OpenSSL 代码问题漏洞

OpenSSL is an open source capable general-purpose cryptographic library from the OpenSSL team that implements the Secure Sockets Layer SSLv2/v3 and Secure Transport Layer TLSv1 protocols. It supports a variety of cryptographic algorithms, including symmetric ciphers, hashing algorithms, secure...

Security Bulletin: IBM Security Verify Governance is vulnerable to denial of service due to an OpenSSL vulnerability

Summary IBM Security Verify Governance is vulnerable to denial of service due to a vulnerability in OpenSSL CVE-2022-0778. The fix linked below upgrades OpenSSL to the patched version. Vulnerability Details CVEID:CVE-2022-0778 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by a...

Exploit for Out-of-bounds Read in Openssl

Heartbleed CVE-2014-0160 ========== Setup You will requir...

K15389: OpenSSL vulnerability CVE-2011-4576

Security Advisory Description The SSL 3.0 implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f does not properly initialize data structures for block cipher padding, which might allow remote attackers to obtain sensitive information by decrypting the padding data sent by an SSL peer...

OpenSSL 安全漏洞

OpenSSL is an open source capable general-purpose cryptographic library from the OpenSSL team that implements the Secure Sockets Layer SSLv2/v3 and Secure Transport Layer TLSv1 protocols. It supports a variety of cryptographic algorithms, including symmetric ciphers, hashing algorithms, secure...

PT-2023-1352

Name of the Vulnerable Software and Affected Versions OpenSSL affected versions not specified Description There is a type confusion vulnerability relating to X.400 address processing inside an X.509 GeneralName. X.400 addresses were parsed as an ASN1 STRING but the public structure definition for...

PT-2022-6260

Name of the Vulnerable Software and Affected Versions OpenSSL affected versions not specified MySQL Server versions 5.7.41 and earlier, 8.0.32 and earlier Description The public API function BIO new NDEF is a helper function used for streaming ASN.1 data via a BIO. It is primarily used internally...

Threat Source newsletter (Nov. 3, 2022): Mastodon, evolution, and LiveJournal oh my!

Welcome to this weeks edition of the Threat Source newsletter. Im fascinated by how things live and die on the internet. Things that are ubiquitous to our daily lives are simply gone the next. LiveJournal and Myspace we hardly knew you. Elon Musks purchase of Twitter and the subsequent exodus led...

GHSA-39HC-V87J-747X Vulnerable OpenSSL included in cryptography wheels

pyca/cryptography's wheels include a statically linked copy of OpenSSL. The versions of OpenSSL included in cryptography 37.0.0-38.0.3 are vulnerable to a number of security issues. More details about the vulnerabilities themselves can be found in https://www.openssl.org/news/secadv/20221101.txt...

roaring-landmask (=0.4.0) potentially affected by CVE-2022-3786 via openssl-src (=300.0.0+3.0.0)

openssl-src CARGO version =300.0.0+3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on openssl-src and may be impacted: - roaring-landmask =0.4.0 Source cves: CVE-2022-3786 Source advisory: OSV:GHSA-H8JM-2X53-XHP5...

Fedora 36 : openssl (2022-502f096dce)

The remote Fedora 36 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2022-502f096dce advisory. Security fix for CVE-2022-3602 and CVE-2022-3786 Tenable has extracted the preceding description block directly from the Fedora security advisory...

Effectively Preparing for the OpenSSL 3.x Vulnerability

With all the noise about the OpenSSL vulnerability, see this blog about how to prepare for mitigation when the patch is released...

OpenSSL 安全漏洞

OpenSSL is a powerful, commercial-grade, full-featured open source toolkit for the Transport Layer Security TLS protocol, which is implemented based on the Full Strength Common Cryptographic Library for protecting communications on computer networks from eavesdropping and is widely used by Intern...

OpenSSL 缓冲区错误漏洞

OpenSSL is a powerful, commercial-grade, full-featured open source toolkit for the Transport Layer Security TLS protocol, a protocol implementation based on the Full Strength Common Cryptographic Library used to protect communications on computer networks from eavesdropping and widely used by...

roaring-landmask (=0.4.0) potentially affected by CVE-2022-3358 via openssl-src (=300.0.0+3.0.0)

openssl-src CARGO version =300.0.0+3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on openssl-src and may be impacted: - roaring-landmask =0.4.0 Source cves: CVE-2022-3358 Source advisory: OSV:RUSTSEC-2022-0059...

Security Bulletin: IBM Sterling Connect:Direct for UNIX container is vulnerable to obtain sensitive information due to OpenSSL (CVE-2022-2097)

Summary There is a vulnerability in the OpenSSL library used by IBM Sterling Connect:Direct for UNIX container. IBM Sterling Connect:Direct for UNIX Container has addressed the applicable issue by upgrading OpenSSL to 1.1.1k. Vulnerability Details CVEID:CVE-2022-2097 DESCRIPTION: OpenSSL could...

OESA-2022-1899 linux-sgx security update

IntelR Software Guard Extensions IntelR SGX is an Intel technology for application developers seeking to protect select code and data from disclosure or modification. Security Fixes: In addition to the crehash shell command injection identified in CVE-2022-1292, further circumstances where the...

Security Bulletin: Power Systems Firmware affected by vulnerability in OpenSSL (CVE-2016-0797)

Summary Power Systems Firmware affected by vulnerability in OpenSSL CVE-2016-0797 Vulnerability Details CVEID: CVE-2016-0797 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by a NULL pointer dereference in the BNhex2bn/BNdec2bn function. An attacker could exploit this...

Security Bulletin: IBM MQ Advanced Message Security is vulnerable to an OpenSSL Montgomery squaring function propagation flaw (CVE-2017-3736)

Summary IBM MQ and IBM WebSphere MQ are affected by an OpenSSL vulnerability which could allow a remote attacker to obtain sensitive information. This is caused by a carry propagation flaw in the the x8664 Montgomery squaring function bnsqrx8xinternal. OpenSSL is used by IBM MQ Advanced Message...

Security Bulletin: Multiple vulnerabilities in expat, glibc, http server, dojo, openssl shipped with IBM Cloud Pak System

Summary Multiple vulnerabilities in expat, glibc, http server, dojo, openssl shipped with Cloud Pak System. Cloud Pak System has addressed these vulnerabilities. Vulnerability Details CVEID:CVE-2021-46143 DESCRIPTION: Expat could allow a remote attacker to execute arbitrary code on the system,...