268 matches found
Ubuntu 18.04 LTS / 20.04 LTS : OpenSSL vulnerabilities (USN-5051-1)
The remote Ubuntu 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5051-1 advisory. John Ouyang discovered that OpenSSL incorrectly handled decrypting SM2 data. A remote attacker could use this issue to cause applications usi...
Security update for openssl-1_1 (important)
openSUSE Security Update: Security update for openssl-11 Announcement ID: openSUSE-SU-2021:2830-1 Rating: important References: 1189520 1189521 Cross-References: CVE-2021-3711 CVE-2021-3712 CVSS scores: CVE-2021-3711 SUSE: 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-3712 SUSE: 5.3...
PT-2021-4042
Name of the Vulnerable Software and Affected Versions OpenSSL versions 1.1.1 through 1.1.1k Description The issue is related to a buffer overflow in the SM2 decryption code. When an application calls the EVP PKEY decrypt function to decrypt SM2 encrypted data, a bug in the implementation can caus...
OpenSSL 1.1.1 < 1.1.1l Multiple Vulnerabilities
The version of OpenSSL installed on the remote host is prior to 1.1.1l. It is, therefore, affected by multiple vulnerabilities as referenced in the 1.1.1l advisory. - ASN.1 strings are represented internally within OpenSSL as an ASN1STRING structure which contains a buffer holding the string data...
CVE-2021-3711: Buffer Copy without Checking Size of Input
In order to decrypt SM2 encrypted data an application is expected to call the API function EVPPKEYdecrypt. Typically an application will call this function twice. The first time, on entry, the "out" parameter can be NULL and, on exit, the "outlen" parameter is populated with the buffer size...
OpenSSL -- multiple vulnerabilities
The OpenSSL project reports: SM2 Decryption Buffer Overflow CVE-2021-3711: High Read buffer overruns processing ASN.1 strings CVE-2021-3712: Moderate...
PT-2021-19393
Name of the Vulnerable Software and Affected Versions i-doit versions prior to 1.16.0 Description The issue allows remote authenticated attackers to inject arbitrary web script or HTML via vulnerable parameters: C MONITORING CONFIG TITLE, SM2 C MONITORING CONFIG TITLE, C MONITORING CONFIG PATH, S...