Code injection

2009-08-3110:30:00

PRIOn knowledge base

www.prio-n.com

7.1 High

AI Score

Confidence

Low

0.005 Low

EPSS

Percentile

76.9%

JSON

The ssl_parse_client_key_exchange function in XySSL before 0.9 does not protect against certain Bleichenbacher attacks using chosen ciphertext, which allows remote attackers to recover keys via unspecified vectors.

CPENameOperatorVersion
xyssleq0.4
xyssleq0.1
xyssleq0.7
xyssleq0.3
xyssleq0.6
xysslle0.8
xyssleq0.2
xyssleq0.5

Name	Operator	Version
xyssl	eq	0.4
xyssl	eq	0.1
xyssl	eq	0.7
xyssl	eq	0.3
xyssl	eq	0.6
xyssl	le	0.8
xyssl	eq	0.2
xyssl	eq	0.5

References

polarssl.org/?archive

www.vupen.com/english/advisories/2008/0917/references

exchange.xforce.ibmcloud.com/vulnerabilities/41253