FreshPorts - VuXML
This page displays vulnerability information about FreeBSD Ports.
The VUXML data was last processed by FreshPorts on 2024-03-28 15:43:32 UTC
List all Vulnerabilities, by package
List all Vulnerabilities, by date
k68
These are the vulnerabilities relating to the commit you have selected:
VuXML ID | Description |
96811d4a-04ec-11ec-9b84-d4c9ef517024 | OpenSSL -- multiple vulnerabilities
The OpenSSL project reports:
SM2 Decryption Buffer Overflow (CVE-2021-3711: High)
Read buffer overruns processing ASN.1 strings (CVE-2021-3712:
Moderate)
Discovery 2021-08-24 Entry 2021-08-24 Modified 2021-08-25 openssl
< 1.1.1l,1
openssl-devel
< 3.0.0.b3
FreeBSD
ge 13.0 lt 13.0_4
ge 12.2 lt 12.2_10
CVE-2021-3711
CVE-2021-3712
https://www.openssl.org/news/secadv/20210824.txt
SA-21:16.openssl
|
0132ca5b-5d11-11ec-8be6-d4c9ef517024 | OpenSSL -- Certificate validation issue
The OpenSSL project reports:
Invalid handling of X509_verify_cert() internal errors in libssl
(Moderate)
Internally libssl in OpenSSL calls X509_verify_cert() on the client
side to verify a certificate supplied by a server. That function may
return a negative return value to indicate an internal error (for
example out of memory). Such a negative return value is mishandled by
OpenSSL and will cause an IO function (such as SSL_connect() or
SSL_do_handshake()) to not indicate success and a subsequent call to
SSL_get_error() to return the value SSL_ERROR_WANT_RETRY_VERIFY.
This return value is only supposed to be returned by OpenSSL if the
application has previously called SSL_CTX_set_cert_verify_callback().
Since most applications do not do this the
SSL_ERROR_WANT_RETRY_VERIFY return value from SSL_get_error() will be
totally unexpected and applications may not behave correctly as a
result. The exact behaviour will depend on the application but it
could result in crashes, infinite loops or other similar incorrect
responses.
Discovery 2021-12-14 Entry 2021-12-14 openssl-devel
< 3.0.1
CVE-2021-4044
https://www.openssl.org/news/secadv/20211214.txt
|