CVE-2024-9143

🗓️ 16 Oct 2024 17:09:23Reported by opensslType

cve🔗 web.nvd.nist.gov📰️ 4 Media mentions👁 493 Views

Use of low-level GF(2^m) elliptic curve APIs with untrusted inputs can lead to out-of-bounds memory access and possible remote code execution

Reporter	Title	Published	Views	Family All 206
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM API Connect	15 Mar 202500:18	–	ibm
IBM Security Bulletins	Security Bulletin: IBM MQ is affected by multiple vulnerabilities in the IBM Semeru Runtime	27 Feb 202515:56	–	ibm
IBM Security Bulletins	Security Bulletin: Security vulnerabilities affect multiple packages shipped with IBM CICS TX Advanced.	28 Apr 202510:33	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities affect IBM® Semeru Runtime	11 Dec 202410:20	–	ibm
IBM Security Bulletins	Security Bulletin: AIX is vulnerable to information disclosure (CVE-2024-13176) or arbitrary code execution or a denial of service (CVE-2024-9143) due to OpenSSL	15 Apr 202503:47	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Data Product Hub is affected by several vulnerabilities	11 Dec 202422:59	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar Wincollect is vulnerable to using components with known vulnerabilities	10 Apr 202517:22	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in OpenSSL affect IBM Rational ClearQuest	11 Aug 202513:06	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in OpenSSL affects IBM Integrated Analytics System [CVE-2024-9143]	28 Jan 202522:08	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities affecting IBM Decision Optimization for Cloud Pak for Data are addressed	16 May 202515:04	–	ibm

Vulners

Node

openssl opensslRange3.3.0–3.3.3

openssl opensslRange3.2.0–3.2.4

openssl opensslRange3.1.0–3.1.8

openssl opensslRange3.0.0–3.0.16

openssl opensslRange1.1.1–1.1.1zb

openssl opensslRange1.0.2–1.0.2zl

[
  {
    "defaultStatus": "unaffected",
    "product": "OpenSSL",
    "vendor": "OpenSSL",
    "versions": [
      {
        "lessThan": "3.3.3",
        "status": "affected",
        "version": "3.3.0",
        "versionType": "semver"
      },
      {
        "lessThan": "3.2.4",
        "status": "affected",
        "version": "3.2.0",
        "versionType": "semver"
      },
      {
        "lessThan": "3.1.8",
        "status": "affected",
        "version": "3.1.0",
        "versionType": "semver"
      },
      {
        "lessThan": "3.0.16",
        "status": "affected",
        "version": "3.0.0",
        "versionType": "semver"
      },
      {
        "lessThan": "1.1.1zb",
        "status": "affected",
        "version": "1.1.1",
        "versionType": "custom"
      },
      {
        "lessThan": "1.0.2zl",
        "status": "affected",
        "version": "1.0.2",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
github	www.github.com/openssl/openssl/commit/fdf6723362ca51bd883295efe206cb5b1cfa5154
openssl-library	www.openssl-library.org/news/secadv/20241016.txt
github	www.github.com/openssl/openssl/commit/72ae83ad214d2eef262461365a1975707f862712
github	www.github.openssl.org/openssl/extended-releases/commit/9d576994cec2b7aa37a91740ea7e680810957e41
github	www.github.com/openssl/openssl/commit/bc7e04d7c8d509fb78fc0e285aa948fb0da04700
github	www.github.openssl.org/openssl/extended-releases/commit/8efc0cbaa8ebba8e116f7b81a876a4123594d86a
github	www.github.com/openssl/openssl/commit/c0d3e4d32d2805f49bec30547f225bc4d092e1f4
lists	www.lists.debian.org/debian-lts-announce/2024/10/msg00033.html
security	www.security.netapp.com/advisory/ntap-20241101-0001/
openwall	www.openwall.com/lists/oss-security/2024/10/16/1

12 May 2026 12:17Current

4.9Medium risk

Vulners AI Score4.9

CVSS 3.14.3

EPSS0.00883

SSVC