FreshPorts - VuXML

This page displays vulnerability information about FreeBSD Ports.

The VUXML data was last processed by FreshPorts on 2024-03-28 15:43:32 UTC

List all Vulnerabilities, by package

List all Vulnerabilities, by date

k68

These are the vulnerabilities relating to the commit you have selected:

VuXML IDDescription
648a432c-a71f-11ed-86e9-d4c9ef517024OpenSSL -- Multiple vulnerabilities

The OpenSSL project reports:

X.400 address type confusion in X.509 GeneralName (CVE-2023-0286) (High): There is a type confusion vulnerability relating to X.400 address processing inside an X.509 GeneralName. X.400 addresses were parsed as an ASN1_STRING but the public structure definition for GENERAL_NAME incorrectly specified the type of the x400Address field as ASN1_TYPE. This field is subsequently interpreted by the OpenSSL function GENERAL_NAME_cmp as an ASN1_TYPE rather than an ASN1_STRING.

Timing Oracle in RSA Decryption (CVE-2022-4304) (Moderate): A timing based side channel exists in the OpenSSL RSA Decryption implementation which could be sufficient to recover a plaintext across a network in a Bleichenbacher style attack. To achieve a successful decryption an attacker would have to be able to send a very large number of trial messages for decryption. The vulnerability affects all RSA padding modes: PKCS#1 v1.5, RSA-OEAP and RSASVE.

X.509 Name Constraints Read Buffer Overflow (CVE-2022-4203) (Moderate): A read buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after certificate chain signature verification and requires either a CA to have signed the malicious certificate or for the application to continue certificate verification despite failure to construct a path to a trusted issuer.

Use-after-free following BIO_new_NDEF (CVE-2023-0215) (Moderate): The public API function BIO_new_NDEF is a helper function used for streaming ASN.1 data via a BIO. It is primarily used internally to OpenSSL to support the SMIME, CMS and PKCS7 streaming capabilities, but may also be called directly by end user applications.

Double free after calling PEM_read_bio_ex (CVE-2022-4450) (Moderate): The function PEM_read_bio_ex() reads a PEM file from a BIO and parses and decodes the "name" (e.g. "CERTIFICATE"), any header data and the payload data. If the function succeeds then the "name_out", "header" and "data" arguments are populated with pointers to buffers containing the relevant decoded data. The caller is responsible for freeing those buffers. It is possible to construct a PEM file that results in 0 bytes of payload data. In this case PEM_read_bio_ex() will return a failure code but will populate the header argument with a pointer to a buffer that has already been freed. If the caller also frees this buffer then a double free will occur. This will most likely lead to a crash. This could be exploited by an attacker who has the ability to supply malicious PEM files for parsing to achieve a denial of service attack.

Invalid pointer dereference in d2i_PKCS7 functions (CVE-2023-0216) (Moderate): An invalid pointer dereference on read can be triggered when an application tries to load malformed PKCS7 data with the d2i_PKCS7(), d2i_PKCS7_bio() or d2i_PKCS7_fp() functions.

NULL dereference validating DSA public key (CVE-2023-0217) (Moderate): An invalid pointer dereference on read can be triggered when an application tries to check a malformed DSA public key by the EVP_PKEY_public_check() function. This will most likely lead to an application crash. This function can be called on public keys supplied from untrusted sources which could allow an attacker to cause a denial of service attack.

NULL dereference during PKCS7 data verification (CVE-2023-0401) (Moderate): A NULL pointer can be dereferenced when signatures are being verified on PKCS7 signed or signedAndEnveloped data. In case the hash algorithm used for the signature is known to the OpenSSL library but the implementation of the hash algorithm is not available the digest initialization will fail. There is a missing check for the return value from the initialization function which later leads to invalid usage of the digest API most likely leading to a crash.


Discovery 2023-02-07
Entry 2023-02-07
openssl
< 1.1.1t,1

openssl-devel
< 3.0.8

openssl-quictls
< 3.0.8

CVE-2023-0286
CVE-2022-4304
CVE-2022-4203
CVE-2023-0215
CVE-2022-4450
CVE-2023-0216
CVE-2023-0401
https://www.openssl.org/news/secadv/20230207.txt
fceb2b08-cb76-11ec-a06f-d4c9ef517024OpenSSL -- Multiple vulnerabilities

The OpenSSL project reports:

  • The c_rehash script allows command injection (CVE-2022-1292) (Moderate)

    The c_rehash script does not properly sanitise shell metacharacters to prevent command injection. This script is distributed by some operating systems in a manner where it is automatically executed. On such operating systems, an attacker could execute arbitrary commands with the privileges of the script.
  • OCSP_basic_verify may incorrectly verify the response signing certificate (CVE-2022-1343) (Moderate)

    The function `OCSP_basic_verify` verifies the signer certificate on an OCSP response. In the case where the (non-default) flag OCSP_NOCHECKS is used then the response will be positive (meaning a successful verification) even in the case where the response signing certificate fails to verify.
  • Incorrect MAC key used in the RC4-MD5 ciphersuite (CVE-2022-1434) (Low)

    The OpenSSL 3.0 implementation of the RC4-MD5 ciphersuite incorrectly uses the AAD data as the MAC key. This makes the MAC key trivially predictable.
  • Resource leakage when decoding certificates and keys (CVE-2022-1473) (Low)

    The OPENSSL_LH_flush() function, which empties a hash table, containsa bug that breaks reuse of the memory occuppied by the removed hash table entries.

Discovery 2022-05-03
Entry 2022-05-04
Modified 2022-05-05
openssl
< 1.1.1o,1

openssl-devel
< 3.0.3

openssl-quictls
< 3.0.3

CVE-2022-1292
CVE-2022-1343
CVE-2022-1434
CVE-2022-1473
https://www.openssl.org/news/secadv/20220503.txt
7392e1e3-4eb9-11ed-856e-d4c9ef517024OpenSSL -- Potential NULL encryption in NID_undef with Custom Cipher

The OpenSSL project reports:

Using a Custom Cipher with NID_undef may lead to NULL encryption (low)


Discovery 2022-10-11
Entry 2022-10-18
openssl-devel
< 3.0.6

CVE-2022-3358
https://www.openssl.org/news/secadv/20221011.txt
a28e8b7e-fc70-11ec-856e-d4c9ef517024OpenSSL -- AES OCB fails to encrypt some bytes

The OpenSSL project reports:

AES OCB mode for 32-bit x86 platforms using the AES-NI assembly optimised implementation will not encrypt the entirety of the data under some circumstances. This could reveal sixteen bytes of data that was preexisting in the memory that wasn't written. In the special case of "in place" encryption, sixteen bytes of the plaintext would be revealed.


Discovery 2022-07-05
Entry 2022-07-05
openssl
< 1.1.1q,1

openssl-devel
< 3.0.5

CVE-2022-2097
https://www.openssl.org/news/secadv/20220705.txt
4eeb93bf-f204-11ec-8fbd-d4c9ef517024OpenSSL -- Command injection vulnerability

The OpenSSL project reports:

Circumstances where the c_rehash script does not properly sanitise shell metacharacters to prevent command injection were found by code review.


Discovery 2022-06-21
Entry 2022-06-22
openssl
< 1.1.1p,1

openssl-devel
< 3.0.4

openssl-quictls
< 3.0.4

CVE-2022-2068
https://www.openssl.org/news/secadv/20220621.txt
0844671c-5a09-11ed-856e-d4c9ef517024OpenSSL -- Buffer overflows in Email verification

The OpenSSL project reports:

X.509 Email Address 4-byte Buffer Overflow (CVE-2022-3602) (High): A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking.

X.509 Email Address Variable Length Buffer Overflow (CVE-2022-3786) (High): A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking.


Discovery 2022-11-01
Entry 2022-11-01
openssl-devel
< 3.0.7

CVE-2022-3602
CVE-2022-3786
https://www.openssl.org/news/secadv/20221101.txt