PT-2022-2691

Name of the Vulnerable Software and Affected Versions OpenSSL versions 1.0.2 through 1.0.2zd OpenSSL versions 1.1.1 through 1.1.1n OpenSSL versions 3.0.0 through 3.0.2 Description The c rehash script does not properly sanitise shell metacharacters to prevent command injection. This script is...

Impact of the OpenSSL Infinite Loop Vulnerability CVE-2022-0778

The Palo Alto Networks Product Security Assurance team has evaluated the OpenSSL infinite loop vulnerability CVE-2022-0778 as it relates to our products. This vulnerability causes the OpenSSL library to enter an infinite loop when parsing an invalid certificate and can result in a Denial-of-Servi...

Security Bulletin: IBM QRadar Network Security is affected by an OpenSSL vulnerability (CVE-2021-3712)

Summary OpenSSL is used within IBM QRadar Network Security. Openssl has a bug which might lead to a denial of service or the ability for an attacker to read system memory. QRadar Network Security has addressed the issue with a firmware update. Vulnerability Details CVEID: CVE-2021-3712 DESCRIPTIO...

Oracle Linux 6 : openssl (ELSA-2022-9246)

The remote Oracle Linux 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2022-9246 advisory. 1.0.1e-59.0.3 - Fix possible infinite loop in BNmodsqrt CVE-2022-0778Orabug: 33969800 Tenable has extracted the preceding description block directly from the...

Oracle Linux 8 : openssl (ELSA-2022-9233)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2022-9233 advisory. 1:1.1.1k-5.0.1 - fix CVE-2022-0778 - possible infinite loop in BNmodsqrt Orabug: 33974871 Tenable has extracted the preceding description block directly from th...

OpenSSL Infinite loop when parsing certificates CVE-2022-0778

A vulnerability CVE-2022-0778 was found in OpenSSL that allows to trigger an infinite loop by crafting a certificate that has invalid elliptic curve parameters. Since certificate parsing happens before verification of the certificate signature, any process that parses an externally supplied...

Ubuntu 16.04 ESM : OpenSSL vulnerability (USN-5328-2)

The remote Ubuntu 16.04 ESM host has packages installed that are affected by a vulnerability as referenced in the USN-5328-2 advisory. USN-5328-1 fixed a vulnerability in OpenSSL. This update provides the corresponding update for Ubuntu 14.04 ESM and Ubuntu 16.04 ESM. Tenable has extracted the...

CVE-2022-25219

A null byte interaction error has been discovered in the code that the telnetdstartup daemon uses to construct a pair of ephemeral passwords that allow a user to spawn a telnet service on the router, and to ensure that the telnet service persists upon reboot. By means of a crafted exchange of UDP...

Security Bulletin: OpenSSL vulnerability affects IBM Spectrum Control (formerly Tivoli Storage Productivity Center) (CVE-2019-1559)

Summary An OpenSSL vulnerability was disclosed on February 26, 2019 by the OpenSSL Project. OpenSSL, used by IBM Spectrum Control formerly Tivoli Storage Productivity Center, has addressed the applicable CVE. Vulnerability Details CVE-ID: CVE-2019-1559 Description: OpenSSL could allow a remote...

Security Bulletin: IBM Spectrum Control (formerly IBM Tivoli Storage Productivity is affected by an OpenSSL vulnerabilitiy (CVE-2018-0739)

Summary An OpenSSL vulnerability was disclosed March 2018 by the OpenSSL Project. OpenSSL, used by IBM Spectrum Control formerly Tivoli Storage Productivity Center, has addressed the applicable CVE. Vulnerability Details CVEID: CVE-2018-0739 DESCRIPTION: OpenSSL is vulnerable to a denial of...

EulerOS Virtualization 3.0.6.6 : openssl (EulerOS-SA-2022-1135)

According to the versions of the openssl packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - ASN.1 strings are represented internally within OpenSSL as an ASN1STRING structure which contains a buffer holding the string da...

PT-2022-1848

Name of the Vulnerable Software and Affected Versions OpenSSL versions 1.0.2 through 1.0.2zc OpenSSL versions 1.1.1 through 1.1.1m OpenSSL versions 3.0.0 through 3.0.1 Description The BN mod sqrt function in OpenSSL contains a bug that can cause it to loop forever for non-prime moduli, leading to...

Siemens S7 Heartbleed (CVE-2014-0160)

The 1 TLS and 2 DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information from process memory via crafted packets that trigger a buffer over-read, as demonstrated by reading private keys,...

Security Bulletin: OpenSSL Vulnerability affects IBM Spectrum Protect Snapshot (formerly Tivoli Storage FlashCopy Manager) for Unix (CVE-2017-3737)

Summary OpenSSL vulnerabilities were disclosed on December 7, 2017 by the OpenSSL Project. OpenSSL, used by IBM Spectrum Protect Snapshot formerly Tivoli Storage FlashCopy Manager for Unix, has addressed the applicable CVE. Vulnerability Details CVEID: CVE-2017-3737 DESCRIPTION: An unspecified...

Privilege escalation

A privilege escalation vulnerability in the McAfee Agent prior to 5.7.5. McAfee Agent uses openssl.cnf during the build process to specify the OPENSSLDIR variable as a subdirectory within the installation directory. A low privilege user could have created subdirectories and executed arbitrary cod...

Scientific Linux Security Update : openssl on SL7.x i686/x86_64 (2022:0064)

The remote Scientific Linux 7 host has packages installed that are affected by a vulnerability as referenced in the SLSA-2022:0064-1 advisory. - openssl: Read buffer overruns processing ASN.1 strings CVE-2021-3712 Note that Nessus has not tested for this issue but has instead relied only on the...

Oracle Linux 8 : openssl (ELSA-2021-5226)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2021-5226 advisory. - CVE-2021-3712 openssl: Read buffer overruns processing ASN.1 strings Tenable has extracted the preceding description block directly from the Oracle Linux...

Security Bulletin: IBM MQ Appliance is affected by an OpenSSL vulnerability (CVE-2021-3712)

Summary IBM MQ Appliance has resolved an OpenSSL vulnerability Vulnerability Details CVEID: CVE-2021-3712 DESCRIPTION: OpenSSL could allow a remote attacker to obtain sensitive information, caused by an out-of-bounds read when processing ASN.1 strings. By sending specially crafted data, an attack...

Security Bulletin: IBM WebSphere MQ for HP NonStop Server is affected by OpenSSL vulnerability CVE-2021-3712

Summary The OpenSSL component of IBM WebSphere MQ for HP NonStop Server could allow a remote attacker to obtain sensitive information. The issue is described by CVE-2021-3712. Vulnerability Details CVEID: CVE-2021-3712 DESCRIPTION: OpenSSL could allow a remote attacker to obtain sensitive...

Security Bulletin: This Power System update is being released to address CVE-2018-0732

Summary POWER9: In response to a denial of service vulnerability in OpenSSL, a new Power Systems firmware update is being released to address Common Vulnerabilities and Exposures issue number CVE-2018-0732. A malicious server can send a large prime value to a client during DHE TLS handshake causi...