CVE-2020-36160

Veritas System Recovery (pre-21.2) loads the OpenSSL library from \usr\local\ssl at startup and attempts to read \usr\local\ssl\openssl.cnf, which does not exist. A low-privilege user can create C:\usr\local\ssl\openssl.cnf to load a malicious OpenSSL engine, enabling arbitrary code execution as ...