PT-2024-40389 · Openssl · Openssl

Name of the Vulnerable Software and Affected Versions: OpenSSL versions prior to 0.6.2 Description: The issue allows an attacker to learn parts of the secret key when they can time decapsulation and forge cipher texts on certain platforms. This does not affect ephemeral usage, such as regular use...

Security Bulletin: IBM MQ is affected by OpenSSL vulnerability (CVE-2023-5363)

Summary IBM MQ is vulnerable to an OpenSSL vulnerability CVE-2023-5363 during initialization of some symmetric ciphers. Vulnerability Details CVEID:CVE-2023-5363 DESCRIPTION: OpenSSL could allow a remote attacker to obtain sensitive information, caused by an incorrect cipher key and IV length...

Security Bulletin: IBM Flex System switch firmware products are affected by a vulnerability in OpenSSL (CVE-2019-1559)

Summary IBM Flex System switch firmware products have addressed the following OpenSSL vulnerability. Vulnerability Details CVEID: CVE-2019-1559 DESCRIPTION: OpenSSL could allow a remote attacker to obtain sensitive information, caused by the failure to immediately close the TCP connection after t...

Security Bulletin: IBM Integrated Management Module II (IMM2) is affected by vulnerability in OpenSSL (CVE-2018-0732)

Summary IBM Integrated Management Module II IMM2 has addressed the following vulnerability in OpenSSL. Vulnerability Details CVEID: CVE-2018-0732 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by the sending of a very large prime value to the client by a malicious server during...

openssl: Denial of service by excessive resource usage in verifying X509 policy constraints

A security vulnerability has been identified in all supported OpenSSL versions related to verifying X.509 certificate chains that include policy constraints. This flaw allows attackers to exploit this vulnerability by creating a malicious certificate chain that triggers exponential use of...

node-openssl Security Vulnerabilities

node-openssl is the openssl package for nodejs. A security vulnerability exists in node-openssl version 2.0.0 and earlier, which stems from a security flaw in the opts parameter...

PT-2023-8644

Name of the Vulnerable Software and Affected Versions OpenSSL versions prior to 3.2 excluding FIPS modules in 3.2, 3.1, and 3.0 Description The issue arises from the improper handling of NULL fields in PKCS12 files, leading to a potential Denial of Service attack. Applications loading files in th...

AZL-31872 CVE-2023-5678 affecting package edk2 for versions less than 20230301gitf80f052277c8-38

Issue summary: Generating excessively long X9.42 DH keys or checking excessively long X9.42 DH keys or parameters may be very slow. Impact summary: Applications that use the functions DHgeneratekey to generate an X9.42 DH key may experience long delays. Likewise, applications that use...

AZL-42685 CVE-2023-5678 affecting package cloud-hypervisor-cvm for versions less than 38.0.72.2-1

Issue summary: Generating excessively long X9.42 DH keys or checking excessively long X9.42 DH keys or parameters may be very slow. Impact summary: Applications that use the functions DHgeneratekey to generate an X9.42 DH key may experience long delays. Likewise, applications that use...

DEBIAN-CVE-2023-5678

Issue summary: Generating excessively long X9.42 DH keys or checking excessively long X9.42 DH keys or parameters may be very slow. Impact summary: Applications that use the functions DHgeneratekey to generate an X9.42 DH key may experience long delays. Likewise, applications that use...

F5 Networks BIG-IP : OpenSSL vulnerability (K08044291)

The version of F5 Networks BIG-IP installed on the remote host is prior to 14.1.0.2 / 15.0.0. It is, therefore, affected by a vulnerability as referenced in the K08044291 advisory. - Constructed ASN.1 types with a recursive definition such as can be found in PKCS7 could eventually exceed the stac...

Tenable Network Security Nessus Security Vulnerability

Tenable Network Security Nessus is an open source system vulnerability scanner from Tenable Network Security, USA. A security vulnerability exists in Tenable Network Security Nessus versions prior to 10.6.2, which stems from a third-party component OpenSSL, zlib inclusion vulnerability that allow...

OpenSSL 3.0.0 < 3.0.12 Multiple Vulnerabilities

The version of OpenSSL installed on the remote host is prior to 3.0.12. It is, therefore, affected by multiple vulnerabilities as referenced in the 3.0.12 advisory. - Issue summary: The POLY1305 MAC message authentication code implementation contains a bug that might corrupt the internal state of...

Missing Cryptographic Step

Overview openssl is a package that wraps the OpenSSL library. Affected versions of this package are vulnerable to Missing Cryptographic Step when the EVPEncryptInitex2, EVPDecryptInitex2 or EVPCipherInitex2 functions are used. An attacker can cause truncation or overreading of key and...

Security Bulletin: IBM App Connect Enterprise is vulnerable to a remote attacker due to OpenSSL

Summary IBM App Connect Enterprise is vulnerable to a remote attacker due to OpenSSL CVE-2023-2975. The resolving fix contains node.js 18.17.1 which includes OpenSSL v3.0.10.0+quic1 Vulnerability Details CVEID:CVE-2023-2975 DESCRIPTION: OpenSSL could allow a remote attacker to bypass security...

Medium: openssl-snapsafe

Issue Overview: Issue summary: Checking excessively long DH keys or parameters may be very slow. Impact summary: Applications that use the functions DHcheck, DHcheckex or EVPPKEYparamcheck to check a DH key or DH parameters may experience long delays. Where the key or parameters that are being...

GHSA-V8GR-M533-GHJ9 Vulnerable OpenSSL included in cryptography wheels

pyca/cryptography's wheels include a statically linked copy of OpenSSL. The versions of OpenSSL included in cryptography 2.5-41.0.3 are vulnerable to several security issues. More details about the vulnerabilities themselves can be found in https://www.openssl.org/news/secadv/20230908.txt. If you...

OpenSSL 3.1.0 < 3.1.3 Vulnerability

The version of OpenSSL installed on the remote host is prior to 3.1.3. It is, therefore, affected by a vulnerability as referenced in the 3.1.3 advisory. - Issue summary: The POLY1305 MAC message authentication code implementation contains a bug that might corrupt the internal state of applicatio...

CVE-2023-4807 POLY1305 MAC implementation corrupts XMM registers on Windows

Issue summary: The POLY1305 MAC message authentication code implementation contains a bug that might corrupt the internal state of applications on the Windows 64 platform when running on newer X8664 processors supporting the AVX512-IFMA instructions. Impact summary: If in an application that uses...

Security Bulletin: IBM Storage Insights is vulnerable to weaknesses related to OpenSSL

Summary Vulnerability in OpenSSL may affect IBM Storage Insights. Vulnerability Details CVEID:CVE-2023-2650 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by a flaw when using OBJobj2txt directly, or use any of the OpenSSL subsystems OCSP, PKCS7/SMIME, CMS, CMP/CRMF or TS with ...