Skip to content
OpenAdvisories
Medium WID-SEC-2022-1914 3 CVEs

OpenSSL: Mehrere Schwachstellen

Published Jan 26, 2017 · Updated Jan 25, 2024 · Revision 41 · de-DE

Vendor: Blue Coat Vendor: Debian Vendor: Dell Vendor: Fortinet Vendor: FreeBSD Vendor: IBM Vendor: Juniper Networks Vendor: NETAPP Vendor: Oracle Vendor: Red Hat Vendor: SUSE Vendor: Ubuntu Product: AIX Product: AIX 5.3 Product: AIX 6.1 Product: AIX 7.1 Product: AIX 7.2 Product: DataPower Gateway Product: Director 6.1 - 6.1.22.1 Product: Enterprise Linux Product: FortiOS Product: FortiOS < 5.4.6 Product: FortiOS < 5.6.0 Product: FreeBSD OS Product: IntelligenceCenter 3.3 Product: Junos Product: Linux Product: Linux Product: Linux Product: Linux +9 more

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in OpenSSL ausnutzen, um einen Denial of Service Angriff durchzuführen oder vertrauliche Daten einzusehen.

Product

OpenSSL ist eine im Quelltext frei verfügbare Bibliothek, die Secure Sockets Layer (SSL) und Transport Layer Security (TLS) implementiert.

Vulnerabilities 3

  • Unscored —
    CVE-2017-3730 Public exploit EPSS 55%

    Bad (EC)DHE parameters cause a client crash

    In OpenSSL 1.1.0 before 1.1.0d, if a malicious server supplies bad parameters for a DHE or ECDHE key exchange then this can result in the client attempting to dereference a NULL pointer leading to a client crash. This could be exploited in a Denial of Service…

    OpenSSL OpenSSL openssl Debian
  • Unscored —
    CVE-2017-3731 EPSS 57%

    Truncated packet could crash via OOB read

    If an SSL/TLS server or client is running on a 32-bit host, and a specific cipher is being used, then a truncated packet can cause that server or client to perform an out-of-bounds read, usually resulting in a crash. For OpenSSL 1.1.0, the crash can be trigge…

    OpenSSL OpenSSL openssl openssl Debian Ubuntu Alpine
  • Unscored —
    CVE-2017-3732 EPSS 15%

    BN_mod_exp may produce incorrect results on x86_64

    There is a carry propagating bug in the x86_64 Montgomery squaring procedure in OpenSSL 1.0.2 before 1.0.2k and 1.1.0 before 1.1.0d. No EC algorithms are affected. Analysis suggests that attacks against RSA and DSA as a result of this defect would be very dif…

    OpenSSL OpenSSL openssl openssl Debian Ubuntu Alpine

Revision history

  1. #41

    Neue Updates von Dell aufgenommen

  2. #40

    Neue Updates von IBM aufgenommen

  3. #39

    Neue Updates von Oracle Linux aufgenommen

  4. #38

    Neue Updates von Oracle Linux aufgenommen

  5. #37

    Neue Updates von Oracle Linux aufgenommen

  6. #36

    New remediations available

  7. #35

    New remediations available

  8. #34

    Added references

  9. #30

    New remediations available

  10. #31

    Version nicht vorhanden

  11. #32

    Version nicht vorhanden

  12. #33

    Version nicht vorhanden

  13. #29

    New remediations available

  14. #28

    New remediations available

  15. #27

    New remediations available

  16. #26

    Added references

  17. #24

    New remediations available

  18. #25

    Version nicht vorhanden

  19. #23

    New remediations available

  20. #21

    New remediations available

  21. #22

    New remediations available

  22. #18

    New remediations available

  23. #19

    Version nicht vorhanden

  24. #20

    New remediations available

  25. #13

    New remediations available

References