VuXML ID | Description |
fceb2b08-cb76-11ec-a06f-d4c9ef517024 | OpenSSL -- Multiple vulnerabilities
The OpenSSL project reports:
- The c_rehash script allows command injection (CVE-2022-1292)
(Moderate)
The c_rehash script does not properly sanitise shell
metacharacters to prevent command injection. This script is distributed
by some operating systems in a manner where it is automatically
executed. On such operating systems, an attacker could execute arbitrary
commands with the privileges of the script.
- OCSP_basic_verify may incorrectly verify the response signing
certificate (CVE-2022-1343) (Moderate)
The function
`OCSP_basic_verify` verifies the signer certificate on an OCSP response.
In the case where the (non-default) flag OCSP_NOCHECKS is used then the
response will be positive (meaning a successful verification) even in
the case where the response signing certificate fails to verify.
- Incorrect MAC key used in the RC4-MD5 ciphersuite (CVE-2022-1434)
(Low)
The OpenSSL 3.0 implementation of the RC4-MD5 ciphersuite
incorrectly uses the AAD data as the MAC key. This makes the MAC key
trivially predictable.
- Resource leakage when decoding certificates and keys (CVE-2022-1473)
(Low)
The OPENSSL_LH_flush() function, which empties a hash table,
containsa bug that breaks reuse of the memory occuppied by the removed
hash table entries.
Discovery 2022-05-03 Entry 2022-05-04 Modified 2022-05-05 openssl
< 1.1.1o,1
openssl-devel
< 3.0.3
openssl-quictls
< 3.0.3
CVE-2022-1292
CVE-2022-1343
CVE-2022-1434
CVE-2022-1473
https://www.openssl.org/news/secadv/20220503.txt
|
0844671c-5a09-11ed-856e-d4c9ef517024 | OpenSSL -- Buffer overflows in Email verification
The OpenSSL project reports:
X.509 Email Address 4-byte Buffer Overflow (CVE-2022-3602) (High):
A buffer overrun can be triggered in X.509 certificate verification,
specifically in name constraint checking.
X.509 Email Address Variable Length Buffer Overflow (CVE-2022-3786)
(High): A buffer overrun can be triggered in X.509 certificate
verification, specifically in name constraint checking.
Discovery 2022-11-01 Entry 2022-11-01 openssl-devel
< 3.0.7
CVE-2022-3602
CVE-2022-3786
https://www.openssl.org/news/secadv/20221101.txt
|
91a337d8-83ed-11e6-bf52-b499baebfeaf | OpenSSL -- multiple vulnerabilities
OpenSSL reports:
Critical vulnerability in OpenSSL 1.1.0a
Fix Use After Free for large message sizes (CVE-2016-6309)
Moderate vulnerability in OpenSSL 1.0.2i
Missing CRL sanity check (CVE-2016-7052)
Discovery 2016-09-26 Entry 2016-09-26 Modified 2016-10-10 openssl
< 1.0.2j,1
openssl-devel
< 1.1.0b
libressl
< 2.4.3
libressl-devel
< 2.4.3
FreeBSD
ge 11.0 lt 11.0_1
https://www.openssl.org/news/secadv/20160926.txt
CVE-2016-6309
CVE-2016-7052
SA-16:27.openssl
|
648a432c-a71f-11ed-86e9-d4c9ef517024 | OpenSSL -- Multiple vulnerabilities
The OpenSSL project reports:
X.400 address type confusion in X.509 GeneralName (CVE-2023-0286) (High):
There is a type confusion vulnerability relating to X.400 address processing
inside an X.509 GeneralName. X.400 addresses were parsed as an ASN1_STRING but
the public structure definition for GENERAL_NAME incorrectly specified the type
of the x400Address field as ASN1_TYPE. This field is subsequently interpreted by
the OpenSSL function GENERAL_NAME_cmp as an ASN1_TYPE rather than an
ASN1_STRING.
Timing Oracle in RSA Decryption (CVE-2022-4304) (Moderate):
A timing based side channel exists in the OpenSSL RSA Decryption implementation
which could be sufficient to recover a plaintext across a network in a
Bleichenbacher style attack. To achieve a successful decryption an attacker
would have to be able to send a very large number of trial messages for
decryption. The vulnerability affects all RSA padding modes: PKCS#1 v1.5,
RSA-OEAP and RSASVE.
X.509 Name Constraints Read Buffer Overflow (CVE-2022-4203) (Moderate):
A read buffer overrun can be triggered in X.509 certificate verification,
specifically in name constraint checking. Note that this occurs
after certificate chain signature verification and requires either a
CA to have signed the malicious certificate or for the application to
continue certificate verification despite failure to construct a path
to a trusted issuer.
Use-after-free following BIO_new_NDEF (CVE-2023-0215) (Moderate):
The public API function BIO_new_NDEF is a helper function used for streaming
ASN.1 data via a BIO. It is primarily used internally to OpenSSL to support the
SMIME, CMS and PKCS7 streaming capabilities, but may also be called directly by
end user applications.
Double free after calling PEM_read_bio_ex (CVE-2022-4450) (Moderate):
The function PEM_read_bio_ex() reads a PEM file from a BIO and parses and
decodes the "name" (e.g. "CERTIFICATE"), any header data and the payload data.
If the function succeeds then the "name_out", "header" and "data" arguments are
populated with pointers to buffers containing the relevant decoded data. The
caller is responsible for freeing those buffers. It is possible to construct a
PEM file that results in 0 bytes of payload data. In this case PEM_read_bio_ex()
will return a failure code but will populate the header argument with a pointer
to a buffer that has already been freed. If the caller also frees this buffer
then a double free will occur. This will most likely lead to a crash. This
could be exploited by an attacker who has the ability to supply malicious PEM
files for parsing to achieve a denial of service attack.
Invalid pointer dereference in d2i_PKCS7 functions (CVE-2023-0216) (Moderate):
An invalid pointer dereference on read can be triggered when an
application tries to load malformed PKCS7 data with the
d2i_PKCS7(), d2i_PKCS7_bio() or d2i_PKCS7_fp() functions.
NULL dereference validating DSA public key (CVE-2023-0217) (Moderate):
An invalid pointer dereference on read can be triggered when an
application tries to check a malformed DSA public key by the
EVP_PKEY_public_check() function. This will most likely lead
to an application crash. This function can be called on public
keys supplied from untrusted sources which could allow an attacker
to cause a denial of service attack.
NULL dereference during PKCS7 data verification (CVE-2023-0401) (Moderate):
A NULL pointer can be dereferenced when signatures are being
verified on PKCS7 signed or signedAndEnveloped data. In case the hash
algorithm used for the signature is known to the OpenSSL library but
the implementation of the hash algorithm is not available the digest
initialization will fail. There is a missing check for the return
value from the initialization function which later leads to invalid
usage of the digest API most likely leading to a crash.
Discovery 2023-02-07 Entry 2023-02-07 openssl
< 1.1.1t,1
openssl-devel
< 3.0.8
openssl-quictls
< 3.0.8
CVE-2023-0286
CVE-2022-4304
CVE-2022-4203
CVE-2023-0215
CVE-2022-4450
CVE-2023-0216
CVE-2023-0401
https://www.openssl.org/news/secadv/20230207.txt
|
50751310-a763-11e6-a881-b499baebfeaf | openssl -- multiple vulnerabilities
OpenSSL reports:
- ChaCha20/Poly1305 heap-buffer-overflow (CVE-2016-7054)
Severity: High
TLS connections using *-CHACHA20-POLY1305 ciphersuites are susceptible to a DoS
attack by corrupting larger payloads. This can result in an OpenSSL crash. This
issue is not considered to be exploitable beyond a DoS.
- CMS Null dereference (CVE-2016-7053)
Severity: Medium
Applications parsing invalid CMS structures can crash with a NULL pointer
dereference. This is caused by a bug in the handling of the ASN.1 CHOICE type
in OpenSSL 1.1.0 which can result in a NULL value being passed to the structure
callback if an attempt is made to free certain invalid encodings. Only CHOICE
structures using a callback which do not handle NULL value are affected.
- Montgomery multiplication may produce incorrect results (CVE-2016-7055)i
Severity: Low
There is a carry propagating bug in the Broadwell-specific Montgomery
multiplication procedure that handles input lengths divisible by, but
longer than 256 bits.
Discovery 2016-11-10 Entry 2016-11-10 Modified 2016-11-11 openssl-devel
< 1.1.0c
https://www.openssl.org/news/secadv/20161110.txt
CVE-2016-7054
CVE-2016-7053
CVE-2016-7055
|
4eeb93bf-f204-11ec-8fbd-d4c9ef517024 | OpenSSL -- Command injection vulnerability
The OpenSSL project reports:
Circumstances where the c_rehash script does not properly
sanitise shell metacharacters to prevent command injection were
found by code review.
Discovery 2022-06-21 Entry 2022-06-22 openssl
< 1.1.1p,1
openssl-devel
< 3.0.4
openssl-quictls
< 3.0.4
CVE-2022-2068
https://www.openssl.org/news/secadv/20220621.txt
|
96811d4a-04ec-11ec-9b84-d4c9ef517024 | OpenSSL -- multiple vulnerabilities
The OpenSSL project reports:
SM2 Decryption Buffer Overflow (CVE-2021-3711: High)
Read buffer overruns processing ASN.1 strings (CVE-2021-3712:
Moderate)
Discovery 2021-08-24 Entry 2021-08-24 Modified 2021-08-25 openssl
< 1.1.1l,1
openssl-devel
< 3.0.0.b3
FreeBSD
ge 13.0 lt 13.0_4
ge 12.2 lt 12.2_10
CVE-2021-3711
CVE-2021-3712
https://www.openssl.org/news/secadv/20210824.txt
SA-21:16.openssl
|
d455708a-e3d3-11e6-9940-b499baebfeaf | OpenSSL -- multiple vulnerabilities
The OpenSSL project reports:
- Truncated packet could crash via OOB read (CVE-2017-3731)
- Bad (EC)DHE parameters cause a client crash (CVE-2017-3730)
- BN_mod_exp may produce incorrect results on x86_64 (CVE-2017-3732)
- Montgomery multiplication may produce incorrect results (CVE-2016-7055)
Discovery 2017-01-26 Entry 2017-01-26 Modified 2017-05-26 openssl
< 1.0.2k,1
openssl-devel
< 1.1.0d
linux-c6-openssl
< 1.0.1e_13
linux-c7-openssl-libs
< 1.0.1e_3
FreeBSD
ge 11.0 lt 11.0_8
ge 10.3 lt 10.3_17
https://www.openssl.org/news/secadv/20170126.txt
CVE-2016-7055
CVE-2017-3730
CVE-2017-3731
CVE-2017-3732
SA-17:02.openssl
|
1a802ba9-f444-11e6-9940-b499baebfeaf | openssl -- crash on handshake
The OpenSSL project reports:
Severity: High
During a renegotiation handshake if the Encrypt-Then-Mac
extension is negotiated where it was not in the original
handshake (or vice-versa) then this can cause OpenSSL to
crash (dependent on ciphersuite). Both clients and servers
are affected.
This issue does not affect OpenSSL version 1.0.2.
Discovery 2017-02-16 Entry 2017-02-16 openssl-devel
< 1.1.0e
https://www.openssl.org/news/secadv/20170216.txt
CVE-2017-3733
|
96a21236-707b-11eb-96d8-d4c9ef517024 | OpenSSL -- Multiple vulnerabilities
The OpenSSL project reports:
Null pointer deref in X509_issuer_and_serial_hash()
CVE-2021-23841 (Moderate) The OpenSSL public API function
X509_issuer_and_serial_hash() attempts to create a unique hash
value based on the issuer and serial number data contained within
an X509 certificate. However it fails to correctly handle any errors
that may occur while parsing the issuer field (which might occur if
the issuer field is maliciously constructed). This may subsequently
result in a NULL pointer deref and a crash leading to a potential
denial of service attack.
Integer overflow in CipherUpdate CVE-2021-23840 (Low)
Calls to EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate
may overflow the output length argument in some cases where the
input length is close to the maximum permissable length for an
integer on the platform. In such cases the return value from the
function call will be 1 (indicating success), but the output length
value will be negative. This could cause applications to behave
incorrectly or crash.
Discovery 2021-02-16 Entry 2021-02-16 Modified 2021-08-25 openssl
< 1.1.1j,1
openssl-devel
< 3.0.0.a12
FreeBSD
ge 12.2 lt 12.2_10
ge 11.4 lt 11.4_13
https://www.openssl.org/news/secadv/20210216.txt
CVE-2021-23841
CVE-2021-23840
CVE-2021-23839
SA-21:17.openssl
|
ea05c456-a4fd-11ec-90de-1c697aa5a594 | OpenSSL -- Infinite loop in BN_mod_sqrt parsing certificates
The OpenSSL project reports:
Infinite loop in BN_mod_sqrt() reachable when parsing certificates
(High)
The BN_mod_sqrt() function, which computes a modular square root,
contains a bug that can cause it to loop forever for non-prime
moduli.
Internally this function is used when parsing certificates that
contain elliptic curve public keys in compressed form or explicit
elliptic curve parameters with a base point encoded in compressed
form.
It is possible to trigger the infinite loop by crafting a
certificate that has invalid explicit curve parameters.
Since certificate parsing happens prior to verification of the
certificate signature, any process that parses an externally
supplied certificate may thus be subject to a denial of service
attack. The infinite loop can also be reached when parsing crafted
private keys as they can contain explicit elliptic curve
parameters.
Thus vulnerable situations include:
- TLS clients consuming server certificates
- TLS servers consuming client certificates
- Hosting providers taking certificates or private keys from
customers
- Certificate authorities parsing certification requests from
subscribers
- Anything else which parses ASN.1 elliptic curve parameters
Also any other applications that use the BN_mod_sqrt() where the
attacker can control the parameter values are vulnerable to this DoS
issue.
Discovery 2022-03-15 Entry 2022-03-16 Modified 2022-03-16 openssl
< 1.1.1n,1
openssl-devel
< 3.0.2
openssl-quictls
< 3.0.2
libressl
< 3.4.3
libressl-devel
< 3.5.1
FreeBSD
ge 13.0 lt 13.0_8
ge 12.3 lt 12.3_3
ge 12.2 lt 12.2_14
CVE-2022-0778
https://www.openssl.org/news/secadv/20220315.txt
SA-22:03.openssl
|
c82ecac5-6e3f-11e8-8777-b499baebfeaf | OpenSSL -- Client DoS due to large DH parameter
The OpenSSL project reports:
During key agreement in a TLS handshake using a DH(E) based
ciphersuite a malicious server can send a very large prime value
to the client. This will cause the client to spend an unreasonably
long period of time generating a key for this prime resulting in a
hang until the client has finished. This could be exploited in a
Denial Of Service attack.
Discovery 2018-06-12 Entry 2018-06-12 Modified 2018-07-24 libressl
libressl-devel
< 2.6.5
ge 2.7.0 lt 2.7.4
openssl
< 1.0.2o_4,1
openssl-devel
< 1.1.0h_2
https://www.openssl.org/news/secadv/20180612.txt
CVE-2018-0732
|
7392e1e3-4eb9-11ed-856e-d4c9ef517024 | OpenSSL -- Potential NULL encryption in NID_undef with Custom Cipher
The OpenSSL project reports:
Using a Custom Cipher with NID_undef may lead to NULL encryption (low)
Discovery 2022-10-11 Entry 2022-10-18 openssl-devel
< 3.0.6
CVE-2022-3358
https://www.openssl.org/news/secadv/20221011.txt
|
a28e8b7e-fc70-11ec-856e-d4c9ef517024 | OpenSSL -- AES OCB fails to encrypt some bytes
The OpenSSL project reports:
AES OCB mode for 32-bit x86 platforms using the AES-NI assembly optimised
implementation will not encrypt the entirety of the data under some
circumstances. This could reveal sixteen bytes of data that was
preexisting in the memory that wasn't written. In the special case of
"in place" encryption, sixteen bytes of the plaintext would be revealed.
Discovery 2022-07-05 Entry 2022-07-05 openssl
< 1.1.1q,1
openssl-devel
< 3.0.5
CVE-2022-2097
https://www.openssl.org/news/secadv/20220705.txt
|
f40f07aa-c00f-11e7-ac58-b499baebfeaf | OpenSSL -- Multiple vulnerabilities
The OpenSSL project reports:
bn_sqrx8x_internal carry bug on x86_64 (CVE-2017-3736)
Severity: Moderate
There is a carry propagating bug in the x86_64 Montgomery squaring
procedure. No EC algorithms are affected. Analysis suggests that
attacks against RSA and DSA as a result of this defect would be
very difficult to perform and are not believed likely. Attacks
against DH are considered just feasible (although very difficult)
because most of the work necessary to deduce information about a
private key may be performed offline.
Malformed X.509 IPAddressFamily could cause OOB read (CVE-2017-3735)
Severity: Low
This issue was previously announced in security advisory
https://www.openssl.org/news/secadv/20170828.txt, but the fix has
not previously been included in a release due to its low severity.
Discovery 2017-11-02 Entry 2017-11-02 openssl
< 1.0.2m,1
openssl-devel
< 1.1.0g
https://www.openssl.org/news/secadv/20171102.txt
CVE-2017-3735
CVE-2017-3736
|
0132ca5b-5d11-11ec-8be6-d4c9ef517024 | OpenSSL -- Certificate validation issue
The OpenSSL project reports:
Invalid handling of X509_verify_cert() internal errors in libssl
(Moderate)
Internally libssl in OpenSSL calls X509_verify_cert() on the client
side to verify a certificate supplied by a server. That function may
return a negative return value to indicate an internal error (for
example out of memory). Such a negative return value is mishandled by
OpenSSL and will cause an IO function (such as SSL_connect() or
SSL_do_handshake()) to not indicate success and a subsequent call to
SSL_get_error() to return the value SSL_ERROR_WANT_RETRY_VERIFY.
This return value is only supposed to be returned by OpenSSL if the
application has previously called SSL_CTX_set_cert_verify_callback().
Since most applications do not do this the
SSL_ERROR_WANT_RETRY_VERIFY return value from SSL_get_error() will be
totally unexpected and applications may not behave correctly as a
result. The exact behaviour will depend on the application but it
could result in crashes, infinite loops or other similar incorrect
responses.
Discovery 2021-12-14 Entry 2021-12-14 openssl-devel
< 3.0.1
CVE-2021-4044
https://www.openssl.org/news/secadv/20211214.txt
|
1aaaa5c6-804d-11ec-8be6-d4c9ef517024 | OpenSSL -- BN_mod_exp incorrect results on MIPS
The OpenSSL project reports:
BN_mod_exp may produce incorrect results on MIPS (Moderate)
There is a carry propagation bug in the MIPS32 and MIPS64 squaring
procedure. Many EC algorithms are affected, including some of the
TLS 1.3 default curves. Impact was not analyzed in detail, because the
pre-requisites for attack are considered unlikely and include reusing
private keys. Analysis suggests that attacks against RSA and DSA as a
result of this defect would be very difficult to perform and are not
believed likely. Attacks against DH are considered just feasible
(although very difficult) because most of the work necessary to deduce
information about a private key may be performed offline. The amount
of resources required for such an attack would be significant.
However, for an attack on TLS to be meaningful, the server would have
to share the DH private key among multiple clients, which is no longer
an option since CVE-2016-0701.
Discovery 2022-01-28 Entry 2022-01-28 openssl
< 1.1.1m,1
openssl-devel
< 3.0.1
openssl-quictls
< 3.0.1
CVE-2021-4160
https://www.openssl.org/news/secadv/20220128.txt
|
8f353420-4197-11e8-8777-b499baebfeaf | OpenSSL -- Cache timing vulnerability
The OpenSSL project reports:
The OpenSSL RSA Key generation algorithm has been shown to be
vulnerable to a cache timing side channel attack. An attacker
with sufficient access to mount cache timing attacks during the
RSA key generation process could recover the private key.
Discovery 2018-04-16 Entry 2018-04-16 openssl
< 1.0.2o_2,1
openssl-devel
< 1.1.0h_1
https://www.openssl.org/news/secadv/20180416.txt
CVE-2018-0737
|
238ae7de-dba2-11e8-b713-b499baebfeaf | OpenSSL -- Multiple vulnerabilities in 1.1 branch
The OpenSSL project reports:
Timing vulnerability in ECDSA signature generation
(CVE-2018-0735): The OpenSSL ECDSA signature algorithm has been
shown to be vulnerable to a timing side channel attack. An
attacker could use variations in the signing algorithm to
recover the private key (Low).
Timing vulnerability in DSA signature generation (CVE-2018-0734):
Avoid a timing attack that leaks information via a side channel
that triggers when a BN is resized. Increasing the size of the
BNs prior to doing anything with them suppresses the attack (Low).
Discovery 2018-10-29 Entry 2018-10-29 Modified 2018-11-10 openssl-devel
< 1.1.0i_1
openssl111
< 1.1.1_2
libressl
ge 2.8.0 lt 2.8.3
libressl-devel
ge 2.8.0 lt 2.8.3
https://www.openssl.org/news/secadv/20181029.txt
https://github.com/openssl/openssl/commit/8abfe72e
CVE-2018-0735
CVE-2018-0734
|
b7cff5a9-31cc-11e8-8f07-b499baebfeaf | OpenSSL -- multiple vulnerabilities
The OpenSSL project reports:
- Constructed ASN.1 types with a recursive definition could
exceed the stack (CVE-2018-0739)
Constructed ASN.1 types with a recursive definition (such as can be
found in PKCS7) could eventually exceed the stack given malicious input
with excessive recursion. This could result in a Denial Of Service
attack. There are no such structures used within SSL/TLS that come from
untrusted sources so this is considered safe.
- rsaz_1024_mul_avx2 overflow bug on x86_64 (CVE-2017-3738)
There is an overflow bug in the AVX2 Montgomery multiplication
procedure used in exponentiation with 1024-bit moduli. This only
affects processors that support the AVX2 but not ADX extensions
like Intel Haswell (4th generation).
Discovery 2018-03-27 Entry 2018-03-27 openssl
< 1.0.2o,1
openssl-devel
< 1.1.0h
https://www.openssl.org/news/secadv/20180327.txt
CVE-2018-0739
CVE-2017-3738
|