openssl - regression update

Fixed packages 1

Vulnerabilities 6

• Critical 9.8
  CVE-2024-4741

  Use After Free with SSL_free_buffers

  Issue summary: Calling the OpenSSL API function SSL_free_buffers may cause memory to be accessed that was previously freed in some situations Impact summary: A use after free can have a range of potential consequences such as the corruption of valid data, cra…

  OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  Nov 13, 2024
• Critical 9.1
  CVE-2024-5535 Public exploit

  SSL_select_next_proto buffer overread

  Issue summary: Calling the OpenSSL API function SSL_select_next_proto with an empty supported client protocols buffer may cause a crash or memory contents to be sent to the peer. Impact summary: A buffer overread can have a range of potential consequences suc…

  OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  Jun 27, 2024
• High 8.8
  CVE-2024-9143 EPSS 12%

  Low-level invalid GF(2^m) parameters lead to OOB memory access

  Issue summary: Use of the low-level GF(2^m) elliptic curve APIs with untrusted explicit values for the field polynomial can lead to out-of-bounds memory reads or writes. Impact summary: Out of bound memory writes can lead to an application crash or even a pos…

  OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  Oct 16, 2024
• Medium 5.9
  CVE-2024-2511 EPSS 59%

  Unbounded memory growth with session handling in TLSv1.3

  Issue summary: Some non-default TLS server configurations can cause unbounded memory growth when processing TLSv1.3 sessions Impact summary: An attacker may exploit certain server configurations to trigger unbounded memory growth that would lead to a Denial o…

  OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  Apr 8, 2024
• Medium 5.5
  CVE-2024-0727

  PKCS12 Decoding crashes

  Issue summary: Processing a maliciously formatted PKCS12 file may lead OpenSSL to crash leading to a potential Denial of Service attack Impact summary: Applications loading files in the PKCS12 format from untrusted sources might terminate abruptly. A file in …

  OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi PyPI
  Jan 26, 2024
• Medium 5.3
  CVE-2023-5678

  Excessive time spent in DH check / generation with large Q parameter value

  Issue summary: Generating excessively long X9.42 DH keys or checking excessively long X9.42 DH keys or parameters may be very slow. Impact summary: Applications that use the functions DH_generate_key() to generate an X9.42 DH key may experience long delays. L…

  OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  Nov 6, 2023