Skip to content
OpenAdvisories
High USN-5502-1 1 CVE

openssl vulnerability

Published Jul 5, 2022 · Updated Apr 27, 2026

Ecosystem: Ubuntu

Summary

Alex Chernyakhovsky discovered that OpenSSL incorrectly handled AES OCB
mode when using the AES-NI assembly optimized implementation on 32-bit
x86 platforms. A remote attacker could possibly use this issue to obtain
sensitive information.

Fixed packages 3

ReleasePackageFixed in
Ubuntu · 18.04 LTS 18.04:LTS openssl 1.1.1-1ubuntu2.1~18.04.20
Ubuntu · 20.04 LTS 20.04:LTS openssl 1.1.1f-1ubuntu2.16
Ubuntu · 22.04 LTS 22.04:LTS openssl 3.0.2-0ubuntu1.6

Vulnerabilities 1

  • High 7.5
    CVE-2022-2097 Public exploit

    AES OCB fails to encrypt some bytes

    AES OCB mode for 32-bit x86 platforms using the AES-NI assembly optimised implementation will not encrypt the entirety of the data under some circumstances. This could reveal sixteen bytes of data that was preexisting in the memory that wasn't written. In the…

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine crates.io

References

  • report
    https://ubuntu.com/security/CVE-2022-2097