27625 matches found
Openssl_V.1.1.1g
OpenSSL 1.1.1g 21 Apr 2020 Copyright c 1998-2020 The OpenSSL Project Copyright c 1995-1998 Eric A. Young, Tim J. Hudson All rights reserved. DESCRIPTION The OpenSSL Project is a collaborative effort to develop a robust, commercial-grade, fully featured, and Open Source toolkit implementing the...
openssl_g2.5_v1_0_1g
OpenSSL 1.0.1g 7 Apr 2014 Copyright c 1998-2011 The OpenSSL Project Copyright c 1995-1998 Eric A. Young, Tim J. Hudson All rights reserved. DESCRIPTION The OpenSSL Project is a collaborative effort to develop a robust, commercial-grade, fully featured, and Open Source toolkit implementing the...
deluded-openssl-3.2.0
Welcome to the OpenSSL Project !openssl logo !github actions ci badgegithub actions ci !appveyor badgeappveyor jobs OpenSSL is a robust, commercial-grade, full-featured Open Source Toolkit for the TLS formerly SSL, DTLS and QUIC currently client side only protocols. The protocol implementations a...
CVE-2026-63072
🔐 CVE-2026-63072 — OpenSSL CMS Heap Buffer Overflow A technical analysis ofCVE-2026-63072 , a heap-based out-of-bounds write affecting OpenSSL's CMS key-unwrapping functionality. 📌 Overview CVE-2026-63072 is a heap-based buffer overflow vulnerability in OpenSSL's CMS Cryptographic Message Syntax...
bleeding-heart
Heartbleed The Heartbleed bug CVE-2014-0160 is a severe implementation flaw in the OpenSSL library, which enables attackers to steal data from the memory of the victim server. The contents of the stolen data depend on what is there in the memory of the server. It could potentially contain private...
Heartbleed-PoC-Exploit-Script
Heartbleed-PoC-Exploit-Script This Python Proof-of-Concept PoC script detects the Heartbleed vulnerability CVE-2014-0160 by performing a TLS handshake with the heartbeat extension and sending a crafted heartbeat request. It parses server responses to identify leaked memory, helping assess...
CTT-HEARTBLEED-Temporal-Resonance-Memory-Leak-Exploit-Heartbleed-CVE-2014-0160
CTT-HEARTBLEED-Temporal-Resonance-Memory-Leak-Exploit-Heartbleed-CVE-2014-0160 Heartbleed CVE-2014-0160 was devastating because it leaked adjacent memory. CTT-Heartbleed goes further—it uses 33-layer temporal resonance to map, reconstruct, and extract specific memory regions across time, not just...
CVE-2026-41940-Security-Patch
CVE-2026-41940-Security-Patch Unofficial temporary patch for the CVE-2026-41940 vulnerability Can be used for temporary defense Please upgrade to the official release as soon as conditions permit cPanel Security Announcement:...
Astra Linux – Vulnerability in Bouncycastle
Bouncy Castle for Java before version 1.73 contains a potential Denial of Service DoS issue within the Bouncy Castle org.bouncycastle.openssl.PEMParser class. This class parses OpenSSL PEM-encoded streams containing X.509 certificates, PKCS8-encoded keys, and PKCS7 objects. Parsing a file that...
Important: Red Hat Security Advisory: openssl security update
An update for openssl is now available for Red Hat Enterprise Linux 9.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...
openssl: openssl: Information Disclosure from Uninitialized Memory via Invalid RSA Public Key
A flaw was found in openssl. Applications that use RSASVE key encapsulation, a method for securely exchanging encryption keys, may inadvertently expose sensitive data. This vulnerability arises when an application processes a malicious, invalid RSA public key provided by an attacker without prope...
openssl: Heap Use-After-Free in OpenSSL PKCS7_verify()
A flaw was found in OpenSSL. When processing a specially crafted PKCS7 or S/MIME Secure/Multipurpose Internet Mail Extensions signed message, a heap use-after-free vulnerability in the PKCS7verify function can be triggered. This occurs if the SignedData digestAlgorithms field is present as an emp...
openssl: OpenSSL: Denial of Service due to NULL pointer dereference in CMS EnvelopedData processing
A flaw was found in OpenSSL. A remote attacker could exploit this vulnerability by sending a specially crafted Cryptographic Message Syntax CMS EnvelopedData message. During the processing of a KeyTransportRecipientInfo with RSA-OAEP encryption, the system attempts to access an optional parameter...
openssl: OpenSSL: Information disclosure and data tampering via specific low-level OCB encryption/decryption calls
A flaw was found in OpenSSL. When applications directly call the low-level CRYPTOocb128encrypt or CRYPTOocb128decrypt functions with non-block-aligned lengths in a single call on hardware-accelerated builds, the trailing 1-15 bytes of a message may be exposed in cleartext. These exposed bytes are...
openssl: AES-OCB IV Ignored on EVP_Cipher() Path
A flaw was found in OpenSSL. Applications that use the AES-OCB encryption method with a specific one-shot interface EVPCipher will have their provided Initialization Vector IV silently discarded. This leads to the same internal cryptographic value being used repeatedly, which compromises the...
openssl: CMS AuthEnvelopedData Processing May Accept Forged Messages
A flaw was found in OpenSSL's Cryptographic Message Services CMS AuthEnvelopedData processing. An on-path attacker can exploit insufficient input validation on cipher and tag length fields by sending specially crafted CMS messages. This can lead to the forging of messages or bypassing integrity...
openssl: Unbounded Memory Growth in the QUIC PATH_CHALLENGE Handler
A flaw was found in OpenSSL's QUIC PATHCHALLENGE handler. A remote attacker can exploit this vulnerability by flooding a QUIC client or server with specially crafted PATHCHALLENGE frames. This leads to unbounded memory allocation within the local QUIC stack, as the system continuously allocates...
io.netty/netty-handler: Netty: TLS hostname verification bypass via OpenSSL client path misconfiguration
A flaw was found in Netty io.netty:netty-handler. When using the SslProvider.OPENSSL client path with a plain X509TrustManager and without Unsafe-based trust-manager wrapping Java 25+, TLS hostname verification is disabled. This misconfiguration allows a man-in-the-middle attacker to present a...
ssl-heartbleed.nse
ssl-heartbleed.nse Nmap NSE script that discovers/exploits Heartbleed/CVE-2014-0160. This script is now basically the one Patrik Karlsson wrote with some minor changes ported from my own script. Features Includes support for FTP,SMTP,XMPP...