VuXML ID | Description |
1aaaa5c6-804d-11ec-8be6-d4c9ef517024 | OpenSSL -- BN_mod_exp incorrect results on MIPS
The OpenSSL project reports:
BN_mod_exp may produce incorrect results on MIPS (Moderate)
There is a carry propagation bug in the MIPS32 and MIPS64 squaring
procedure. Many EC algorithms are affected, including some of the
TLS 1.3 default curves. Impact was not analyzed in detail, because the
pre-requisites for attack are considered unlikely and include reusing
private keys. Analysis suggests that attacks against RSA and DSA as a
result of this defect would be very difficult to perform and are not
believed likely. Attacks against DH are considered just feasible
(although very difficult) because most of the work necessary to deduce
information about a private key may be performed offline. The amount
of resources required for such an attack would be significant.
However, for an attack on TLS to be meaningful, the server would have
to share the DH private key among multiple clients, which is no longer
an option since CVE-2016-0701.
Discovery 2022-01-28 Entry 2022-01-28 openssl
< 1.1.1m,1
openssl-devel
< 3.0.1
openssl-quictls
< 3.0.1
CVE-2021-4160
https://www.openssl.org/news/secadv/20220128.txt
|
d778ddb0-2338-11ea-a1c7-b499baebfeaf | OpenSSL -- Overflow vulnerability
The OpenSSL project reports:
rsaz_512_sqr overflow bug on x86_64 (CVE-2019-1551) (Low)
There is an overflow bug in the x64_64 Montgomery squaring procedure
used in exponentiation with 512-bit moduli. No EC algorithms are
affected. Analysis suggests that attacks against 2-prime RSA1024,
3-prime RSA1536, and DSA1024 as a result of this defect would be very
difficult to perform and are not believed likely. Attacks against
DH512 are considered just feasible. However, for an attack the target
would have to re-use the DH512 private key, which is not recommended
anyway. Also applications directly using the low level API BN_mod_exp
may be affected if they use BN_FLG_CONSTTIME.
Discovery 2019-12-06 Entry 2019-12-20 openssl
< 1.0.2u,1
https://www.openssl.org/news/secadv/20191206.txt
CVE-2019-1551
|
96a21236-707b-11eb-96d8-d4c9ef517024 | OpenSSL -- Multiple vulnerabilities
The OpenSSL project reports:
Null pointer deref in X509_issuer_and_serial_hash()
CVE-2021-23841 (Moderate) The OpenSSL public API function
X509_issuer_and_serial_hash() attempts to create a unique hash
value based on the issuer and serial number data contained within
an X509 certificate. However it fails to correctly handle any errors
that may occur while parsing the issuer field (which might occur if
the issuer field is maliciously constructed). This may subsequently
result in a NULL pointer deref and a crash leading to a potential
denial of service attack.
Integer overflow in CipherUpdate CVE-2021-23840 (Low)
Calls to EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate
may overflow the output length argument in some cases where the
input length is close to the maximum permissable length for an
integer on the platform. In such cases the return value from the
function call will be 1 (indicating success), but the output length
value will be negative. This could cause applications to behave
incorrectly or crash.
Discovery 2021-02-16 Entry 2021-02-16 Modified 2021-08-25 openssl
< 1.1.1j,1
openssl-devel
< 3.0.0.a12
FreeBSD
ge 12.2 lt 12.2_10
ge 11.4 lt 11.4_13
https://www.openssl.org/news/secadv/20210216.txt
CVE-2021-23841
CVE-2021-23840
CVE-2021-23839
SA-21:17.openssl
|
96811d4a-04ec-11ec-9b84-d4c9ef517024 | OpenSSL -- multiple vulnerabilities
The OpenSSL project reports:
SM2 Decryption Buffer Overflow (CVE-2021-3711: High)
Read buffer overruns processing ASN.1 strings (CVE-2021-3712:
Moderate)
Discovery 2021-08-24 Entry 2021-08-24 Modified 2021-08-25 openssl
< 1.1.1l,1
openssl-devel
< 3.0.0.b3
FreeBSD
ge 13.0 lt 13.0_4
ge 12.2 lt 12.2_10
CVE-2021-3711
CVE-2021-3712
https://www.openssl.org/news/secadv/20210824.txt
SA-21:16.openssl
|
9e0c6f7a-d46d-11e9-a1c7-b499baebfeaf | OpenSSL -- Multiple vulnerabilities
The OpenSSL project reports:
ECDSA remote timing attack (CVE-2019-1547) [Low]
Fork Protection (CVE-2019-1549) [Low]
(OpenSSL 1.1.1 only)
Discovery 2019-09-10 Entry 2019-09-11 openssl
< 1.0.2t,1
openssl111
< 1.1.1d
https://www.openssl.org/news/secadv/20190910.txt
CVE-2019-1547
CVE-2019-1549
|
c82ecac5-6e3f-11e8-8777-b499baebfeaf | OpenSSL -- Client DoS due to large DH parameter
The OpenSSL project reports:
During key agreement in a TLS handshake using a DH(E) based
ciphersuite a malicious server can send a very large prime value
to the client. This will cause the client to spend an unreasonably
long period of time generating a key for this prime resulting in a
hang until the client has finished. This could be exploited in a
Denial Of Service attack.
Discovery 2018-06-12 Entry 2018-06-12 Modified 2018-07-24 libressl
libressl-devel
< 2.6.5
ge 2.7.0 lt 2.7.4
openssl
< 1.0.2o_4,1
openssl-devel
< 1.1.0h_2
https://www.openssl.org/news/secadv/20180612.txt
CVE-2018-0732
|
f0e45968-faff-11ec-856e-d4c9ef517024 | OpenSSL -- Heap memory corruption with RSA private key operation
The OpenSSL project reports:
The OpenSSL 3.0.4 release introduced a serious bug in the RSA
implementation for X86_64 CPUs supporting the AVX512IFMA instructions.
This issue makes the RSA implementation with 2048 bit private keys
incorrect on such machines and memory corruption will happen during
the computation. As a consequence of the memory corruption an attacker
may be able to trigger a remote code execution on the machine performing
the computation.
SSL/TLS servers or other servers using 2048 bit RSA private keys running
on machines supporting AVX512IFMA instructions of the X86_64 architecture
are affected by this issue.
Discovery 2022-07-01 Entry 2022-07-03 Modified 2022-07-05 openssl-devel
ge 3.0.4 lt 3.0.5
CVE-2022-2274
https://www.openssl.org/news/secadv/20220705.txt
|
7700061f-34f7-11e9-b95c-b499baebfeaf | OpenSSL -- Padding oracle vulnerability
The OpenSSL project reports:
0-byte record padding oracle (CVE-2019-1559) (Moderate)
If an application encounters a fatal protocol error and then calls
SSL_shutdown() twice (once to send a close_notify, and once to receive
one) then OpenSSL can respond differently to the calling application if
a 0 byte record is received with invalid padding compared to if a 0 byte
record is received with an invalid MAC. If the application then behaves
differently based on that in a way that is detectable to the remote peer,
then this amounts to a padding oracle that could be used to decrypt data.
Discovery 2019-02-19 Entry 2019-02-20 Modified 2019-03-07 openssl
< 1.0.2r,1
linux-c6-openssl
< 1.0.1e_16
https://www.openssl.org/news/secadv/20190226.txt
CVE-2019-1559
|
8f353420-4197-11e8-8777-b499baebfeaf | OpenSSL -- Cache timing vulnerability
The OpenSSL project reports:
The OpenSSL RSA Key generation algorithm has been shown to be
vulnerable to a cache timing side channel attack. An attacker
with sufficient access to mount cache timing attacks during the
RSA key generation process could recover the private key.
Discovery 2018-04-16 Entry 2018-04-16 openssl
< 1.0.2o_2,1
openssl-devel
< 1.1.0h_1
https://www.openssl.org/news/secadv/20180416.txt
CVE-2018-0737
|
5a668ab3-8d86-11eb-b8d6-d4c9ef517024 | OpenSSL -- Multiple vulnerabilities
The OpenSSL project reports:
High: CA certificate check bypass with X509_V_FLAG_X509_STRICT
(CVE-2021-3450) The X509_V_FLAG_X509_STRICT flag enables
additional security checks of the certificates present in a
certificate chain. It is not set by default.
High: NULL pointer deref in signature_algorithms processing
(CVE-2021-3449) An OpenSSL TLS server may crash if sent a
maliciously crafted renegotiation ClientHello message from a client.
If a TLSv1.2 renegotiation ClientHello omits the
signature_algorithms extension (where it was present in the initial
ClientHello), but includes a signature_algorithms_cert extension
then a NULL pointer dereference will result, leading to a crash and
a denial of service attack.
Discovery 2021-03-25 Entry 2021-03-26 Modified 2021-04-07 openssl
< 1.1.1k,1
FreeBSD
ge 12.2 lt 12.2_5
https://www.openssl.org/news/secadv/20210325.txt
CVE-2021-3449
CVE-2021-3450
SA-21:07.openssl
|
4eeb93bf-f204-11ec-8fbd-d4c9ef517024 | OpenSSL -- Command injection vulnerability
The OpenSSL project reports:
Circumstances where the c_rehash script does not properly
sanitise shell metacharacters to prevent command injection were
found by code review.
Discovery 2022-06-21 Entry 2022-06-22 openssl
< 1.1.1p,1
openssl-devel
< 3.0.4
openssl-quictls
< 3.0.4
CVE-2022-2068
https://www.openssl.org/news/secadv/20220621.txt
|
b7cff5a9-31cc-11e8-8f07-b499baebfeaf | OpenSSL -- multiple vulnerabilities
The OpenSSL project reports:
- Constructed ASN.1 types with a recursive definition could
exceed the stack (CVE-2018-0739)
Constructed ASN.1 types with a recursive definition (such as can be
found in PKCS7) could eventually exceed the stack given malicious input
with excessive recursion. This could result in a Denial Of Service
attack. There are no such structures used within SSL/TLS that come from
untrusted sources so this is considered safe.
- rsaz_1024_mul_avx2 overflow bug on x86_64 (CVE-2017-3738)
There is an overflow bug in the AVX2 Montgomery multiplication
procedure used in exponentiation with 1024-bit moduli. This only
affects processors that support the AVX2 but not ADX extensions
like Intel Haswell (4th generation).
Discovery 2018-03-27 Entry 2018-03-27 openssl
< 1.0.2o,1
openssl-devel
< 1.1.0h
https://www.openssl.org/news/secadv/20180327.txt
CVE-2018-0739
CVE-2017-3738
|
fceb2b08-cb76-11ec-a06f-d4c9ef517024 | OpenSSL -- Multiple vulnerabilities
The OpenSSL project reports:
- The c_rehash script allows command injection (CVE-2022-1292)
(Moderate)
The c_rehash script does not properly sanitise shell
metacharacters to prevent command injection. This script is distributed
by some operating systems in a manner where it is automatically
executed. On such operating systems, an attacker could execute arbitrary
commands with the privileges of the script.
- OCSP_basic_verify may incorrectly verify the response signing
certificate (CVE-2022-1343) (Moderate)
The function
`OCSP_basic_verify` verifies the signer certificate on an OCSP response.
In the case where the (non-default) flag OCSP_NOCHECKS is used then the
response will be positive (meaning a successful verification) even in
the case where the response signing certificate fails to verify.
- Incorrect MAC key used in the RC4-MD5 ciphersuite (CVE-2022-1434)
(Low)
The OpenSSL 3.0 implementation of the RC4-MD5 ciphersuite
incorrectly uses the AAD data as the MAC key. This makes the MAC key
trivially predictable.
- Resource leakage when decoding certificates and keys (CVE-2022-1473)
(Low)
The OPENSSL_LH_flush() function, which empties a hash table,
containsa bug that breaks reuse of the memory occuppied by the removed
hash table entries.
Discovery 2022-05-03 Entry 2022-05-04 Modified 2022-05-05 openssl
< 1.1.1o,1
openssl-devel
< 3.0.3
openssl-quictls
< 3.0.3
CVE-2022-1292
CVE-2022-1343
CVE-2022-1434
CVE-2022-1473
https://www.openssl.org/news/secadv/20220503.txt
|
1d56cfc5-3970-11eb-929d-d4c9ef517024 | OpenSSL -- NULL pointer de-reference
The OpenSSL project reports:
EDIPARTYNAME NULL pointer de-reference (High)
The X.509 GeneralName type is a generic type for representing
different types of names. One of those name types is known as
EDIPartyName. OpenSSL provides a function GENERAL_NAME_cmp which
compares different instances of a GENERAL_NAME to see if they
are equal or not. This function behaves incorrectly when both
GENERAL_NAMEs contain an EDIPARTYNAME. A NULL pointer
dereference and a crash may occur leading to a possible denial
of service attack.
Discovery 2020-12-08 Entry 2020-12-08 Modified 2020-12-15 openssl
ge 1.0.2,1 lt 1.1.1i,1
FreeBSD
ge 12.2 lt 12.2_2
ge 12.1 lt 12.1_12
ge 11.4 lt 11.4_6
https://www.openssl.org/news/secadv/20201208.txt
CVE-2020-1971
SA-20:33.openssl
|
ea05c456-a4fd-11ec-90de-1c697aa5a594 | OpenSSL -- Infinite loop in BN_mod_sqrt parsing certificates
The OpenSSL project reports:
Infinite loop in BN_mod_sqrt() reachable when parsing certificates
(High)
The BN_mod_sqrt() function, which computes a modular square root,
contains a bug that can cause it to loop forever for non-prime
moduli.
Internally this function is used when parsing certificates that
contain elliptic curve public keys in compressed form or explicit
elliptic curve parameters with a base point encoded in compressed
form.
It is possible to trigger the infinite loop by crafting a
certificate that has invalid explicit curve parameters.
Since certificate parsing happens prior to verification of the
certificate signature, any process that parses an externally
supplied certificate may thus be subject to a denial of service
attack. The infinite loop can also be reached when parsing crafted
private keys as they can contain explicit elliptic curve
parameters.
Thus vulnerable situations include:
- TLS clients consuming server certificates
- TLS servers consuming client certificates
- Hosting providers taking certificates or private keys from
customers
- Certificate authorities parsing certification requests from
subscribers
- Anything else which parses ASN.1 elliptic curve parameters
Also any other applications that use the BN_mod_sqrt() where the
attacker can control the parameter values are vulnerable to this DoS
issue.
Discovery 2022-03-15 Entry 2022-03-16 Modified 2022-03-16 openssl
< 1.1.1n,1
openssl-devel
< 3.0.2
openssl-quictls
< 3.0.2
libressl
< 3.4.3
libressl-devel
< 3.5.1
FreeBSD
ge 13.0 lt 13.0_8
ge 12.3 lt 12.3_3
ge 12.2 lt 12.2_14
CVE-2022-0778
https://www.openssl.org/news/secadv/20220315.txt
SA-22:03.openssl
|