The vulnerability of the ts_obj_print_bio function in the OpenSSL library, which allows a hacker to cause a service failure

🗓️ 25 Apr 2022 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 1 Views

OpenSSL ts_obj_print_bio flaw lets remote attackers read beyond buffers and crash services.

Reporter	Title	Published	Views	Family All 230
ALT Linux	Security fix for the ALT Linux 9 package openssl1.1 version 1.0.2i-alt1	22 Sep 201600:00	–	altlinux
ALT Linux	Security fix for the ALT Linux 10 package openssl1.1 version 1.0.2i-alt1	22 Sep 201600:00	–	altlinux
ALT Linux	Security fix for the ALT Linux 7 package openssl10 version 1.0.1u-alt0.M70P.1	23 Sep 201600:00	–	altlinux
ALT Linux	Security fix for the ALT Linux 8 package openssl10 version 1.0.2i-alt1	22 Sep 201600:00	–	altlinux
ALT Linux	Security fix for the ALT Linux 9 package openssl10 version 1.0.2i-alt1	22 Sep 201600:00	–	altlinux
IBM Security Bulletins	Security Bulletin: Multiple Security vulnerabilities fixed in IBM Security Privileged Identity Manager	16 Jun 201821:59	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Security Guardium is affected by OpenSSL Security Advisory [22 Sep 2016] and [26 Sep 2016] vulnerabilities (multiple CVEs)	16 Jun 201821:47	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in OpenSSL affect IBM SmartCloud Entry	19 Jul 202000:49	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in OpenSSL affects IBM Tivoli Composite Application Manager for Transactions	17 Jun 201815:39	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Security Guardium is affected by Using Components with Known Vulnerabilities	16 Jun 201822:03	–	ibm

Vulners

Node

openssl opensslMatch1.0.1n

OR

openssl opensslMatch1.0.1o

OR

openssl opensslMatch1.0.2b

OR

openssl opensslMatch1.0.2c

OR

openssl opensslMatch1.0.1m

OR

openssl opensslMatch1.0.2a

OR

openssl opensslMatch1.0.2

OR

openssl opensslMatch1.0.2h

OR

openssl opensslMatch1.0.2g

OR

openssl opensslMatch1.0.2f

OR

openssl opensslMatch1.0.2e

OR

openssl opensslMatch1.0.2d

OR

openssl opensslMatch1.0.1c

OR

openssl opensslMatch1.0.1d

OR

openssl opensslMatch1.0.1l

OR

openssl opensslMatch1.0.1t

OR

openssl opensslMatch1.0.1e

OR

openssl opensslMatch1.0.1f

OR

openssl opensslMatch1.0.1a

OR

openssl opensslMatch1.0.1b

OR

openssl opensslMatch1.0.1i

OR

openssl opensslMatch1.0.1j

OR

openssl opensslMatch1.0.1k

OR

openssl opensslMatch1.0.1r

OR

openssl opensslMatch1.0.1s

OR

openssl opensslMatch1.0.1

OR

openssl opensslMatch1.0.1g

OR

openssl opensslMatch1.0.1h

OR

openssl opensslMatch1.0.1p

OR

openssl opensslMatch1.0.1q

OR

red_hat red_hat_enterprise_linuxMatch6

OR

red_hat red_hat_enterprise_linuxMatch7

OR

canonical ubuntuMatch12.04

OR

novell opensuse_leapMatch15.0

Source	Link
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
github	www.github.com/openssl/openssl/commit/0ed26acce328ec16a3aa635f1ca37365e8c7403a
oracle	www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
oracle	www.oracle.com/technetwork/topics/security/ovmbulletinoct2016-3090547.html
oracle	www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html
securityfocus	www.securityfocus.com/bid/92117
splunk	www.splunk.com/view/SP-CAAAPUE
splunk	www.splunk.com/view/SP-CAAAPSV
security	www.security.gentoo.org/glsa/201612-16
kb	www.kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40312

25 Apr 2022 00:00Current

7.7High risk

Vulners AI Score7.7

CVSS 37.5

CVSS 27.8

EPSS0.042

OpenSSL ts_obj_print_bio buffer overread remote attacker service crash