OESA-2026-3830 openssl security update

OpenSSL is a robust, commercial-grade, and full-featured toolkit for the Transport Layer Security TLS and Secure Sockets Layer SSL protocols. Security Fixes: Issue summary: In a server or client configuration with RFC7250 Raw Public Keys RPKs enabled, and only the private key with no associated...

OESA-2026-3828 openssl security update

OpenSSL is a robust, commercial-grade, and full-featured toolkit for the Transport Layer Security TLS and Secure Sockets Layer SSL protocols. Security Fixes: Issue summary: Receiving a DTLS record for a future epoch while a handshake is in progress causes OpenSSL to buffer far more memory than th...

OESA-2026-3829 openssl security update

OpenSSL is a robust, commercial-grade, and full-featured toolkit for the Transport Layer Security TLS and Secure Sockets Layer SSL protocols. Security Fixes: Issue summary: Receiving a DTLS record for a future epoch while a handshake is in progress causes OpenSSL to buffer far more memory than th...

OESA-2026-3827 openssl security update

OpenSSL is a robust, commercial-grade, and full-featured toolkit for the Transport Layer Security TLS and Secure Sockets Layer SSL protocols. Security Fixes: Issue summary: Receiving a DTLS record for a future epoch while a handshake is in progress causes OpenSSL to buffer far more memory than th...

OESA-2026-3826 openssl security update

OpenSSL is a robust, commercial-grade, and full-featured toolkit for the Transport Layer Security TLS and Secure Sockets Layer SSL protocols. Security Fixes: Issue summary: Receiving a DTLS record for a future epoch while a handshake is in progress causes OpenSSL to buffer far more memory than th...

OESA-2026-3820 compat-openssl11 security update

OpenSSL is a robust, commercial-grade, and full-featured toolkit for the Transport Layer Security TLS and Secure Sockets Layer SSL protocols. Security Fixes: Issue summary: Receiving a DTLS record for a future epoch while a handshake is in progress causes OpenSSL to buffer far more memory than th...

cve-2020-0601

Zeek test script for CVE-2020-0601 Este script puede detectar intentos de explotación de CVE-2020-0601. Realiza una comprobación simple para ver si se utiliza una curva conocida en un certificado; si no es el caso, se genera una notificación. Ejemplo de notificación en notice.log: root@kitploit:...

cve-2022-3602-and-cve-2022-3786-openssl-poc

Este repositorio no tiene un README...

FREAK-Attack-CVE-2015-0204-Testing-Script

FREAK 攻击 CVE-2015-0204 测试脚本 基于 Akamai 建议的 OpenSSL FREAK 攻击（CVE-2015-0204）自动化测试基础 BASH 脚本。它是自由软件，无需在其他人的服务器上运行。在正常情况下，你的服务器在 SSL Labs 测试中必须获得 A+ 评级，并且应被列为 HSTS 预加载列表中的网站以增强安全性。 除了知名的网络服务提供商，不要在 SSL Lab 上对某个混蛋的服务器测试你自己的网站。先测试那个服务器，发现其网站存在安全漏洞并不罕见。 该脚本按照 Akamai...

HeartLeak

HeartLeak 又一个针对史上最热门的漏洞的利用脚本。 该脚本有两个功能： scan: 生成随机主机（IP地址），检查它们是否支持OpenSSL，测试它们是否存在CVE-2014-0160（心跳缓冲区过度读取漏洞）漏洞，并将存在漏洞的主机保存到TXT文件中 monitor: 持续发送恶意心跳请求，将泄露的数据原样转储到文件中。同时查找可打印数据，将其保存到TXT文件中并在屏幕上显示。...

Astra Linux – Vulnerability in Bouncycastle

Bouncy Castle for Java before version 1.73 contains a potential Denial of Service DoS issue within the Bouncy Castle org.bouncycastle.openssl.PEMParser class. This class parses OpenSSL PEM-encoded streams containing X.509 certificates, PKCS8-encoded keys, and PKCS7 objects. Parsing a file that...

CVE-2026-45447

🚨 CVE-2026-45447 - OpenSSL 关键释放后使用漏洞 PKCS7verify 中的堆释放后使用漏洞，可能导致内存损坏、崩溃和潜在远程代码执行。 📖 执行摘要 CVE-2026-45447 是 OpenSSL 的 PKCS7 验证功能 中的一个关键漏洞。 该缺陷存在于 PKCS7verify 代码路径中，可通过特制的包含畸形 ASN.1 结构的 PKCS7 或 S/MIME 签名消息触发。 成功利用可能导致： 堆损坏 应用程序崩溃 拒绝服务 DoS 潜在远程代码执行 RCE 🎯 漏洞信息 📸 演示 🔥 技术描述 恶意行为者可以构造一个特制的： PKCS7...

CVE-2016-2107

CVE-2016-2107 针对2016年5月OpenSSL填充预言机（CVE-2016-2107）的简单测试 安装 root@kitploit: $ go version go version go1.6.2 darwin/amd64 $ go get github.com/FiloSottile/CVE-2016-2107 此工具仅适用于 Go 1.6+，并且只有在正确下载到 $GOPATH 路径下时才能构建。 用法 root@kitploit: $ CVE-2016-2107 filippo.io 2016/05/03 17:50:49 Vulnerable: false...

openssl: untrusted sender DN used as format string in CMP response validation

A flaw was found in OpenSSL. A malicious CMP Certificate Management Protocol endpoint can send an unexpected distinguished name DN directly as the format string argument to ERRraisedata, causing the application to dereference and write to unrelated stack contents. This can lead to a crash in the...

openssl: excessive memory use buffering DTLS records for a future epoch

A flaw was found in OpenSSL. Receiving a DTLS Datagram Transport Layer Security record for a future epoch while a handshake is in progress causes OpenSSL to buffer an excessive amount of memory. This allows a peer to cause memory exhaustion, eventually resulting in a denial of service, using a...

openssl: heap buffer overflow in CMS key unwrapping

A flaw was found in OpenSSL. A crafted CMS Cryptographic Message Syntax message can cause an 8-byte out-of-bounds heap write when it is decrypted with CMSdecrypt. This issue occurs because the CMS decryption process incorrectly sizes the key-unwrap output buffer when using the AES-WRAP-PAD unwrap...

openssl: CMP indefinite cache growth of ExtraCerts

A flaw was found in OpenSSL. The CMP Certificate Management Protocol implementation does not clear cached additional certificates when an invalid message is received, leading to excessive memory consumption. This allows a malicious client to repeatedly send requests containing unique extra...

openssl: QUIC server may trigger double free when processing INITIAL packet

A flaw was found in OpenSSL. A malformed INITIAL packet with an invalid DCID destination connection ID can cause the QUIC server to double free the QRX object. This issue leads to memory corruption, causing the termination of the QUIC server process and resulting in a denial of service...

Important: Red Hat Security Advisory: openssl security, bug fix, and enhancement update

An update for openssl is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...

openssl: OpenSSL: Denial of Service via unbounded memory growth in QUIC server

A flaw was found in OpenSSL. A remote attacker could exploit this by sending a large number of QUIC Initial packets to an OpenSSL QUIC server. This can cause the server to allocate and queue new incoming channels without limit, leading to unbounded memory growth. The excessive memory consumption...