CVE-2011-3207

2011-09-2210:55:03

CWE-264

[email protected]

web.nvd.nist.gov

cve-2011-3207

openssl

crl validation

remote attackers

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

AI Score

8.3

Confidence

High

EPSS

0.013

Percentile

86.0%

JSON

crypto/x509/x509_vfy.c in OpenSSL 1.0.x before 1.0.0e does not initialize certain structure members, which makes it easier for remote attackers to bypass CRL validation by using a nextUpdate value corresponding to a time in the past.

Affected configurations

NVD

Node

opensslopensslMatch1.0.0

opensslopensslMatch1.0.0beta1

opensslopensslMatch1.0.0beta2

opensslopensslMatch1.0.0beta3

opensslopensslMatch1.0.0beta4

opensslopensslMatch1.0.0beta5

opensslopensslMatch1.0.0a

opensslopensslMatch1.0.0b

opensslopensslMatch1.0.0c

opensslopensslMatch1.0.0d

VendorProductVersionCPE
opensslopenssl1.0.0dcpe:/a:openssl:openssl:1.0.0d:::
opensslopenssl1.0.0cpe:/a:openssl:openssl:1.0.0:beta4::
opensslopenssl1.0.0cpe:/a:openssl:openssl:1.0.0:beta2::
opensslopenssl1.0.0acpe:/a:openssl:openssl:1.0.0a:::
opensslopenssl1.0.0bcpe:/a:openssl:openssl:1.0.0b:::
opensslopenssl1.0.0cpe:/a:openssl:openssl:1.0.0:beta5::
opensslopenssl1.0.0cpe:/a:openssl:openssl:1.0.0:beta3::
opensslopenssl1.0.0ccpe:/a:openssl:openssl:1.0.0c:::
opensslopenssl1.0.0cpe:/a:openssl:openssl:1.0.0:::
opensslopenssl1.0.0cpe:/a:openssl:openssl:1.0.0:beta1::

Vendor	Product	Version	CPE
openssl	openssl	1.0.0d	cpe:/a:openssl:openssl:1.0.0d:::
openssl	openssl	1.0.0	cpe:/a:openssl:openssl:1.0.0:beta4::
openssl	openssl	1.0.0	cpe:/a:openssl:openssl:1.0.0:beta2::
openssl	openssl	1.0.0a	cpe:/a:openssl:openssl:1.0.0a:::
openssl	openssl	1.0.0b	cpe:/a:openssl:openssl:1.0.0b:::
openssl	openssl	1.0.0	cpe:/a:openssl:openssl:1.0.0:beta5::
openssl	openssl	1.0.0	cpe:/a:openssl:openssl:1.0.0:beta3::
openssl	openssl	1.0.0c	cpe:/a:openssl:openssl:1.0.0c:::
openssl	openssl	1.0.0	cpe:/a:openssl:openssl:1.0.0:::
openssl	openssl	1.0.0	cpe:/a:openssl:openssl:1.0.0:beta1::