GHSA-2CJ7-MG3X-9MHQ vulnerabilities

Vulnerabilities for packages: openssl...

GHSA-HVC4-MJV4-5MW6 vulnerabilities

Vulnerabilities for packages: openssl-provider-fips-3.1.2, openssl-provider-fips, openssl...

GHSA-R9FV-H47R-823F vulnerabilities

Vulnerabilities for packages: openssl-provider-fips-3.1.2, openssl-provider-fips, openssl...

GHSA-299C-JVHC-GXJ8 vulnerabilities

Vulnerabilities for packages: openssl...

GHSA-XW78-PCR6-WRG8 vulnerabilities

Vulnerabilities for packages: openssl...

GHSA-GQXG-9VFR-P9CG vulnerabilities

Vulnerabilities for packages: openssl...

GHSA-Q764-R57M-9WP9 vulnerabilities

Vulnerabilities for packages: libcrypto3-2.34, openssl-provider-fips, openssl...

GHSA-77F3-6546-6RJ7 vulnerabilities

Vulnerabilities for packages: openssl-provider-fips, openssl...

GHSA-W2W6-XP88-5CVW vulnerabilities

Vulnerabilities for packages: openssl-provider-fips, openssl...

GHSA-4WP2-XW7P-2GFX vulnerabilities

Vulnerabilities for packages: openssl-provider-fips, openssl...

Azure Linux 3.0 Security Update: cloud-hypervisor-cvm / openssl (CVE-2024-12797)

The version of cloud-hypervisor-cvm / openssl installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-12797 advisory. - Issue summary: Clients using RFC7250 Raw Public Keys RPKs to authenticate a server M...

Siemens SIMATIC and RUGGEDCOM Devices Linux Kernel Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CVE-2022-2068)

In addition to the crehash shell command injection identified in CVE-2022-1292, further circumstances where the crehash script does not properly sanitise shell metacharacters to prevent command injection were found by code review. When the CVE-2022-1292 was fixed it was not discovered that there...

Siemens SIMATIC Devices Linux Kernel Out-of-bounds Write (CVE-2022-2274)

The OpenSSL 3.0.4 release introduced a serious bug in the RSA implementation for X8664 CPUs supporting the AVX512IFMA instructions. This issue makes the RSA implementation with 2048 bit private keys incorrect on such machines and memory corruption will happen during the computation. As a...

AIX is vulnerable to information disclosure (CVE-2024-13176) or arbitrary code execution or a denial of service (CVE-2024-9143) due to OpenSSL

IBM SECURITY ADVISORY First Issued: Mon Feb 24 15:15:11 CST 2025 The most recent version of this document is available here: https://aix.software.ibm.com/aix/efixes/security/openssladvisory44.asc Security Bulletin: AIX is vulnerable to information disclosure CVE-2024-13176 or arbitrary code...

Advisory ROSA-SA-2025-2715

Software: openssl 1.1.1k OS: ROSA Virtualization 3.0 packageevrstring: openssl-1.1.1.1k-12.0.1 CVE-ID: CVE-2022-1292 BDU-ID: 2022-03181 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the OpenSSL library's crehash script implementation is related to failure to take measures to neutralize shell...

Siemens SCALANCE Devices Uncontrolled Resource Consumption (CVE-2023-6237)

Issue summary: Checking excessively long invalid RSA public keys may take a long time. Impact summary: Applications that use the function EVPPKEYpubliccheck to check RSA public keys may experience long delays. Where the key that is being checked has been obtained from an untrusted source this may...

Siemens SIMATIC and SCALANCE Devices Inefficient Regular Expression Complexity (CVE-2023-3446)

Issue summary: Checking excessively long DH keys or parameters may be very slow. Impact summary: Applications that use the functions DHcheck, DHcheckex or EVPPKEYparamcheck to check a DH key or DH parameters may experience long delays. Where the key or parameters that are being checked have been...

Siemens SCALANCE Devices Out-of-bounds Write (CVE-2023-6129)

Issue summary: The POLY1305 MAC message authentication code implementation contains a bug that might corrupt the internal state of applications running on PowerPC CPU based platforms if the CPU provides vector instructions. Impact summary: If an attacker can influence whether the POLY1305 MAC...

Siemens SIMATIC and SCALANCE Devices Exposure of Sensitive Information to an Unauthorized Actor (CVE-2024-5535)

Calling the OpenSSL API function SSLselectnextproto with an empty supported client protocols buffer may cause a crash or memory contents to be sent to the peer. A buffer overread can have a range of potential consequences such as unexpected application beahviour or a crash. In particular this iss...

openSUSE Security Advisory (SUSE-SU-2025:0613-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...