Most recent entries from all

ALSA-2022:5818 — Moderate: openssl security update

Affected: AlmaLinux:8: openssl, AlmaLinux:8: openssl-devel, AlmaLinux:8: openssl-libs, AlmaLinux:8: openssl-perl

OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library. Security Fix(es): * openssl: c_rehash script allows command injection (CVE-2022-1292) * openssl: the c_rehash script allows command injection (CVE-2022-2068) * openssl: AES OCB fails to encrypt some bytes (CVE-2022-2097) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2022-04284

Withdrawn: BELL-CVE-2022-2097 — CVE-2022-2097 does not affect BellSoft software

Withdrawn by the publisher.

certfr-2022-avi-607 — De multiples vulnérabilités ont été découvertes dans OpenSSL. Elles permettent à un attaquant de provoquer une exécutio…

certfr-2022-avi-607

Withdrawn: CLEANSTART-2026-GK72927 — Issue summary: PBMAC1 parameters in PKCS#12 files are missing validation which can trigger a stack-based buffer overflo…

Withdrawn by the publisher.

Affected: CleanStart: openssl

Multiple security vulnerabilities affect the openssl package. Issue summary: PBMAC1 parameters in PKCS#12 files are missing validation which can trigger a stack-based buffer overflow, invalid pointer or NULL pointer dereference during MAC verification. See references for individual vulnerability details.

EUVD-2026-179356

fkie_cve-2022-2097

AES OCB mode for 32-bit x86 platforms using the AES-NI assembly optimised implementation will not encrypt the entirety of the data under some circumstances. This could reveal sixteen bytes of data that was preexisting in the memory that wasn't written. In the special case of "in place" encryption, sixteen bytes of the plaintext would be revealed. Since OpenSSL does not support OCB based cipher suites for TLS and DTLS, they are both unaffected. Fixed in OpenSSL 3.0.5 (Affected 3.0.0-3.0.4). Fixed in OpenSSL 1.1.1q (Affected 1.1.1-1.1.1p).

GHSA-3wx7-46ch-7rq2 — AES OCB fails to encrypt some bytes

Affected: crates.io: openssl-src

AES OCB mode for 32-bit x86 platforms using the AES-NI assembly optimized implementation will not encrypt the entirety of the data under some circumstances. This could reveal sixteen bytes of data that was pre-existing in the memory that wasn't written. In the special case of "in place" encryption, sixteen bytes of the plaintext would be revealed.

Since OpenSSL does not support OCB based cipher suites for TLS and DTLS, they are both unaffected.

gsd-2022-2097

ICSA-23-017-03 — Siemens SINEC INS

In addition to the c_rehash shell command injection identified in CVE-2022-1292, further circumstances where the c_rehash script does not properly sanitise shell metacharacters to prevent command injection were found by code review. When the CVE-2022-1292 was fixed it was not discovered that there are other places in the script where the file names of certificates being hashed were possibly passed to a command executed through the shell. This script is distributed by some operating systems in a manner where it is automatically executed. On such operating systems, an attacker could execute arbitrary commands with the privileges of the script. Use of the c_rehash script is considered obsolete and should be replaced by the OpenSSL rehash command line tool. AES OCB mode for 32-bit x86 platforms using the AES-NI assembly optimised implementation will not encrypt the entirety of the data under some circumstances. This could reveal sixteen bytes of data that was preexisting in the memory that wasn't written. In the special case of "in place" encryption, sixteen bytes of the plaintext would be revealed. Since OpenSSL does not support OCB based cipher suites for TLS and DTLS, they are both unaffected. The OpenSSL 3.0.4 release introduced a serious bug in the RSA implementation for X86_64 CPUs supporting the AVX512IFMA instructions. This issue makes the RSA implementation with 2048 bit private keys incorrect on such machines and memory corruption will happen during the computation. As…

msrc_CVE-2022-2097 — AES OCB fails to encrypt some bytes

msrc_CVE-2022-2097

OESA-2022-1833 — openssl security update

Affected: openEuler:20.03-LTS-SP1: openssl, openEuler:20.03-LTS-SP3: openssl, openEuler:22.03-LTS: openssl

OpenSSL is a robust, commercial-grade, and full-featured toolkit for the Transport Layer Security (TLS) and Secure Sockets Layer (SSL) protocols. Security Fix(es): AES OCB mode for 32-bit x86 platforms using the AES-NI assembly optimised implementation will not encrypt the entirety of the data under some circumstances. This could reveal sixteen bytes of data that was preexisting in the memory that wasn t written. In the special case of in place encryption, sixteen bytes of the plaintext would be revealed. Since OpenSSL does not support OCB based cipher suites for TLS and DTLS, they are both unaffected. Fixed in OpenSSL 3.0.5 (Affected 3.0.0-3.0.4). Fixed in OpenSSL 1.1.1q (Affected 1.1.1-1.1.1p).(CVE-2022-2097)

openSUSE-SU-2022:2328-1 — Security update for openssl-1_1

Security update for openssl-1_1

RUSTSEC-2022-0032 — AES OCB fails to encrypt some bytes

Affected: crates.io: openssl-src

Since OpenSSL does not support OCB based cipher suites for TLS and DTLS, they are both unaffected.

SUSE-SU-2022:2309-1 — Security update for openssl

Security update for openssl

UBUNTU-CVE-2022-2097

Affected: Ubuntu:Pro:16.04:LTS: edk2, Ubuntu:18.04:LTS: openssl, Ubuntu:Pro:FIPS-updates:18.04:LTS: openssl, Ubuntu:Pro:FIPS:18.04:LTS: openssl, Ubuntu:20.04:LTS: openssl, Ubuntu:Pro:FIPS-updates:20.04:LTS: openssl, Ubuntu:Pro:FIPS:20.04:LTS: openssl, Ubuntu:22.04:LTS: nodejs, Ubuntu:22.04:LTS: openssl

VDE-2023-001 — PHOENIX CONTACT: Multiple Vulnerabilities in PLCnext Firmware

A new LTS Firmware release fixes known vulnerabilities in used open-source libraries. In addition, the following improvements have been implemented: HMI - Hardening against DoS attacks. - Hardening against memory leak problems in case of network attacks. WBM - Umlauts in the password of the 'User Manager' were not handled correctly. The password rule for upper and lower case was not followed. This could lead to unintentionally weaker passwords.- Hardening of WBM against Cross-Site-Scripting. User Manager - In security notifications 'SecurityToken' was always displayed as '0000000' when creating or modifying users.- Hardening of Trust and Identity Stores.

VDE-2024-006 — TRUMPF: Oseon contains vulnerable version of OpenSSL 1.1.x

Multiple vulnerabilities in the included versions of OpenSSL can lead to different problems, including crashes of the OpenSSL modules (leading to a Denial of Service) or leakage of plaintext. These underlying vulnerabilities can be fixed by installing a software update provided by TRUMPF.

WID-SEC-W-2022-0561 — OpenSSL: Schwachstelle ermöglicht Offenlegung von Informationen

Ein Angreifer kann eine Schwachstelle in OpenSSL ausnutzen, um Informationen offenzulegen.