VuXML ID | Description |
10dee731-c069-11ee-9190-84a93843eb75 | OpenSSL -- Multiple vulnerabilities
The OpenSSL project reports:
Excessive time spent checking invalid RSA public keys (CVE-2023-6237)
PKCS12 Decoding crashes (CVE-2024-0727)
Discovery 2024-01-30 Entry 2024-01-31 openssl
< 3.0.13,1
openssl-quictls
< 3.0.13
openssl31
< 3.1.5
openssl31-quictls
< 3.1.5
openssl32
< 3.2.1
CVE-2024-0727
CVE-2023-6237
https://www.openssl.org/news/secadv/20240125.txt
https://www.openssl.org/news/secadv/20240115.txt
https://www.openssl.org/news/openssl-3.0-notes.html
https://www.openssl.org/news/openssl-3.1-notes.html
https://www.openssl.org/news/openssl-3.2-notes.html
|
a5956603-7e4f-11ee-9df6-84a93843eb75 | OpenSSL -- DoS in DH generation
The OpenSSL project reports:
Excessive time spent in DH check / generation with large Q
parameter value (low).
Generating excessively long X9.42 DH keys or checking
excessively long X9.42 DH keys or parameters may be very slow.
Discovery 2023-11-08 Entry 2023-11-08 openssl
< 3.0.12_1,1
openssl111
< 1.1.1w_1
openssl31
< 3.1.4_1
openssl-quictls
< 3.0.12_1
openssl31-quictls
< 3.1.4_1
CVE-2023-5678
https://www.openssl.org/news/secadv/20231106.txt
|
4eeb93bf-f204-11ec-8fbd-d4c9ef517024 | OpenSSL -- Command injection vulnerability
The OpenSSL project reports:
Circumstances where the c_rehash script does not properly
sanitise shell metacharacters to prevent command injection were
found by code review.
Discovery 2022-06-21 Entry 2022-06-22 openssl
< 1.1.1p,1
openssl-devel
< 3.0.4
openssl-quictls
< 3.0.4
CVE-2022-2068
https://www.openssl.org/news/secadv/20220621.txt
|
ea05c456-a4fd-11ec-90de-1c697aa5a594 | OpenSSL -- Infinite loop in BN_mod_sqrt parsing certificates
The OpenSSL project reports:
Infinite loop in BN_mod_sqrt() reachable when parsing certificates
(High)
The BN_mod_sqrt() function, which computes a modular square root,
contains a bug that can cause it to loop forever for non-prime
moduli.
Internally this function is used when parsing certificates that
contain elliptic curve public keys in compressed form or explicit
elliptic curve parameters with a base point encoded in compressed
form.
It is possible to trigger the infinite loop by crafting a
certificate that has invalid explicit curve parameters.
Since certificate parsing happens prior to verification of the
certificate signature, any process that parses an externally
supplied certificate may thus be subject to a denial of service
attack. The infinite loop can also be reached when parsing crafted
private keys as they can contain explicit elliptic curve
parameters.
Thus vulnerable situations include:
- TLS clients consuming server certificates
- TLS servers consuming client certificates
- Hosting providers taking certificates or private keys from
customers
- Certificate authorities parsing certification requests from
subscribers
- Anything else which parses ASN.1 elliptic curve parameters
Also any other applications that use the BN_mod_sqrt() where the
attacker can control the parameter values are vulnerable to this DoS
issue.
Discovery 2022-03-15 Entry 2022-03-16 Modified 2022-03-16 openssl
< 1.1.1n,1
openssl-devel
< 3.0.2
openssl-quictls
< 3.0.2
libressl
< 3.4.3
libressl-devel
< 3.5.1
FreeBSD
ge 13.0 lt 13.0_8
ge 12.3 lt 12.3_3
ge 12.2 lt 12.2_14
CVE-2022-0778
https://www.openssl.org/news/secadv/20220315.txt
SA-22:03.openssl
|
bad6588e-2fe0-11ee-a0d1-84a93843eb75 | OpenSSL -- Excessive time spent checking DH q parameter value
The OpenSSL project reports:
Checking excessively long DH keys or parameters may be very slow
(severity: Low).
Discovery 2023-07-31 Entry 2023-07-31 openssl
< 1.1.1u_1,1
openssl30
< 3.0.9_2
openssl31
< 3.1.1_2
CVE-2023-3817
https://www.openssl.org/news/secadv/20230731.txt
|
a28e8b7e-fc70-11ec-856e-d4c9ef517024 | OpenSSL -- AES OCB fails to encrypt some bytes
The OpenSSL project reports:
AES OCB mode for 32-bit x86 platforms using the AES-NI assembly optimised
implementation will not encrypt the entirety of the data under some
circumstances. This could reveal sixteen bytes of data that was
preexisting in the memory that wasn't written. In the special case of
"in place" encryption, sixteen bytes of the plaintext would be revealed.
Discovery 2022-07-05 Entry 2022-07-05 openssl
< 1.1.1q,1
openssl-devel
< 3.0.5
CVE-2022-2097
https://www.openssl.org/news/secadv/20220705.txt
|
fceb2b08-cb76-11ec-a06f-d4c9ef517024 | OpenSSL -- Multiple vulnerabilities
The OpenSSL project reports:
- The c_rehash script allows command injection (CVE-2022-1292)
(Moderate)
The c_rehash script does not properly sanitise shell
metacharacters to prevent command injection. This script is distributed
by some operating systems in a manner where it is automatically
executed. On such operating systems, an attacker could execute arbitrary
commands with the privileges of the script.
- OCSP_basic_verify may incorrectly verify the response signing
certificate (CVE-2022-1343) (Moderate)
The function
`OCSP_basic_verify` verifies the signer certificate on an OCSP response.
In the case where the (non-default) flag OCSP_NOCHECKS is used then the
response will be positive (meaning a successful verification) even in
the case where the response signing certificate fails to verify.
- Incorrect MAC key used in the RC4-MD5 ciphersuite (CVE-2022-1434)
(Low)
The OpenSSL 3.0 implementation of the RC4-MD5 ciphersuite
incorrectly uses the AAD data as the MAC key. This makes the MAC key
trivially predictable.
- Resource leakage when decoding certificates and keys (CVE-2022-1473)
(Low)
The OPENSSL_LH_flush() function, which empties a hash table,
containsa bug that breaks reuse of the memory occuppied by the removed
hash table entries.
Discovery 2022-05-03 Entry 2022-05-04 Modified 2022-05-05 openssl
< 1.1.1o,1
openssl-devel
< 3.0.3
openssl-quictls
< 3.0.3
CVE-2022-1292
CVE-2022-1343
CVE-2022-1434
CVE-2022-1473
https://www.openssl.org/news/secadv/20220503.txt
|
eb9a3c57-ff9e-11ed-a0d1-84a93843eb75 | OpenSSL -- Possible DoS translating ASN.1 identifiers
The OpenSSL project reports:
Severity: Moderate. Processing some specially crafted ASN.1
object identifiers or data containing them may be very slow.
Discovery 2023-05-30 Entry 2023-05-31 openssl
< 1.1.1u,1
openssl30
< 3.0.9
openssl31
< 3.1.1
openssl-quictls
< 3.0.9
CVE-2023-2650
https://www.openssl.org/news/secadv/20230530.txt
|
8337251b-b07b-11ee-b0d7-84a93843eb75 | OpenSSL -- Vector register corruption on PowerPC
SO-AND-SO reports:
The POLY1305 MAC (message authentication code) implementation
contains a bug that might corrupt the internal state of applications running
on PowerPC CPU based platforms if the CPU provides vector instructions.
Discovery 2024-01-09 Entry 2024-01-11 openssl
< 3.0.12_2,1
openssl-quictls
< 3.0.12_2
openssl31
< 3.1.4_2
openssl31-quictls
< 3.1.4_2
openssl32
< 3.2.0_1
CVE-2023-6129
https://www.openssl.org/news/secadv/20240109.txt
|
7c217849-f7d7-11ee-a490-84a93843eb75 | OpenSSL -- Unbounded memory growth with session handling in TLSv1.3
The OpenSSL project reports:
Some non-default TLS server configurations can cause unbounded
memory growth when processing TLSv1.3 sessions
Discovery 2024-04-08 Entry 2024-04-11 openssl
< 3.0.13_3,1
openssl31
< 3.1.5_3
openssl32
< 3.2.1_2
openssl-quictls
< 3.0.13_3
openssl31-quictls
< 3.1.5_1
CVE-2024-2511
https://www.openssl.org/news/secadv/20240408.txt
|
4a4712ae-7299-11ee-85eb-84a93843eb75 | OpenSSL -- potential loss of confidentiality
SO-AND-SO reports:
Moderate severity: A bug has been identified in the processing
of key and initialisation vector (IV) lengths. This can lead to
potential truncation or overruns during the initialisation of
some symmetric ciphers.
Discovery 2023-10-24 Entry 2023-10-24 openssl
< 3.0.12,1
openssl31
< 3.1.4
openssl-quictls
< 3.0.12
CVE-2023-5363
https://www.openssl.org/news/secadv/20231024.txt
|
648a432c-a71f-11ed-86e9-d4c9ef517024 | OpenSSL -- Multiple vulnerabilities
The OpenSSL project reports:
X.400 address type confusion in X.509 GeneralName (CVE-2023-0286) (High):
There is a type confusion vulnerability relating to X.400 address processing
inside an X.509 GeneralName. X.400 addresses were parsed as an ASN1_STRING but
the public structure definition for GENERAL_NAME incorrectly specified the type
of the x400Address field as ASN1_TYPE. This field is subsequently interpreted by
the OpenSSL function GENERAL_NAME_cmp as an ASN1_TYPE rather than an
ASN1_STRING.
Timing Oracle in RSA Decryption (CVE-2022-4304) (Moderate):
A timing based side channel exists in the OpenSSL RSA Decryption implementation
which could be sufficient to recover a plaintext across a network in a
Bleichenbacher style attack. To achieve a successful decryption an attacker
would have to be able to send a very large number of trial messages for
decryption. The vulnerability affects all RSA padding modes: PKCS#1 v1.5,
RSA-OEAP and RSASVE.
X.509 Name Constraints Read Buffer Overflow (CVE-2022-4203) (Moderate):
A read buffer overrun can be triggered in X.509 certificate verification,
specifically in name constraint checking. Note that this occurs
after certificate chain signature verification and requires either a
CA to have signed the malicious certificate or for the application to
continue certificate verification despite failure to construct a path
to a trusted issuer.
Use-after-free following BIO_new_NDEF (CVE-2023-0215) (Moderate):
The public API function BIO_new_NDEF is a helper function used for streaming
ASN.1 data via a BIO. It is primarily used internally to OpenSSL to support the
SMIME, CMS and PKCS7 streaming capabilities, but may also be called directly by
end user applications.
Double free after calling PEM_read_bio_ex (CVE-2022-4450) (Moderate):
The function PEM_read_bio_ex() reads a PEM file from a BIO and parses and
decodes the "name" (e.g. "CERTIFICATE"), any header data and the payload data.
If the function succeeds then the "name_out", "header" and "data" arguments are
populated with pointers to buffers containing the relevant decoded data. The
caller is responsible for freeing those buffers. It is possible to construct a
PEM file that results in 0 bytes of payload data. In this case PEM_read_bio_ex()
will return a failure code but will populate the header argument with a pointer
to a buffer that has already been freed. If the caller also frees this buffer
then a double free will occur. This will most likely lead to a crash. This
could be exploited by an attacker who has the ability to supply malicious PEM
files for parsing to achieve a denial of service attack.
Invalid pointer dereference in d2i_PKCS7 functions (CVE-2023-0216) (Moderate):
An invalid pointer dereference on read can be triggered when an
application tries to load malformed PKCS7 data with the
d2i_PKCS7(), d2i_PKCS7_bio() or d2i_PKCS7_fp() functions.
NULL dereference validating DSA public key (CVE-2023-0217) (Moderate):
An invalid pointer dereference on read can be triggered when an
application tries to check a malformed DSA public key by the
EVP_PKEY_public_check() function. This will most likely lead
to an application crash. This function can be called on public
keys supplied from untrusted sources which could allow an attacker
to cause a denial of service attack.
NULL dereference during PKCS7 data verification (CVE-2023-0401) (Moderate):
A NULL pointer can be dereferenced when signatures are being
verified on PKCS7 signed or signedAndEnveloped data. In case the hash
algorithm used for the signature is known to the OpenSSL library but
the implementation of the hash algorithm is not available the digest
initialization will fail. There is a missing check for the return
value from the initialization function which later leads to invalid
usage of the digest API most likely leading to a crash.
Discovery 2023-02-07 Entry 2023-02-07 openssl
< 1.1.1t,1
openssl-devel
< 3.0.8
openssl-quictls
< 3.0.8
CVE-2023-0286
CVE-2022-4304
CVE-2022-4203
CVE-2023-0215
CVE-2022-4450
CVE-2023-0216
CVE-2023-0401
https://www.openssl.org/news/secadv/20230207.txt
|