1608 matches found
USN-6854-1 openssl vulnerability
It was discovered that OpenSSL failed to choose an appropriately short private key size when computing shared-secrets in the Diffie-Hellman Key Agreement Protocol. A remote attacker could possibly use this issue to cause OpenSSL to consume resources, resulting in a denial of service...
OpenSSL 3.2.0 < 3.2.3 Vulnerability
The version of OpenSSL installed on the remote host is prior to 3.2.3. It is, therefore, affected by a vulnerability as referenced in the 3.2.3 advisory. - Issue summary: Calling the OpenSSL API function SSLselectnextproto with an empty supported client protocols buffer may cause a crash or memor...
MGASA-2024-0226 Updated iperf packages fix security vulnerability
iPerf3 before 3.17, when used with OpenSSL before 3.2.0 as a server with RSA authentication, allows a timing side channel in RSA decryption operations. This side channel could be sufficient for an attacker to recover credential plaintext. It requires the attacker to send a large number of message...
OpenSSL 0.9.8 < 0.9.8p Vulnerability
The version of OpenSSL installed on the remote host is prior to 0.9.8p. It is, therefore, affected by a vulnerability as referenced in the 0.9.8p advisory. - Multiple race conditions in ssl/t1lib.c in OpenSSL 0.9.8f through 0.9.8o, 1.0.0, and 1.0.0a, when multi- threading and internal caching are...
OpenSSL 0.9.8v < 0.9.8w Vulnerability
The version of OpenSSL installed on the remote host is prior to 0.9.8w. It is, therefore, affected by a vulnerability as referenced in the 0.9.8w advisory. - Multiple integer signedness errors in crypto/buffer/buffer.c in OpenSSL 0.9.8v allow remote attackers to conduct buffer overflow attacks, a...
The vulnerability of the OpenSSL cryptographic library, related to resource release errors, allows a hacker to cause a service failure.
The vulnerability of the OpenSSL cryptographic library is related to the use of the non-standard SSLOPNOTICKET option, which allows session cache to grow indefinitely. Exploiting this vulnerability could allow a remote attacker to cause a service failure...
SUSE CVE-2024-4603
Issue summary: Checking excessively long DSA keys or parameters may be very slow. Impact summary: Applications that use the functions EVPPKEYparamcheck or EVPPKEYpubliccheck to check a DSA public key or DSA parameters may experience long delays. Where the key or parameters that are being checked...
SUSE-SU-2024:1633-1 Security update for openssl-1_1
This update for openssl-11 fixes the following issues: - CVE-2024-2511: Fixed unconstrained session cache growth in TLSv1.3 bsc1222548...
PT-2024-7386
Name of the Vulnerable Software and Affected Versions: OpenSSL versions prior to 3.3.3 Description: The issue arises from the use of low-level GF2^m elliptic curve APIs with untrusted explicit values for the field polynomial, leading to out-of-bounds memory reads or writes. This can cause an...
PT-2024-6083
Name of the Vulnerable Software and Affected Versions OpenSSL versions prior to the next release exact version not specified CPython version 3.9 and earlier Description The issue is related to the OpenSSL API function SSL select next proto which can cause a crash or memory contents to be sent to...
openssl: Excessive time spent checking DH keys and parameters
A vulnerability was found in OpenSSL. This security flaw occurs because the applications that use the DHcheck, DHcheckex, or EVPPKEYparamcheck functions to check a DH key or DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an...
OpenSSL 3.1.0 < 3.1.6 Multiple Vulnerabilities
The version of OpenSSL installed on the remote host is prior to 3.1.6. It is, therefore, affected by multiple vulnerabilities as referenced in the 3.1.6 advisory. - Issue summary: Checking excessively long DSA keys or parameters may be very slow. Impact summary: Applications that use the function...
PT-2024-3762
Name of the Vulnerable Software and Affected Versions OpenSSL versions prior to 3.3.0 Description The issue is related to unbounded memory growth when processing TLSv1.3 sessions due to the use of the non-default SSL OP NO TICKET option. This can lead to a Denial of Service. The problem occurs wh...
OpenSSL 1.1.1 < 1.1.1y Multiple Vulnerabilities
The version of OpenSSL installed on the remote host is prior to 1.1.1y. It is, therefore, affected by multiple vulnerabilities as referenced in the 1.1.1y advisory. - Issue summary: Some non-default TLS server configurations can cause unbounded memory growth when processing TLSv1.3 sessions Impac...
PT-2024-21765 · Openssl · Openssl
Name of the Vulnerable Software and Affected Versions: OpenSSL affected versions not specified Description: The issue is related to a possible out-of-bounds OOB read in the asn1 ec pkey parse function of asn1 common.c due to a missing null check. This could lead to local information disclosure...
Security Bulletin: Vulnerability in NX-OS Firmware used by IBM c-type SAN directors and switches.
Summary Public disclosed OpenSSL vulnerability in NX-OS Firmware used by IBM c-type SAN directors and switches. The vulnerability has been addressed and can be resolved by applying the NX-OS code level listed below. Vulnerability Details CVEID:CVE-2023-0466 DESCRIPTION: OpenSSL could allow a remo...
Security Bulletin: This Power System update is being released to address CVE-2022-4450
Summary This affects the BMC administrator function to upload HTTPS certificates. Vulnerability Details CVEID:CVE-2022-4450 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by a double-free error related to the improper handling of specific PEM data by the PEMreadbioex function. ...
Security Bulletin: z/Transaction Processing Facility is affected by an OpenSSL vulnerability
Summary The z/TPF version of OpenSSL was updated to address the vulnerability described by CVE-2024-0727. Vulnerability Details CVEID:CVE-2024-0727 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by improper input validation. By persuading a victim to open a specially crafted...
SUSE SLES15: libopenssl-1_0_0-devel / libopenssl-1_0_0-devel-32bit / etc (SUSE-SU-2024:0831-1)
The remote SUSE Linux SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:0831-1 advisory. - CVE-2024-0727: Denial of service when processing a maliciously formatted PKCS12 file bsc1219243. Tenable has extracted the...