FreshPorts - VuXML

This page displays vulnerability information about FreeBSD Ports.

The VUXML data was last processed by FreshPorts on 2024-03-27 18:04:16 UTC

List all Vulnerabilities, by package

List all Vulnerabilities, by date

k68

These are the vulnerabilities relating to the commit you have selected:

VuXML IDDescription
f0e45968-faff-11ec-856e-d4c9ef517024OpenSSL -- Heap memory corruption with RSA private key operation

The OpenSSL project reports:

The OpenSSL 3.0.4 release introduced a serious bug in the RSA implementation for X86_64 CPUs supporting the AVX512IFMA instructions. This issue makes the RSA implementation with 2048 bit private keys incorrect on such machines and memory corruption will happen during the computation. As a consequence of the memory corruption an attacker may be able to trigger a remote code execution on the machine performing the computation.

SSL/TLS servers or other servers using 2048 bit RSA private keys running on machines supporting AVX512IFMA instructions of the X86_64 architecture are affected by this issue.


Discovery 2022-07-01
Entry 2022-07-03
Modified 2022-07-05
openssl-devel
ge 3.0.4 lt 3.0.5

CVE-2022-2274
https://www.openssl.org/news/secadv/20220705.txt
fceb2b08-cb76-11ec-a06f-d4c9ef517024OpenSSL -- Multiple vulnerabilities

The OpenSSL project reports:

  • The c_rehash script allows command injection (CVE-2022-1292) (Moderate)

    The c_rehash script does not properly sanitise shell metacharacters to prevent command injection. This script is distributed by some operating systems in a manner where it is automatically executed. On such operating systems, an attacker could execute arbitrary commands with the privileges of the script.
  • OCSP_basic_verify may incorrectly verify the response signing certificate (CVE-2022-1343) (Moderate)

    The function `OCSP_basic_verify` verifies the signer certificate on an OCSP response. In the case where the (non-default) flag OCSP_NOCHECKS is used then the response will be positive (meaning a successful verification) even in the case where the response signing certificate fails to verify.
  • Incorrect MAC key used in the RC4-MD5 ciphersuite (CVE-2022-1434) (Low)

    The OpenSSL 3.0 implementation of the RC4-MD5 ciphersuite incorrectly uses the AAD data as the MAC key. This makes the MAC key trivially predictable.
  • Resource leakage when decoding certificates and keys (CVE-2022-1473) (Low)

    The OPENSSL_LH_flush() function, which empties a hash table, containsa bug that breaks reuse of the memory occuppied by the removed hash table entries.

Discovery 2022-05-03
Entry 2022-05-04
Modified 2022-05-05
openssl
< 1.1.1o,1

openssl-devel
< 3.0.3

openssl-quictls
< 3.0.3

CVE-2022-1292
CVE-2022-1343
CVE-2022-1434
CVE-2022-1473
https://www.openssl.org/news/secadv/20220503.txt
4eeb93bf-f204-11ec-8fbd-d4c9ef517024OpenSSL -- Command injection vulnerability

The OpenSSL project reports:

Circumstances where the c_rehash script does not properly sanitise shell metacharacters to prevent command injection were found by code review.


Discovery 2022-06-21
Entry 2022-06-22
openssl
< 1.1.1p,1

openssl-devel
< 3.0.4

openssl-quictls
< 3.0.4

CVE-2022-2068
https://www.openssl.org/news/secadv/20220621.txt