Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS : OpenSSL vulnerabilities (USN-5844-1)

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5844-1 advisory. - A read buffer overrun can be ...

Continue Reading
Ubuntu 18.04 LTS : OpenSSL vulnerabilities (USN-5845-1)

The remote Ubuntu 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5845-1 advisory. - The public API function BIO_new_NDEF is a helper fun ...

Continue Reading
OpenSSL 1.0.2 < 1.0.2zg Multiple Vulnerabilities

The version of OpenSSL installed on the remote host is prior to 1.0.2zg. It is, therefore, affected by multiple vulnerabilities as referenced in the 1.0.2zg advisory. - There is a type confusion vul ...

Continue Reading
OpenSSL 1.1.1 < 1.1.1t Multiple Vulnerabilities

The version of OpenSSL installed on the remote host is prior to 1.1.1t. It is, therefore, affected by multiple vulnerabilities as referenced in the 1.1.1t advisory. - There is a type confusion vulne ...

Continue Reading
Slackware Linux 15.0 / current openssl Multiple Vulnerabilities (SSA:2023-038-01)

The version of openssl installed on the remote host is prior to 1.1.1t. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2023-038-01 advisory. - A timing based side ch ...

Continue Reading
Cipher.update_into can corrupt memory if passed an immutable python object as the outbuf

Previously, `Cipher.update_into` would accept Python objects which implement the buffer protocol, but provide only immutable buffers: ```pycon >>> outbuf = b"x00" * 32 >>> c = cipher ...

Continue Reading
Use-after-free following `BIO_new_NDEF`

The public API function `BIO_new_NDEF` is a helper function used for streaming ASN.1 data via a `BIO`. It is primarily used internally to OpenSSL to support the SMIME, CMS and PKCS7 streaming capabili ...

Continue Reading
`NULL` dereference during PKCS7 data verification

A `NULL` pointer can be dereferenced when signatures are being verified on PKCS7 `signed` or `signedAndEnveloped` data. In case the hash algorithm used for the signature is known to the OpenSSL librar ...

Continue Reading

Back to Main

Subscribe for the latest news: