A successful attack needs on average 2^20 messages. In
practice only automated systems will be affected as humans will
not be willing to process this many messages.
SSL/TLS applications are *NOT* affected by this problem since
the SSL/TLS code does not use the PKCS#7 or CMS decryption
code.
Discovery 2012-03-12 Entry 2012-03-15 openssl
< 1.0.0_10
CVE-2012-0884
http://www.openssl.org/news/secadv_20120312.txt
|
648a432c-a71f-11ed-86e9-d4c9ef517024 | OpenSSL -- Multiple vulnerabilities
The OpenSSL project reports:
X.400 address type confusion in X.509 GeneralName (CVE-2023-0286) (High):
There is a type confusion vulnerability relating to X.400 address processing
inside an X.509 GeneralName. X.400 addresses were parsed as an ASN1_STRING but
the public structure definition for GENERAL_NAME incorrectly specified the type
of the x400Address field as ASN1_TYPE. This field is subsequently interpreted by
the OpenSSL function GENERAL_NAME_cmp as an ASN1_TYPE rather than an
ASN1_STRING.
Timing Oracle in RSA Decryption (CVE-2022-4304) (Moderate):
A timing based side channel exists in the OpenSSL RSA Decryption implementation
which could be sufficient to recover a plaintext across a network in a
Bleichenbacher style attack. To achieve a successful decryption an attacker
would have to be able to send a very large number of trial messages for
decryption. The vulnerability affects all RSA padding modes: PKCS#1 v1.5,
RSA-OEAP and RSASVE.
X.509 Name Constraints Read Buffer Overflow (CVE-2022-4203) (Moderate):
A read buffer overrun can be triggered in X.509 certificate verification,
specifically in name constraint checking. Note that this occurs
after certificate chain signature verification and requires either a
CA to have signed the malicious certificate or for the application to
continue certificate verification despite failure to construct a path
to a trusted issuer.
Use-after-free following BIO_new_NDEF (CVE-2023-0215) (Moderate):
The public API function BIO_new_NDEF is a helper function used for streaming
ASN.1 data via a BIO. It is primarily used internally to OpenSSL to support the
SMIME, CMS and PKCS7 streaming capabilities, but may also be called directly by
end user applications.
Double free after calling PEM_read_bio_ex (CVE-2022-4450) (Moderate):
The function PEM_read_bio_ex() reads a PEM file from a BIO and parses and
decodes the "name" (e.g. "CERTIFICATE"), any header data and the payload data.
If the function succeeds then the "name_out", "header" and "data" arguments are
populated with pointers to buffers containing the relevant decoded data. The
caller is responsible for freeing those buffers. It is possible to construct a
PEM file that results in 0 bytes of payload data. In this case PEM_read_bio_ex()
will return a failure code but will populate the header argument with a pointer
to a buffer that has already been freed. If the caller also frees this buffer
then a double free will occur. This will most likely lead to a crash. This
could be exploited by an attacker who has the ability to supply malicious PEM
files for parsing to achieve a denial of service attack.
Invalid pointer dereference in d2i_PKCS7 functions (CVE-2023-0216) (Moderate):
An invalid pointer dereference on read can be triggered when an
application tries to load malformed PKCS7 data with the
d2i_PKCS7(), d2i_PKCS7_bio() or d2i_PKCS7_fp() functions.
NULL dereference validating DSA public key (CVE-2023-0217) (Moderate):
An invalid pointer dereference on read can be triggered when an
application tries to check a malformed DSA public key by the
EVP_PKEY_public_check() function. This will most likely lead
to an application crash. This function can be called on public
keys supplied from untrusted sources which could allow an attacker
to cause a denial of service attack.
NULL dereference during PKCS7 data verification (CVE-2023-0401) (Moderate):
A NULL pointer can be dereferenced when signatures are being
verified on PKCS7 signed or signedAndEnveloped data. In case the hash
algorithm used for the signature is known to the OpenSSL library but
the implementation of the hash algorithm is not available the digest
initialization will fail. There is a missing check for the return
value from the initialization function which later leads to invalid
usage of the digest API most likely leading to a crash.
Discovery 2023-02-07 Entry 2023-02-07 openssl
< 1.1.1t,1
openssl-devel
< 3.0.8
openssl-quictls
< 3.0.8
CVE-2023-0286
CVE-2022-4304
CVE-2022-4203
CVE-2023-0215
CVE-2022-4450
CVE-2023-0216
CVE-2023-0401
https://www.openssl.org/news/secadv/20230207.txt
|
68233cba-7774-11d8-89ed-0020ed76ef5a | OpenSSL ChangeCipherSpec denial-of-service vulnerability
A remote attacker could cause an application using OpenSSL to
crash by performing a specially crafted SSL/TLS handshake.
Discovery 2004-03-17 Entry 2004-03-17 Modified 2004-05-05 openssl
openssl-beta
< 0.9.7d
FreeBSD
ge 4.0 lt 4.8_17
ge 4.9 lt 4.9_4
ge 5.0 lt 5.1_16
ge 5.2 lt 5.2.1_3
CVE-2004-0079
http://www.openssl.org/news/secadv_20040317.txt
SA-04:05.openssl
288574
9899
|
6f0529e2-2e82-11e6-b2ec-b499baebfeaf | OpenSSL -- vulnerability in DSA signing
The OpenSSL team reports:
Operations in the DSA signing algorithm should run in constant time
in order to avoid side channel attacks. A flaw in the OpenSSL DSA
implementation means that a non-constant time codepath is followed for
certain operations. This has been demonstrated through a cache-timing
attack to be sufficient for an attacker to recover the private DSA key.
Discovery 2016-06-09 Entry 2016-06-09 Modified 2016-12-20 openssl
< 1.0.2_13
libressl
< 2.2.9
ge 2.3.0 lt 2.3.6
libressl-devel
< 2.4.1
https://git.openssl.org/?p=openssl.git;a=commit;h=399944622df7bd81af62e67ea967c470534090e2
CVE-2016-2178
|
6f170cf2-e6b7-11e8-a9a8-b499baebfeaf | OpenSSL -- timing vulnerability
The OpenSSL project reports:
Microarchitecture timing vulnerability in ECC scalar
multiplication. Severity: Low
OpenSSL ECC scalar multiplication, used in e.g. ECDSA and ECDH, has
been shown to be vulnerable to a microarchitecture timing side channel
attack. An attacker with sufficient access to mount local timing
attacks during ECDSA signature generation could recover the private
key.
Discovery 2018-11-12 Entry 2018-11-12 openssl
< 1.0.2p_2
https://www.openssl.org/news/secadv/20181112.txt
CVE-2018-5407
|
7184f92e-8bb8-11e1-8d7b-003067b2972c | OpenSSL -- integer conversions result in memory corruption
OpenSSL security team reports:
A potentially exploitable vulnerability has been discovered in the OpenSSL
function asn1_d2i_read_bio.
Any application which uses BIO or FILE based functions to read untrusted DER
format data is vulnerable. Affected functions are of the form d2i_*_bio or
d2i_*_fp, for example d2i_X509_bio or d2i_PKCS12_fp.
Discovery 2012-04-19 Entry 2012-04-21 openssl
< 1.0.1_1
CVE-2012-2110
http://marc.info/?l=full-disclosure&m=133483221408243
http://www.openssl.org/news/secadv_20120419.txt
|
7700061f-34f7-11e9-b95c-b499baebfeaf | OpenSSL -- Padding oracle vulnerability
The OpenSSL project reports:
0-byte record padding oracle (CVE-2019-1559) (Moderate)
If an application encounters a fatal protocol error and then calls
SSL_shutdown() twice (once to send a close_notify, and once to receive
one) then OpenSSL can respond differently to the calling application if
a 0 byte record is received with invalid padding compared to if a 0 byte
record is received with an invalid MAC. If the application then behaves
differently based on that in a way that is detectable to the remote peer,
then this amounts to a padding oracle that could be used to decrypt data.
Discovery 2019-02-19 Entry 2019-02-20 Modified 2019-03-07 openssl
< 1.0.2r,1
linux-c6-openssl
< 1.0.1e_16
https://www.openssl.org/news/secadv/20190226.txt
CVE-2019-1559
|
78cc8a46-3e56-11e1-89b4-001ec9578670 | OpenSSL -- multiple vulnerabilities
The OpenSSL Team reports:
6 security flaws have been fixed in OpenSSL 1.0.0f:
If X509_V_FLAG_POLICY_CHECK is set in OpenSSL 0.9.8,
then a policy check failure can lead to a double-free.
OpenSSL prior to 1.0.0f and 0.9.8s failed to clear the
bytes used as block cipher padding in SSL 3.0 records.
As a result, in each record, up to 15 bytes of
uninitialized memory may be sent, encrypted, to the SSL
peer. This could include sensitive contents of
previously freed memory.
RFC 3779 data can be included in certificates, and if
it is malformed, may trigger an assertion failure.
This could be used in a denial-of-service attack.
Support for handshake restarts for server gated
cryptograpy (SGC) can be used in a denial-of-service
attack.
A malicious TLS client can send an invalid set of GOST
parameters which will cause the server to crash due to
lack of error checking. This could be used in a
denial-of-service attack.
Discovery 2012-01-04 Entry 2012-01-14 openssl
< 1.0.0_8
CVE-2011-4108
CVE-2011-4109
CVE-2011-4576
CVE-2011-4577
CVE-2011-4619
CVE-2012-0027
http://openssl.org/news/secadv_20120104.txt
|
7c217849-f7d7-11ee-a490-84a93843eb75 | OpenSSL -- Unbounded memory growth with session handling in TLSv1.3
The OpenSSL project reports:
Some non-default TLS server configurations can cause unbounded
memory growth when processing TLSv1.3 sessions
Discovery 2024-04-08 Entry 2024-04-11 openssl
< 3.0.13_3,1
openssl31
< 3.1.5_3
openssl32
< 3.2.1_2
openssl-quictls
< 3.0.13_3
openssl31-quictls
< 3.1.5_1
CVE-2024-2511
https://www.openssl.org/news/secadv/20240408.txt
|
7caebe30-d7f1-11e6-a9a5-b499baebfeaf | openssl -- timing attack vulnerability
Cesar Pereida Garcia reports:
The signing function in crypto/ecdsa/ecdsa_ossl.c in certain OpenSSL
versions and forks is vulnerable to timing attacks when signing with the
standardized elliptic curve P-256 despite featuring constant-time curve
operations and modular inversion. A software defect omits setting the
BN_FLG_CONSTTIME flag for nonces, failing to take a secure code path in
the BN_mod_inverse method and therefore resulting in a cache-timing attack
vulnerability.
A malicious user with local access can recover ECDSA P-256 private keys.
Discovery 2017-01-10 Entry 2017-01-11 Modified 2017-01-11 openssl
< 1.0.2
libressl
< 2.4.4_1
libressl-devel
< 2.5.0_1
http://seclists.org/oss-sec/2017/q1/52
CVE-2016-7056
|
7ccd4def-c1be-11e3-9d09-000c2980a9f3 | OpenSSL -- Local Information Disclosure
OpenSSL reports:
A flaw in the implementation of Montgomery Ladder Approach would
create a side-channel that leaks sensitive timing information.
A local attacker might be able to snoop a signing process and
might recover the signing key from it.
Discovery 2014-04-07 Entry 2014-04-11 openssl
ge 1.0.1 lt 1.0.1_10
mingw32-openssl
ge 1.0.1 lt 1.0.1g
FreeBSD
ge 8.3 lt 8.3_15
ge 8.4 lt 8.4_8
ge 9.1 lt 9.1_11
ge 9.2 lt 9.2_4
ge 10.0 lt 10.0_1
CVE-2014-0076
SA-14:06.openssl
https://www.openssl.org/news/vulnerabilities.html#2014-0076
|
82b55df8-4d5a-11de-8811-0030843d3802 | openssl -- denial of service in DTLS implementation
Secunia reports:
Some vulnerabilities have been reported in OpenSSL, which can be
exploited by malicious people to cause a DoS.
The library does not limit the number of buffered DTLS records with
a future epoch. This can be exploited to exhaust all available memory
via specially crafted DTLS packets.
An error when processing DTLS messages can be exploited to exhaust
all available memory by sending a large number of out of sequence
handshake messages.
Discovery 2009-05-18 Entry 2009-05-30 Modified 2014-04-10 openssl
ge 0.9.8 lt 0.9.8k_1
linux-f10-openssl
ge 0.9.8f lt 0.9.8m
CVE-2009-1378
CVE-2009-1377
http://secunia.com/advisories/35128/
|
8305e215-1080-11e5-8ba2-000c2980a9f3 | openssl -- multiple vulnerabilities
The OpenSSL team reports:
- Missing DHE man-in-the-middle protection (Logjam)
(CVE-2015-4000)
- Malformed ECParameters causes infinite loop (CVE-2015-1788)
- Exploitable out-of-bounds read in X509_cmp_time
(CVE-2015-1789)
- PKCS#7 crash with missing EnvelopedContent (CVE-2015-1790)
- CMS verify infinite loop with unknown hash function
(CVE-2015-1792)
- Race condition handling NewSessionTicket (CVE-2015-1791)
- Invalid free in DTLS (CVE-2014-8176)
Discovery 2015-06-11 Entry 2015-06-11 Modified 2016-08-09 openssl
< 1.0.2_2
mingw32-openssl
ge 1.0.1 lt 1.0.2b
linux-c6-openssl
< 1.0.1e_6
libressl
< 2.1.7
FreeBSD
ge 10.1 lt 10.1_12
ge 9.3 lt 9.3_16
ge 8.4 lt 8.4_30
CVE-2014-8176
CVE-2015-1788
CVE-2015-1789
CVE-2015-1790
CVE-2015-1791
CVE-2015-1792
CVE-2015-4000
SA-15:10.openssl
https://www.openssl.org/news/secadv_20150611.txt
|
8337251b-b07b-11ee-b0d7-84a93843eb75 | OpenSSL -- Vector register corruption on PowerPC
SO-AND-SO reports:
The POLY1305 MAC (message authentication code) implementation
contains a bug that might corrupt the internal state of applications running
on PowerPC CPU based platforms if the CPU provides vector instructions.
Discovery 2024-01-09 Entry 2024-01-11 openssl
< 3.0.12_2,1
openssl-quictls
< 3.0.12_2
openssl31
< 3.1.4_2
openssl31-quictls
< 3.1.4_2
openssl32
< 3.2.0_1
CVE-2023-6129
https://www.openssl.org/news/secadv/20240109.txt
|
8aff07eb-1dbd-11e4-b6ba-3c970e169bc2 | OpenSSL -- multiple vulnerabilities
The OpenSSL Project reports:
A flaw in OBJ_obj2txt may cause pretty printing functions
such as X509_name_oneline, X509_name_print_ex et al. to leak
some information from the stack. [CVE-2014-3508]
The issue affects OpenSSL clients and allows a malicious
server to crash the client with a null pointer dereference
(read) by specifying an SRP ciphersuite even though it was
not properly negotiated with the client. [CVE-2014-5139]
If a multithreaded client connects to a malicious server
using a resumed session and the server sends an ec point
format extension it could write up to 255 bytes to freed
memory. [CVE-2014-3509]
An attacker can force an error condition which causes
openssl to crash whilst processing DTLS packets due to
memory being freed twice. This can be exploited through
a Denial of Service attack. [CVE-2014-3505]
An attacker can force openssl to consume large amounts
of memory whilst processing DTLS handshake messages.
This can be exploited through a Denial of Service
attack. [CVE-2014-3506]
By sending carefully crafted DTLS packets an attacker
could cause openssl to leak memory. This can be exploited
through a Denial of Service attack. [CVE-2014-3507]
OpenSSL DTLS clients enabling anonymous (EC)DH
ciphersuites are subject to a denial of service attack.
A malicious server can crash the client with a null pointer
dereference (read) by specifying an anonymous (EC)DH
ciphersuite and sending carefully crafted handshake
messages. [CVE-2014-3510]
A flaw in the OpenSSL SSL/TLS server code causes the
server to negotiate TLS 1.0 instead of higher protocol
versions when the ClientHello message is badly
fragmented. This allows a man-in-the-middle attacker
to force a downgrade to TLS 1.0 even if both the server
and the client support a higher protocol version, by
modifying the client's TLS records. [CVE-2014-3511]
A malicious client or server can send invalid SRP
parameters and overrun an internal buffer. Only
applications which are explicitly set up for SRP
use are affected. [CVE-2014-3512]
Discovery 2014-08-06 Entry 2014-08-06 Modified 2016-08-09 openssl
ge 1.0.1 lt 1.0.1_14
mingw32-openssl
ge 1.0.1 lt 1.0.1i
FreeBSD
ge 8.4 lt 8.4_15
ge 9.1 lt 9.1_18
ge 9.2 lt 9.2_11
ge 9.3 lt 9.3_1
ge 10.0 lt 10.0_8
https://www.openssl.org/news/secadv_20140806.txt
SA-14:18.openssl
CVE-2014-3505
CVE-2014-3506
CVE-2014-3507
CVE-2014-3508
CVE-2014-3509
CVE-2014-3510
CVE-2014-3511
CVE-2014-3512
CVE-2014-5139
|
8f353420-4197-11e8-8777-b499baebfeaf | OpenSSL -- Cache timing vulnerability
The OpenSSL project reports:
The OpenSSL RSA Key generation algorithm has been shown to be
vulnerable to a cache timing side channel attack. An attacker
with sufficient access to mount cache timing attacks during the
RSA key generation process could recover the private key.
Discovery 2018-04-16 Entry 2018-04-16 openssl
< 1.0.2o_2,1
openssl-devel
< 1.1.0h_1
https://www.openssl.org/news/secadv/20180416.txt
CVE-2018-0737
|
91a337d8-83ed-11e6-bf52-b499baebfeaf | OpenSSL -- multiple vulnerabilities
OpenSSL reports:
Critical vulnerability in OpenSSL 1.1.0a
Fix Use After Free for large message sizes (CVE-2016-6309)
Moderate vulnerability in OpenSSL 1.0.2i
Missing CRL sanity check (CVE-2016-7052)
Discovery 2016-09-26 Entry 2016-09-26 Modified 2016-10-10 openssl
< 1.0.2j,1
openssl-devel
< 1.1.0b
libressl
< 2.4.3
libressl-devel
< 2.4.3
FreeBSD
ge 11.0 lt 11.0_1
https://www.openssl.org/news/secadv/20160926.txt
CVE-2016-6309
CVE-2016-7052
SA-16:27.openssl
|
96811d4a-04ec-11ec-9b84-d4c9ef517024 | OpenSSL -- multiple vulnerabilities
The OpenSSL project reports:
SM2 Decryption Buffer Overflow (CVE-2021-3711: High)
Read buffer overruns processing ASN.1 strings (CVE-2021-3712:
Moderate)
Discovery 2021-08-24 Entry 2021-08-24 Modified 2021-08-25 openssl
< 1.1.1l,1
openssl-devel
< 3.0.0.b3
FreeBSD
ge 13.0 lt 13.0_4
ge 12.2 lt 12.2_10
CVE-2021-3711
CVE-2021-3712
https://www.openssl.org/news/secadv/20210824.txt
SA-21:16.openssl
|
96a21236-707b-11eb-96d8-d4c9ef517024 | OpenSSL -- Multiple vulnerabilities
The OpenSSL project reports:
Null pointer deref in X509_issuer_and_serial_hash()
CVE-2021-23841 (Moderate) The OpenSSL public API function
X509_issuer_and_serial_hash() attempts to create a unique hash
value based on the issuer and serial number data contained within
an X509 certificate. However it fails to correctly handle any errors
that may occur while parsing the issuer field (which might occur if
the issuer field is maliciously constructed). This may subsequently
result in a NULL pointer deref and a crash leading to a potential
denial of service attack.
Integer overflow in CipherUpdate CVE-2021-23840 (Low)
Calls to EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate
may overflow the output length argument in some cases where the
input length is close to the maximum permissable length for an
integer on the platform. In such cases the return value from the
function call will be 1 (indicating success), but the output length
value will be negative. This could cause applications to behave
incorrectly or crash.
Discovery 2021-02-16 Entry 2021-02-16 Modified 2021-08-25 openssl
< 1.1.1j,1
openssl-devel
< 3.0.0.a12
FreeBSD
ge 12.2 lt 12.2_10
ge 11.4 lt 11.4_13
https://www.openssl.org/news/secadv/20210216.txt
CVE-2021-23841
CVE-2021-23840
CVE-2021-23839
SA-21:17.openssl
|
9d15355b-ce7c-11e4-9db0-d050992ecde8 | OpenSSL -- multiple vulnerabilities
OpenSSL project reports:
- Reclassified: RSA silently downgrades to EXPORT_RSA
[Client] (CVE-2015-0204). OpenSSL only.
- Segmentation fault in ASN1_TYPE_cmp (CVE-2015-0286)
- ASN.1 structure reuse memory corruption (CVE-2015-0287)
- PKCS#7 NULL pointer dereferences (CVE-2015-0289)
- Base64 decode (CVE-2015-0292). OpenSSL only.
- DoS via reachable assert in SSLv2 servers
(CVE-2015-0293). OpenSSL only.
- Use After Free following d2i_ECPrivatekey error
(CVE-2015-0209)
- X509_to_X509_REQ NULL pointer deref (CVE-2015-0288)
Discovery 2015-03-19 Entry 2015-03-19 Modified 2016-08-09 openssl
ge 1.0.1 lt 1.0.1_19
mingw32-openssl
ge 1.0.1 lt 1.0.1m
linux-c6-openssl
< 1.0.1e_4
libressl
le 2.1.5_1
FreeBSD
ge 10.1 lt 10.1_8
ge 9.3 lt 9.3_12
ge 8.4 lt 8.4_26
SA-15:06.openssl
ports/198681
CVE-2015-0204
CVE-2015-0286
CVE-2015-0287
CVE-2015-0289
CVE-2015-0292
CVE-2015-0293
CVE-2015-0209
CVE-2015-0288
https://www.openssl.org/news/secadv_20150319.txt
|
9e0c6f7a-d46d-11e9-a1c7-b499baebfeaf | OpenSSL -- Multiple vulnerabilities
The OpenSSL project reports:
ECDSA remote timing attack (CVE-2019-1547) [Low]
Fork Protection (CVE-2019-1549) [Low]
(OpenSSL 1.1.1 only)
Discovery 2019-09-10 Entry 2019-09-11 openssl
< 1.0.2t,1
openssl111
< 1.1.1d
https://www.openssl.org/news/secadv/20190910.txt
CVE-2019-1547
CVE-2019-1549
|
a28e8b7e-fc70-11ec-856e-d4c9ef517024 | OpenSSL -- AES OCB fails to encrypt some bytes
The OpenSSL project reports:
AES OCB mode for 32-bit x86 platforms using the AES-NI assembly optimised
implementation will not encrypt the entirety of the data under some
circumstances. This could reveal sixteen bytes of data that was
preexisting in the memory that wasn't written. In the special case of
"in place" encryption, sixteen bytes of the plaintext would be revealed.
Discovery 2022-07-05 Entry 2022-07-05 openssl
< 1.1.1q,1
openssl-devel
< 3.0.5
CVE-2022-2097
https://www.openssl.org/news/secadv/20220705.txt
|
a5956603-7e4f-11ee-9df6-84a93843eb75 | OpenSSL -- DoS in DH generation
The OpenSSL project reports:
Excessive time spent in DH check / generation with large Q
parameter value (low).
Generating excessively long X9.42 DH keys or checking
excessively long X9.42 DH keys or parameters may be very slow.
Discovery 2023-11-08 Entry 2023-11-08 openssl
< 3.0.12_1,1
openssl111
< 1.1.1w_1
openssl31
< 3.1.4_1
openssl-quictls
< 3.0.12_1
openssl31-quictls
< 3.1.4_1
CVE-2023-5678
https://www.openssl.org/news/secadv/20231106.txt
|
b7cff5a9-31cc-11e8-8f07-b499baebfeaf | OpenSSL -- multiple vulnerabilities
The OpenSSL project reports:
- Constructed ASN.1 types with a recursive definition could
exceed the stack (CVE-2018-0739)
Constructed ASN.1 types with a recursive definition (such as can be
found in PKCS7) could eventually exceed the stack given malicious input
with excessive recursion. This could result in a Denial Of Service
attack. There are no such structures used within SSL/TLS that come from
untrusted sources so this is considered safe.
- rsaz_1024_mul_avx2 overflow bug on x86_64 (CVE-2017-3738)
There is an overflow bug in the AVX2 Montgomery multiplication
procedure used in exponentiation with 1024-bit moduli. This only
affects processors that support the AVX2 but not ADX extensions
like Intel Haswell (4th generation).
Discovery 2018-03-27 Entry 2018-03-27 openssl
< 1.0.2o,1
openssl-devel
< 1.1.0h
https://www.openssl.org/news/secadv/20180327.txt
CVE-2018-0739
CVE-2017-3738
|
bad6588e-2fe0-11ee-a0d1-84a93843eb75 | OpenSSL -- Excessive time spent checking DH q parameter value
The OpenSSL project reports:
Checking excessively long DH keys or parameters may be very slow
(severity: Low).
Discovery 2023-07-31 Entry 2023-07-31 openssl
< 1.1.1u_1,1
openssl30
< 3.0.9_2
openssl31
< 3.1.1_2
CVE-2023-3817
https://www.openssl.org/news/secadv/20230731.txt
|
c82ecac5-6e3f-11e8-8777-b499baebfeaf | OpenSSL -- Client DoS due to large DH parameter
The OpenSSL project reports:
During key agreement in a TLS handshake using a DH(E) based
ciphersuite a malicious server can send a very large prime value
to the client. This will cause the client to spend an unreasonably
long period of time generating a key for this prime resulting in a
hang until the client has finished. This could be exploited in a
Denial Of Service attack.
Discovery 2018-06-12 Entry 2018-06-12 Modified 2018-07-24 libressl
libressl-devel
< 2.6.5
ge 2.7.0 lt 2.7.4
openssl
< 1.0.2o_4,1
openssl-devel
< 1.1.0h_2
https://www.openssl.org/news/secadv/20180612.txt
CVE-2018-0732
|
d455708a-e3d3-11e6-9940-b499baebfeaf | OpenSSL -- multiple vulnerabilities
The OpenSSL project reports:
- Truncated packet could crash via OOB read (CVE-2017-3731)
- Bad (EC)DHE parameters cause a client crash (CVE-2017-3730)
- BN_mod_exp may produce incorrect results on x86_64 (CVE-2017-3732)
- Montgomery multiplication may produce incorrect results (CVE-2016-7055)
Discovery 2017-01-26 Entry 2017-01-26 Modified 2017-05-26 openssl
< 1.0.2k,1
openssl-devel
< 1.1.0d
linux-c6-openssl
< 1.0.1e_13
linux-c7-openssl-libs
< 1.0.1e_3
FreeBSD
ge 11.0 lt 11.0_8
ge 10.3 lt 10.3_17
https://www.openssl.org/news/secadv/20170126.txt
CVE-2016-7055
CVE-2017-3730
CVE-2017-3731
CVE-2017-3732
SA-17:02.openssl
|
d778ddb0-2338-11ea-a1c7-b499baebfeaf | OpenSSL -- Overflow vulnerability
The OpenSSL project reports:
rsaz_512_sqr overflow bug on x86_64 (CVE-2019-1551) (Low)
There is an overflow bug in the x64_64 Montgomery squaring procedure
used in exponentiation with 512-bit moduli. No EC algorithms are
affected. Analysis suggests that attacks against 2-prime RSA1024,
3-prime RSA1536, and DSA1024 as a result of this defect would be very
difficult to perform and are not believed likely. Attacks against
DH512 are considered just feasible. However, for an attack the target
would have to re-use the DH512 private key, which is not recommended
anyway. Also applications directly using the low level API BN_mod_exp
may be affected if they use BN_FLG_CONSTTIME.
Discovery 2019-12-06 Entry 2019-12-20 openssl
< 1.0.2u,1
https://www.openssl.org/news/secadv/20191206.txt
CVE-2019-1551
|
dba5d1c9-9f29-11e1-b511-003067c2616f | OpenSSL -- DTLS and TLS 1.1, 1.2 denial of service
OpenSSL security team reports:
A flaw in the OpenSSL handling of CBC mode ciphersuites in TLS 1.1, 1.2 and
DTLS can be exploited in a denial of service attack on both clients and
servers.
Discovery 2012-05-10 Entry 2012-05-10 openssl
< 1.0.1_2
CVE-2012-2333
http://www.openssl.org/news/secadv_20120510.txt
|
ea05c456-a4fd-11ec-90de-1c697aa5a594 | OpenSSL -- Infinite loop in BN_mod_sqrt parsing certificates
The OpenSSL project reports:
Infinite loop in BN_mod_sqrt() reachable when parsing certificates
(High)
The BN_mod_sqrt() function, which computes a modular square root,
contains a bug that can cause it to loop forever for non-prime
moduli.
Internally this function is used when parsing certificates that
contain elliptic curve public keys in compressed form or explicit
elliptic curve parameters with a base point encoded in compressed
form.
It is possible to trigger the infinite loop by crafting a
certificate that has invalid explicit curve parameters.
Since certificate parsing happens prior to verification of the
certificate signature, any process that parses an externally
supplied certificate may thus be subject to a denial of service
attack. The infinite loop can also be reached when parsing crafted
private keys as they can contain explicit elliptic curve
parameters.
Thus vulnerable situations include:
- TLS clients consuming server certificates
- TLS servers consuming client certificates
- Hosting providers taking certificates or private keys from
customers
- Certificate authorities parsing certification requests from
subscribers
- Anything else which parses ASN.1 elliptic curve parameters
Also any other applications that use the BN_mod_sqrt() where the
attacker can control the parameter values are vulnerable to this DoS
issue.
Discovery 2022-03-15 Entry 2022-03-16 Modified 2022-03-16 openssl
< 1.1.1n,1
openssl-devel
< 3.0.2
openssl-quictls
< 3.0.2
libressl
< 3.4.3
libressl-devel
< 3.5.1
FreeBSD
ge 13.0 lt 13.0_8
ge 12.3 lt 12.3_3
ge 12.2 lt 12.2_14
CVE-2022-0778
https://www.openssl.org/news/secadv/20220315.txt
SA-22:03.openssl
|
eb9a3c57-ff9e-11ed-a0d1-84a93843eb75 | OpenSSL -- Possible DoS translating ASN.1 identifiers
The OpenSSL project reports:
Severity: Moderate. Processing some specially crafted ASN.1
object identifiers or data containing them may be very slow.
Discovery 2023-05-30 Entry 2023-05-31 openssl
< 1.1.1u,1
openssl30
< 3.0.9
openssl31
< 3.1.1
openssl-quictls
< 3.0.9
CVE-2023-2650
https://www.openssl.org/news/secadv/20230530.txt
|
f40f07aa-c00f-11e7-ac58-b499baebfeaf | OpenSSL -- Multiple vulnerabilities
The OpenSSL project reports:
bn_sqrx8x_internal carry bug on x86_64 (CVE-2017-3736)
Severity: Moderate
There is a carry propagating bug in the x86_64 Montgomery squaring
procedure. No EC algorithms are affected. Analysis suggests that
attacks against RSA and DSA as a result of this defect would be
very difficult to perform and are not believed likely. Attacks
against DH are considered just feasible (although very difficult)
because most of the work necessary to deduce information about a
private key may be performed offline.
Malformed X.509 IPAddressFamily could cause OOB read (CVE-2017-3735)
Severity: Low
This issue was previously announced in security advisory
https://www.openssl.org/news/secadv/20170828.txt, but the fix has
not previously been included in a release due to its low severity.
Discovery 2017-11-02 Entry 2017-11-02 openssl
< 1.0.2m,1
openssl-devel
< 1.1.0g
https://www.openssl.org/news/secadv/20171102.txt
CVE-2017-3735
CVE-2017-3736
|
fceb2b08-cb76-11ec-a06f-d4c9ef517024 | OpenSSL -- Multiple vulnerabilities
The OpenSSL project reports:
- The c_rehash script allows command injection (CVE-2022-1292)
(Moderate)
The c_rehash script does not properly sanitise shell
metacharacters to prevent command injection. This script is distributed
by some operating systems in a manner where it is automatically
executed. On such operating systems, an attacker could execute arbitrary
commands with the privileges of the script.
- OCSP_basic_verify may incorrectly verify the response signing
certificate (CVE-2022-1343) (Moderate)
The function
`OCSP_basic_verify` verifies the signer certificate on an OCSP response.
In the case where the (non-default) flag OCSP_NOCHECKS is used then the
response will be positive (meaning a successful verification) even in
the case where the response signing certificate fails to verify.
- Incorrect MAC key used in the RC4-MD5 ciphersuite (CVE-2022-1434)
(Low)
The OpenSSL 3.0 implementation of the RC4-MD5 ciphersuite
incorrectly uses the AAD data as the MAC key. This makes the MAC key
trivially predictable.
- Resource leakage when decoding certificates and keys (CVE-2022-1473)
(Low)
The OPENSSL_LH_flush() function, which empties a hash table,
containsa bug that breaks reuse of the memory occuppied by the removed
hash table entries.
Discovery 2022-05-03 Entry 2022-05-04 Modified 2022-05-05 openssl
< 1.1.1o,1
openssl-devel
< 3.0.3
openssl-quictls
< 3.0.3
CVE-2022-1292
CVE-2022-1343
CVE-2022-1434
CVE-2022-1473
https://www.openssl.org/news/secadv/20220503.txt
|