Internet Bug Bounty: CVE-2021-3711: SM2 decrypt buffer overflow

CVE-2021-3711 In order to decrypt SM2 encrypted data an application is expected to call the API function EVPPKEYdecrypt. Typically an application will call this function twice. The first time, on entry, the "out" parameter can be NULL and, on exit, the "outlen" parameter is populated with the...

Tenable SecurityCenter OpenSSL < 1.1.1l Multiple Vulnerabilities (TNS-2021-16)

According to its self-reported version, the Tenable SecurityCenter application installed on the remote host is missing the security patch SC-202109.1, therefore affected by multiple vulnerabilities as referenced in the 1.1.1l advisory: - A heap-based buffer overflow condition exists due to the...

Security Bulletin: OpenSSL Vulnerability Affects IBM Sterling Connect:Express for UNIX (CVE-2021-3711)

Summary Security vulnerability have been disclosed on 24th August 2021 by the OpenSSL Project. OpenSSl is used by IBM Sterling Connect:Express for UNIX. IBM Sterling Connect:Express for UNIX has addressed the applicable CVE. Vulnerability Details CVEID: CVE-2021-3711 DESCRIPTION: OpenSSL is...

CVE-2021-3711 affecting package openssl 1.1.1k-16

CVE-2021-3711 affecting package openssl 1.1.1k-16. A patched version of the package is available...

USN-5051-1: OpenSSL vulnerabilities | Cloud Foundry

Severity High Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 18.04 Description John Ouyang discovered that OpenSSL incorrectly handled decrypting SM2 data. A remote attacker could use this issue to cause applications using OpenSSL to crash, resulting in a denial of service, or possibl...

OESA-2021-1330 OpenSSL security update

OpenSSL is a robust, commercial-grade, and full-featured toolkit for the Transport Layer Security TLS and Secure Sockets Layer SSL protocols. Security Fixes: In order to decrypt SM2 encrypted data an application is expected to call the API function EVPPKEYdecrypt. Typically an application will ca...

Security fix for the ALT Linux 9 package openssl1.1 version 1.1.1l-alt1

1.1.1l-alt1 built Sept. 2, 2021 Gleb Fotengauer-Malinovskiy in task 283690 Aug. 24, 2021 Gleb Fotengauer-Malinovskiy - Updated to 1.1.1l fixes CVE-2021-3711, CVE-2021-3712...

QNAP Working on Patches for OpenSSL Flaws Affecting its NAS Devices

Network-attached storage NAS appliance maker QNAP said it's currently investigating two recently patched security flaws in OpenSSL to determine their potential impact, adding it will release security updates should its products turn out to be vulnerable. Tracked as CVE-2021-3711 CVSS score: 7.5 a...

Photon OS 2.0: Nxtgn PHSA-2021-2.0-0383

An update of the nxtgn package has been released. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2021-2.0-0383. The text itself is copyright C VMware, Inc...

Security fix for the ALT Linux 10 package openssl1.1 version 1.1.1l-alt1

1.1.1l-alt1 built Aug. 27, 2021 Gleb Fotengauer-Malinovskiy in task 283689 Aug. 24, 2021 Gleb Fotengauer-Malinovskiy - Updated to 1.1.1l fixes CVE-2021-3711, CVE-2021-3712...

OPENSUSE-SU-2021:1188-1 Security update for openssl-1_1

This update for openssl-11 fixes the following security issues: - CVE-2021-3711: A bug in the implementation of the SM2 decryption code could lead to buffer overflows. bsc1189520 - CVE-2021-3712: a bug in the code for printing certificate details could lead to a buffer overrun that a malicious...

FreeBSD : OpenSSL -- multiple vulnerabilities (96811d4a-04ec-11ec-9b84-d4c9ef517024)

The OpenSSL project reports : SM2 Decryption Buffer Overflow CVE-2021-3711: High Read buffer overruns processing ASN.1 strings CVE-2021-3712 : Moderate %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML...

openSUSE: Security Advisory for openssl-1_1 (openSUSE-SU-2021:2830-1)

The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

SUSE SLED12: libopenssl-1_1-devel / libopenssl-1_1-devel-32bit / libopenssl1_1 / etc (SUSE-SU-2021:2833-1)

The remote SUSE Linux SLED12 / SLES12 / SLESSAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:2833-1 advisory. This update for openssl-11 fixes the following security issues: - CVE-2021-3711: A bug in the implementation of the SM2...

SUSE: Security Advisory (SUSE-SU-2021:2830-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

OpenSSL: SM2 Decryption Buffer Overflow (20210824) - Linux

OpenSSL is prone to a buffer overflow vulnerability. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Security update for openssl-1_1 (important)

openSUSE Security Update: Security update for openssl-11 Announcement ID: openSUSE-SU-2021:1188-1 Rating: important References: 1189520 1189521 Cross-References: CVE-2021-3711 CVE-2021-3712 CVSS scores: CVE-2021-3711 SUSE: 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-3712 SUSE: 5.3...

CVE-2021-3711

creationtimestamp| type| source ---|---|--- 2021-08-24 18:23:26+00:00| seen| https://t.me/cibsecurity/27773 2021-08-24 23:51:07+00:00| seen| https://t.me/ctinow/38926 2021-09-02 11:05:07+00:00| published-proof-of-concept| https://t.me/CyberSecurityTechnologies/4203 2021-09-03 11:59:41+00:00| seen...

[SECURITY] [DSA 4963-1] openssl security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4963-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso August 24, 2021 https://www.debian.org/security/faq -...

DEBIAN-CVE-2021-3711

In order to decrypt SM2 encrypted data an application is expected to call the API function EVPPKEYdecrypt. Typically an application will call this function twice. The first time, on entry, the "out" parameter can be NULL and, on exit, the "outlen" parameter is populated with the buffer size...