24878 matches found
GHSA-W67W-MW4J-8QRV vulnerabilities
Vulnerabilities for packages: openssl-provider-fips, openssl...
GHSA-W67W-MW4J-8QRV vulnerabilities
Vulnerabilities for packages: openssl...
roaring-landmask (0.4.0) potentially affected by CVE-2023-0216 via openssl-src (300.0.0+3.0.0)
openssl-src CARGO version 300.0.0+3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on openssl-src and may be impacted: - roaring-landmask 0.4.0 Source cves: CVE-2023-0216 Source advisory: OSV:GHSA-29XX-HCV2-C4CP...
openssl-src subject to Invalid pointer dereference in `d2i_PKCS7` functions
An invalid pointer dereference on read can be triggered when an application tries to load malformed PKCS7 data with the d2iPKCS7, d2iPKCS7bio or d2iPKCS7fp functions. The result of the dereference is an application crash which could lead to a denial of service attack. The TLS implementation in...
GHSA-29XX-HCV2-C4CP vulnerabilities
Vulnerabilities for packages: openssl...
GHSA-29XX-HCV2-C4CP vulnerabilities
Vulnerabilities for packages: openssl-provider-fips, openssl...
GHSA-29XX-HCV2-C4CP openssl-src subject to Invalid pointer dereference in `d2i_PKCS7` functions
An invalid pointer dereference on read can be triggered when an application tries to load malformed PKCS7 data with the d2iPKCS7, d2iPKCS7bio or d2iPKCS7fp functions. The result of the dereference is an application crash which could lead to a denial of service attack. The TLS implementation in...
GHSA-V5W6-WCM8-JM4Q openssl-src contains Double free after calling `PEM_read_bio_ex`
The function PEMreadbioex reads a PEM file from a BIO and parses and decodes the "name" e.g. "CERTIFICATE", any header data and the payload data. If the function succeeds then the "nameout", "header" and "data" arguments are populated with pointers to buffers containing the relevant decoded data...
openssl-src contains Double free after calling `PEM_read_bio_ex`
The function PEMreadbioex reads a PEM file from a BIO and parses and decodes the "name" e.g. "CERTIFICATE", any header data and the payload data. If the function succeeds then the "nameout", "header" and "data" arguments are populated with pointers to buffers containing the relevant decoded data...
GHSA-V5W6-WCM8-JM4Q vulnerabilities
Vulnerabilities for packages: openssl...
roaring-landmask (0.4.0) potentially affected by CVE-2022-4450 via openssl-src (300.0.0+3.0.0)
openssl-src CARGO version 300.0.0+3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on openssl-src and may be impacted: - roaring-landmask 0.4.0 Source cves: CVE-2022-4450 Source advisory: OSV:GHSA-V5W6-WCM8-JM4Q...
roaring-landmask (0.4.0) potentially affected by CVE-2023-0217 via openssl-src (300.0.0+3.0.0)
openssl-src CARGO version 300.0.0+3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on openssl-src and may be impacted: - roaring-landmask 0.4.0 Source cves: CVE-2023-0217 Source advisory: OSV:GHSA-VXRH-CPG7-8VJR...
openssl-src subject to NULL dereference validating DSA public key
An invalid pointer dereference on read can be triggered when an application tries to check a malformed DSA public key by the EVPPKEYpubliccheck function. This will most likely lead to an application crash. This function can be called on public keys supplied from untrusted sources which could allo...
GHSA-VXRH-CPG7-8VJR vulnerabilities
Vulnerabilities for packages: openssl-provider-fips, openssl...
GHSA-VXRH-CPG7-8VJR openssl-src subject to NULL dereference validating DSA public key
An invalid pointer dereference on read can be triggered when an application tries to check a malformed DSA public key by the EVPPKEYpubliccheck function. This will most likely lead to an application crash. This function can be called on public keys supplied from untrusted sources which could allo...
GHSA-VXRH-CPG7-8VJR vulnerabilities
Vulnerabilities for packages: openssl...
roaring-landmask (0.4.0) potentially affected by CVE-2023-0401 via openssl-src (300.0.0+3.0.0)
openssl-src CARGO version 300.0.0+3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on openssl-src and may be impacted: - roaring-landmask 0.4.0 Source cves: CVE-2023-0401 Source advisory: OSV:GHSA-VRH7-X64V-7VXQ...
GHSA-VRH7-X64V-7VXQ vulnerabilities
Vulnerabilities for packages: openssl...
GHSA-VRH7-X64V-7VXQ openssl-src contains `NULL` dereference during PKCS7 data verification
A NULL pointer can be dereferenced when signatures are being verified on PKCS7 signed or signedAndEnveloped data. In case the hash algorithm used for the signature is known to the OpenSSL library but the implementation of the hash algorithm is not available the digest initialization will fail...