Veracode Vulnerability DatabaseVERACODE:3552Information Disclosure
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:L/Au:N/C:P/I:N/A:N
OpenSSL is vulnerable to information disclosure. The library contains a carry propagation bug during the montgomery squaring procedure. This makes it easier for a malicious user to obtain sensitive private key information from the Diffie-Hellman and Diffie-Hellman Ephemereal Ciphersuites.
| CPE | Name | Operator | Version |
|---|---|---|---|
| openssl | le | 1.0.204.1 | |
| openssl-osx | eq | 1.0.204.1 | |
| openssl-static | le | 1.0.2.c1 | |
| openssl | le | 1.0.204.1 | |
| openssl-osx | eq | 1.0.204.1 | |
| openssl-static | le | 1.0.2.c1 |
References
fortiguard.com/advisory/openssl-advisory-december-2015
kb.juniper.net/InfoCenter/index?page=content&id=JSA10759
kb.juniper.net/InfoCenter/index?page=content&id=JSA10761
openssl.org/news/secadv/20151203.txt
tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151204-openssl
www.fortiguard.com/advisory/openssl-advisory-december-2015
www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html
www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html
www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
www.securityfocus.com/bid/78705
www.securityfocus.com/bid/91787
www.securitytracker.com/id/1034294
www.slackware.com/security/viewer.php?l=slackware-security&y=2015&m=slackware-security.539966
www.slackware.com/security/viewer.php?l=slackware-security&y=2015&m=slackware-security.754583
www.ubuntu.com/usn/USN-2830-1
blog.fuzzing-project.org/31-Fuzzing-Math-miscalculations-in-OpenSSLs-BN_mod_exp-CVE-2015-3193.html
bugzilla.redhat.com/show_bug.cgi?id=1288317
cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf
git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=d73cc256c8e256c32ed959456101b73ba9842f72
git.openssl.org/?p=openssl.git;a=commit;h=d73cc256c8e256c32ed959456101b73ba9842f72
h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05398322
kb.isc.org/article/AA-01438
kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40100
www.openssl.org/news/secadv/20151203.txt
Related
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:L/Au:N/C:P/I:N/A:N