{
"schema_version": 1,
"series_id": "openssl-vulnerability-disclosures",
"source_commit": "18c7d2226fd32d230d7b976b899a0a346592688c",
"retrieved_at": "2026-08-28",
"data_through": "2026-08-25",
"records": [
{
"id": "CVE-2002-0655",
"published": "2002-07-30",
"quarter": "2002-Q3",
"title": "",
"description": "Inproper handling of ASCII representations of integers on 64 bit platforms allowed remote attackers to cause a denial of service or possibly execute arbitrary code.",
"severity": "unknown",
"reporters": [
"OpenSSL Group (A.L. Digital)"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20020730.txt",
"source_path": "secjson/CVE-2002-0655.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2002-0655.json"
},
{
"id": "CVE-2002-0656",
"published": "2002-07-30",
"quarter": "2002-Q3",
"title": "",
"description": "A buffer overflow allowed remote attackers to execute arbitrary code by sending a large client master key in SSL2 or a large session ID in SSL3.",
"severity": "unknown",
"reporters": [
"OpenSSL Group (A.L. Digital)"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20020730.txt",
"source_path": "secjson/CVE-2002-0656.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2002-0656.json"
},
{
"id": "CVE-2002-0657",
"published": "2002-07-30",
"quarter": "2002-Q3",
"title": "",
"description": "A buffer overflow when Kerberos is enabled allowed attackers to execute arbitrary code by sending a long master key. Note that this flaw did not affect any released version of 0.9.6 or 0.9.7.",
"severity": "unknown",
"reporters": [
"OpenSSL Group (A.L. Digital)"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20020730.txt",
"source_path": "secjson/CVE-2002-0657.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2002-0657.json"
},
{
"id": "CVE-2002-0659",
"published": "2002-07-30",
"quarter": "2002-Q3",
"title": "",
"description": "A flaw in the ASN1 library allowed remote attackers to cause a denial of service by sending invalid encodings.",
"severity": "unknown",
"reporters": [],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20020730.txt",
"source_path": "secjson/CVE-2002-0659.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2002-0659.json"
},
{
"id": "CVE-2002-1568",
"published": "2002-08-08",
"quarter": "2002-Q3",
"title": "",
"description": "The use of assertions when detecting buffer overflow attacks allowed remote attackers to cause a denial of service (crash) by sending certain messages to cause OpenSSL to abort from a failed assertion, as demonstrated using SSLv2 CLIENT_MASTER_KEY messages, which were not properly handled in s2_srvr.c.",
"severity": "unknown",
"reporters": [],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": null,
"source_path": "secjson/CVE-2002-1568.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2002-1568.json"
},
{
"id": "CVE-2003-0078",
"published": "2003-02-19",
"quarter": "2003-Q1",
"title": "",
"description": "sl3_get_record in s3_pkt.c did not perform a MAC computation if an incorrect block cipher padding was used, causing an information leak (timing discrepancy) that may make it easier to launch cryptographic attacks that rely on distinguishing between padding and MAC verification errors, possibly leading to extraction of the original plaintext, aka the \"Vaudenay timing attack.\".",
"severity": "unknown",
"reporters": [],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20030219.txt",
"source_path": "secjson/CVE-2003-0078.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2003-0078.json"
},
{
"id": "CVE-2003-0147",
"published": "2003-03-14",
"quarter": "2003-Q1",
"title": "",
"description": "RSA blinding was not enabled by default, which could allow local and remote attackers to obtain a server's private key by determining factors using timing differences on (1) the number of extra reductions during Montgomery reduction, and (2) the use of different integer multiplication algorithms (\"Karatsuba\" and normal).",
"severity": "unknown",
"reporters": [],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20030317.txt",
"source_path": "secjson/CVE-2003-0147.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2003-0147.json"
},
{
"id": "CVE-2003-0131",
"published": "2003-03-19",
"quarter": "2003-Q1",
"title": "",
"description": "The SSL and TLS components allowed remote attackers to perform an unauthorized RSA private key operation via a modified Bleichenbacher attack that uses a large number of SSL or TLS connections using PKCS #1 v1.5 padding that caused OpenSSL to leak information regarding the relationship between ciphertext and the associated plaintext, aka the \"Klima-Pokorny-Rosa attack\".",
"severity": "unknown",
"reporters": [],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20030319.txt",
"source_path": "secjson/CVE-2003-0131.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2003-0131.json"
},
{
"id": "CVE-2003-0543",
"published": "2003-09-30",
"quarter": "2003-Q3",
"title": "",
"description": "An integer overflow could allow remote attackers to cause a denial of service (crash) via an SSL client certificate with certain ASN.1 tag values.",
"severity": "unknown",
"reporters": [
"NISCC"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20030930.txt",
"source_path": "secjson/CVE-2003-0543.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2003-0543.json"
},
{
"id": "CVE-2003-0544",
"published": "2003-09-30",
"quarter": "2003-Q3",
"title": "",
"description": "Incorrect tracking of the number of characters in certain ASN.1 inputs could allow remote attackers to cause a denial of service (crash) by sending an SSL client certificate that causes OpenSSL to read past the end of a buffer when the long form is used.",
"severity": "unknown",
"reporters": [
"NISCC"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20030930.txt",
"source_path": "secjson/CVE-2003-0544.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2003-0544.json"
},
{
"id": "CVE-2003-0545",
"published": "2003-09-30",
"quarter": "2003-Q3",
"title": "",
"description": "Certain ASN.1 encodings that were rejected as invalid by the parser could trigger a bug in the deallocation of the corresponding data structure, corrupting the stack, leading to a crash.",
"severity": "unknown",
"reporters": [
"NISCC"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20030930.txt",
"source_path": "secjson/CVE-2003-0545.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2003-0545.json"
},
{
"id": "CVE-2003-0851",
"published": "2003-11-04",
"quarter": "2003-Q4",
"title": "",
"description": "A flaw in OpenSSL 0.9.6k (only) would cause certain ASN.1 sequences to trigger a large recursion. On platforms such as Windows this large recursion cannot be handled correctly and so the bug causes OpenSSL to crash. A remote attacker could exploit this flaw if they can send arbitrary ASN.1 sequences which would cause OpenSSL to crash. This could be performed for example by sending a client certificate to a SSL/TLS enabled server which is configured to accept them.",
"severity": "unknown",
"reporters": [
"Novell"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20031104.txt",
"source_path": "secjson/CVE-2003-0851.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2003-0851.json"
},
{
"id": "CVE-2004-0079",
"published": "2004-03-17",
"quarter": "2004-Q1",
"title": "",
"description": "The Codenomicon TLS Test Tool uncovered a null-pointer assignment in the do_change_cipher_spec() function. A remote attacker could perform a carefully crafted SSL/TLS handshake against a server that used the OpenSSL library in such a way as to cause a crash.",
"severity": "unknown",
"reporters": [
"OpenSSL group"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20040317.txt",
"source_path": "secjson/CVE-2004-0079.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2004-0079.json"
},
{
"id": "CVE-2004-0081",
"published": "2004-03-17",
"quarter": "2004-Q1",
"title": "",
"description": "The Codenomicon TLS Test Tool found that some unknown message types were handled incorrectly, allowing a remote attacker to cause a denial of service (infinite loop).",
"severity": "unknown",
"reporters": [
"OpenSSL group"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20030317.txt",
"source_path": "secjson/CVE-2004-0081.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2004-0081.json"
},
{
"id": "CVE-2004-0112",
"published": "2004-03-17",
"quarter": "2004-Q1",
"title": "",
"description": "A flaw in SSL/TLS handshaking code when using Kerberos ciphersuites. A remote attacker could perform a carefully crafted SSL/TLS handshake against a server configured to use Kerberos ciphersuites in such a way as to cause OpenSSL to crash. Most applications have no ability to use Kerberos ciphersuites and will therefore be unaffected.",
"severity": "unknown",
"reporters": [
"OpenSSL group (Stephen Henson)"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20040317.txt",
"source_path": "secjson/CVE-2004-0112.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2004-0112.json"
},
{
"id": "CVE-2004-0975",
"published": "2004-09-30",
"quarter": "2004-Q3",
"title": "",
"description": "The der_chop script created temporary files insecurely which could allow local users to overwrite files via a symlink attack on temporary files. Note that it is quite unlikely that a user would be using the redundant der_chop script, and this script was removed from the OpenSSL distribution.",
"severity": "unknown",
"reporters": [],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": null,
"source_path": "secjson/CVE-2004-0975.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2004-0975.json"
},
{
"id": "CVE-2005-2969",
"published": "2005-10-11",
"quarter": "2005-Q4",
"title": "",
"description": "A deprecated option, SSL_OP_MISE_SSLV2_RSA_PADDING, could allow an attacker acting as a \"man in the middle\" to force a connection to downgrade to SSL 2.0 even if both parties support better protocols.",
"severity": "unknown",
"reporters": [
"researcher"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20051011.txt",
"source_path": "secjson/CVE-2005-2969.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2005-2969.json"
},
{
"id": "CVE-2006-4339",
"published": "2006-09-05",
"quarter": "2006-Q3",
"title": "",
"description": "Daniel Bleichenbacher discovered an attack on PKCS #1 v1.5 signatures where under certain circumstances it may be possible for an attacker to forge a PKCS #1 v1.5 signature that would be incorrectly verified by OpenSSL.",
"severity": "unknown",
"reporters": [
"openssl"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20060905.txt",
"source_path": "secjson/CVE-2006-4339.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2006-4339.json"
},
{
"id": "CVE-2006-2937",
"published": "2006-09-28",
"quarter": "2006-Q3",
"title": "",
"description": "During the parsing of certain invalid ASN.1 structures an error condition is mishandled. This can result in an infinite loop which consumes system memory.",
"severity": "unknown",
"reporters": [
"openssl"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20060928.txt",
"source_path": "secjson/CVE-2006-2937.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2006-2937.json"
},
{
"id": "CVE-2006-2940",
"published": "2006-09-28",
"quarter": "2006-Q3",
"title": "",
"description": "Certain types of public key can take disproportionate amounts of time to process. This could be used by an attacker in a denial of service attack.",
"severity": "unknown",
"reporters": [
"openssl"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20060928.txt",
"source_path": "secjson/CVE-2006-2940.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2006-2940.json"
},
{
"id": "CVE-2006-3738",
"published": "2006-09-28",
"quarter": "2006-Q3",
"title": "",
"description": "A buffer overflow was discovered in the SSL_get_shared_ciphers() utility function. An attacker could send a list of ciphers to an application that uses this function and overrun a buffer.",
"severity": "unknown",
"reporters": [
"openssl"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20060928.txt",
"source_path": "secjson/CVE-2006-3738.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2006-3738.json"
},
{
"id": "CVE-2006-4343",
"published": "2006-09-28",
"quarter": "2006-Q3",
"title": "",
"description": "A flaw in the SSLv2 client code was discovered. When a client application used OpenSSL to create an SSLv2 connection to a malicious server, that server could cause the client to crash.",
"severity": "unknown",
"reporters": [
"openssl"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20060928.txt",
"source_path": "secjson/CVE-2006-4343.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2006-4343.json"
},
{
"id": "CVE-2007-4995",
"published": "2007-10-12",
"quarter": "2007-Q4",
"title": "",
"description": "A flaw in DTLS support. An attacker could create a malicious client or server that could trigger a heap overflow. This is possibly exploitable to run arbitrary code, but it has not been verified.",
"severity": "unknown",
"reporters": [
"Andy Polyakov"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20071012.txt",
"source_path": "secjson/CVE-2007-4995.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2007-4995.json"
},
{
"id": "CVE-2007-5135",
"published": "2007-10-12",
"quarter": "2007-Q4",
"title": "",
"description": "A flaw was found in the SSL_get_shared_ciphers() utility function. An attacker could send a list of ciphers to an application that used this function and overrun a buffer with a single byte. Few applications make use of this vulnerable function and generally it is used only when applications are compiled for debugging.",
"severity": "unknown",
"reporters": [
"Moritz Jodeit"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20071012.txt",
"source_path": "secjson/CVE-2007-5135.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2007-5135.json"
},
{
"id": "CVE-2007-5502",
"published": "2007-11-29",
"quarter": "2007-Q4",
"title": "",
"description": "The PRNG implementation for the OpenSSL FIPS Object Module 1.1.1 does not perform auto-seeding during the FIPS self-test, which generates random data that is more predictable than expected and makes it easier for attackers to bypass protection mechanisms that rely on the randomness.",
"severity": "unknown",
"reporters": [
"Geoff Lowe"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20071129.txt",
"source_path": "secjson/CVE-2007-5502.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2007-5502.json"
},
{
"id": "CVE-2008-0891",
"published": "2008-05-28",
"quarter": "2008-Q2",
"title": "",
"description": "Testing using the Codenomicon TLS test suite discovered a flaw in the handling of server name extension data in OpenSSL 0.9.8f and OpenSSL 0.9.8g. If OpenSSL has been compiled using the non-default TLS server name extensions, a remote attacker could send a carefully crafted packet to a server application using OpenSSL and cause it to crash.",
"severity": "unknown",
"reporters": [
"codenomicon"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20080528.txt",
"source_path": "secjson/CVE-2008-0891.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2008-0891.json"
},
{
"id": "CVE-2008-1672",
"published": "2008-05-28",
"quarter": "2008-Q2",
"title": "",
"description": "Testing using the Codenomicon TLS test suite discovered a flaw if the 'Server Key exchange message' is omitted from a TLS handshake in OpenSSL 0.9.8f and OpenSSL 0.9.8g. If a client connects to a malicious server with particular cipher suites, the server could cause the client to crash.",
"severity": "unknown",
"reporters": [
"codenomicon"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20080528.txt",
"source_path": "secjson/CVE-2008-1672.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2008-1672.json"
},
{
"id": "CVE-2008-5077",
"published": "2009-01-07",
"quarter": "2009-Q1",
"title": "",
"description": "The Google Security Team discovered several functions inside OpenSSL incorrectly checked the result after calling the EVP_VerifyFinal function, allowing a malformed signature to be treated as a good signature rather than as an error. This issue affected the signature checks on DSA and ECDSA keys used with SSL/TLS. One way to exploit this flaw would be for a remote attacker who is in control of a malicious server or who can use a 'man in the middle' attack to present a malformed SSL/TLS signature",
"severity": "unknown",
"reporters": [
"google"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20090107.txt",
"source_path": "secjson/CVE-2008-5077.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2008-5077.json"
},
{
"id": "CVE-2009-1387",
"published": "2009-02-05",
"quarter": "2009-Q1",
"title": "",
"description": "Fix denial of service flaw due in the DTLS implementation. A remote attacker could use this flaw to cause a DTLS server to crash.",
"severity": "unknown",
"reporters": [
"Robin Seggelmann"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://web.archive.org/web/20100710092848/https://rt.openssl.org/Ticket/Display.html?id=1838",
"source_path": "secjson/CVE-2009-1387.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2009-1387.json"
},
{
"id": "CVE-2009-0590",
"published": "2009-03-25",
"quarter": "2009-Q1",
"title": "",
"description": "The function ASN1_STRING_print_ex() when used to print a BMPString or UniversalString will crash with an invalid memory access if the encoded length of the string is illegal. Any OpenSSL application which prints out the contents of a certificate could be affected by this bug, including SSL servers, clients and S/MIME software.",
"severity": "unknown",
"reporters": [],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20090325.txt",
"source_path": "secjson/CVE-2009-0590.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2009-0590.json"
},
{
"id": "CVE-2009-0591",
"published": "2009-03-25",
"quarter": "2009-Q1",
"title": "",
"description": "The function CMS_verify() does not correctly handle an error condition involving malformed signed attributes. This will cause an invalid set of signed attributes to appear valid and content digests will not be checked.",
"severity": "unknown",
"reporters": [
"Ivan Nestlerode, IBM"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20090325.txt",
"source_path": "secjson/CVE-2009-0591.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2009-0591.json"
},
{
"id": "CVE-2009-0789",
"published": "2009-03-25",
"quarter": "2009-Q1",
"title": "",
"description": "When a malformed ASN1 structure is received it's contents are freed up and zeroed and an error condition returned. On a small number of platforms where sizeof(long) < sizeof(void *) (for example WIN64) this can cause an invalid memory access later resulting in a crash when some invalid structures are read, for example RSA public keys.",
"severity": "unknown",
"reporters": [
"Paolo Ganci"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20090325.txt",
"source_path": "secjson/CVE-2009-0789.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2009-0789.json"
},
{
"id": "CVE-2009-1377",
"published": "2009-05-12",
"quarter": "2009-Q2",
"title": "",
"description": "Fix a denial of service flaw in the DTLS implementation. Records are buffered if they arrive with a future epoch to be processed after finishing the corresponding handshake. There is currently no limitation to this buffer allowing an attacker to perform a DOS attack to a DTLS server by sending records with future epochs until there is no memory left.",
"severity": "unknown",
"reporters": [
"Daniel Mentz, Robin Seggelmann"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://web.archive.org/web/20120306065500/http://rt.openssl.org/Ticket/Display.html?id=1930&user=guest&pass=guest",
"source_path": "secjson/CVE-2009-1377.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2009-1377.json"
},
{
"id": "CVE-2009-1378",
"published": "2009-05-12",
"quarter": "2009-Q2",
"title": "",
"description": "Fix a denial of service flaw in the DTLS implementation. In dtls1_process_out_of_seq_message() the check if the current message is already buffered was missing. For every new message was memory allocated, allowing an attacker to perform an denial of service attack against a DTLS server by sending out of seq handshake messages until there is no memory left.",
"severity": "unknown",
"reporters": [
"Daniel Mentz, Robin Seggelmann"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://web.archive.org/web/20101120211136/http://rt.openssl.org/Ticket/Display.html?id=1931&user=guest&pass=guest",
"source_path": "secjson/CVE-2009-1378.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2009-1378.json"
},
{
"id": "CVE-2009-1379",
"published": "2009-05-12",
"quarter": "2009-Q2",
"title": "",
"description": "Use-after-free vulnerability in the dtls1_retrieve_buffered_fragment function could cause a client accessing a malicious DTLS server to crash.",
"severity": "unknown",
"reporters": [
"Daniel Mentz, Robin Seggelmann"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://web.archive.org/web/20100824233642/http://rt.openssl.org/Ticket/Display.html?id=1923&user=guest&pass=guest",
"source_path": "secjson/CVE-2009-1379.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2009-1379.json"
},
{
"id": "CVE-2009-1386",
"published": "2009-06-02",
"quarter": "2009-Q2",
"title": "",
"description": "Fix a NULL pointer dereference if a DTLS server recieved ChangeCipherSpec as first record. A remote attacker could use this flaw to cause a DTLS server to crash.",
"severity": "unknown",
"reporters": [
"Alex Lam"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": null,
"source_path": "secjson/CVE-2009-1386.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2009-1386.json"
},
{
"id": "CVE-2009-3555",
"published": "2009-11-05",
"quarter": "2009-Q4",
"title": "",
"description": "Implement RFC5746 to address vulnerabilities in SSL/TLS renegotiation.",
"severity": "unknown",
"reporters": [],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20091111.txt",
"source_path": "secjson/CVE-2009-3555.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2009-3555.json"
},
{
"id": "CVE-2009-4355",
"published": "2010-01-13",
"quarter": "2010-Q1",
"title": "",
"description": "A memory leak in the zlib_stateful_finish function in crypto/comp/c_zlib.c allows remote attackers to cause a denial of service via vectors that trigger incorrect calls to the CRYPTO_cleanup_all_ex_data function.",
"severity": "unknown",
"reporters": [
"Michael K Johnson and Andy Grimm (rPath)"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": null,
"source_path": "secjson/CVE-2009-4355.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2009-4355.json"
},
{
"id": "CVE-2010-0433",
"published": "2010-01-19",
"quarter": "2010-Q1",
"title": "",
"description": "A missing return value check flaw was discovered in OpenSSL, that could possibly cause OpenSSL to call a Kerberos library function with invalid arguments, resulting in a NULL pointer dereference crash in the MIT Kerberos library. In certain configurations, a remote attacker could use this flaw to crash a TLS/SSL server using OpenSSL by requesting Kerberos cipher suites during the TLS handshake.",
"severity": "unknown",
"reporters": [
"Todd Rinaldo, Tomas Hoger (Red Hat)"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": null,
"source_path": "secjson/CVE-2010-0433.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2010-0433.json"
},
{
"id": "CVE-2009-3245",
"published": "2010-02-23",
"quarter": "2010-Q1",
"title": "",
"description": "It was discovered that OpenSSL did not always check the return value of the bn_wexpand() function. An attacker able to trigger a memory allocation failure in that function could cause an application using the OpenSSL library to crash or, possibly, execute arbitrary code.",
"severity": "unknown",
"reporters": [
"Martin Olsson, Neel Mehta"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": null,
"source_path": "secjson/CVE-2009-3245.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2009-3245.json"
},
{
"id": "CVE-2010-0740",
"published": "2010-03-24",
"quarter": "2010-Q1",
"title": "",
"description": "In TLS connections, certain incorrectly formatted records can cause an OpenSSL client or server to crash due to a read attempt at NULL.",
"severity": "unknown",
"reporters": [
"Bodo Moeller and Adam Langley (Google)"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20100324.txt",
"source_path": "secjson/CVE-2010-0740.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2010-0740.json"
},
{
"id": "CVE-2010-0742",
"published": "2010-06-01",
"quarter": "2010-Q2",
"title": "",
"description": "A flaw in the handling of CMS structures containing OriginatorInfo was found which could lead to a write to invalid memory address or double free. CMS support is disabled by default in OpenSSL 0.9.8 versions.",
"severity": "unknown",
"reporters": [
"Ronald Moesbergen"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20100601.txt",
"source_path": "secjson/CVE-2010-0742.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2010-0742.json"
},
{
"id": "CVE-2010-1633",
"published": "2010-06-01",
"quarter": "2010-Q2",
"title": "",
"description": "An invalid Return value check in pkey_rsa_verifyrecover was discovered. When verification recovery fails for RSA keys an uninitialised buffer with an undefined length is returned instead of an error code. This could lead to an information leak.",
"severity": "unknown",
"reporters": [
"Peter-Michael Hager"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20100601.txt",
"source_path": "secjson/CVE-2010-1633.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2010-1633.json"
},
{
"id": "CVE-2010-3864",
"published": "2010-11-16",
"quarter": "2010-Q4",
"title": "",
"description": "A flaw in the OpenSSL TLS server extension code parsing which on affected servers can be exploited in a buffer overrun attack. Any OpenSSL based TLS server is vulnerable if it is multi-threaded and uses OpenSSL's internal caching mechanism. Servers that are multi-process and/or disable internal session caching are NOT affected.",
"severity": "unknown",
"reporters": [
"Rob Hulswit"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20101116.txt",
"source_path": "secjson/CVE-2010-3864.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2010-3864.json"
},
{
"id": "CVE-2010-4180",
"published": "2010-12-02",
"quarter": "2010-Q4",
"title": "",
"description": "A flaw in the OpenSSL SSL/TLS server code where an old bug workaround allows malicious clients to modify the stored session cache ciphersuite. In some cases the ciphersuite can be downgraded to a weaker one on subsequent connections. This issue only affects OpenSSL based SSL/TLS server if it uses OpenSSL's internal caching mechanisms and the SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG flag (many applications enable this by using the SSL_OP_ALL option).",
"severity": "unknown",
"reporters": [
"Martin Rex"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20101202.txt",
"source_path": "secjson/CVE-2010-4180.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2010-4180.json"
},
{
"id": "CVE-2010-4252",
"published": "2010-12-02",
"quarter": "2010-Q4",
"title": "",
"description": "An error in OpenSSL's experimental J-PAKE implementation which could lead to successful validation by someone with no knowledge of the shared secret. The OpenSSL Team still consider the implementation of J-PAKE to be experimental and is not compiled by default.",
"severity": "unknown",
"reporters": [
"Sebastian Martini"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20101202.txt",
"source_path": "secjson/CVE-2010-4252.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2010-4252.json"
},
{
"id": "CVE-2011-0014",
"published": "2011-02-08",
"quarter": "2011-Q1",
"title": "",
"description": "A buffer over-read flaw was discovered in the way OpenSSL parsed the Certificate Status Request TLS extensions in ClientHello TLS handshake messages. A remote attacker could possibly use this flaw to crash an SSL server using the affected OpenSSL functionality.",
"severity": "unknown",
"reporters": [
"Neel Mehta"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20110208.txt",
"source_path": "secjson/CVE-2011-0014.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2011-0014.json"
},
{
"id": "CVE-2011-3207",
"published": "2011-09-06",
"quarter": "2011-Q3",
"title": "",
"description": "Under certain circumstances OpenSSL's internal certificate verification routines can incorrectly accept a CRL whose nextUpdate field is in the past. Applications are only affected by the CRL checking vulnerability if they enable OpenSSL's internal CRL checking which is off by default. Applications which use their own custom CRL checking (such as Apache) are not affected.",
"severity": "unknown",
"reporters": [
"Kaspar Brand"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20110906.txt",
"source_path": "secjson/CVE-2011-3207.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2011-3207.json"
},
{
"id": "CVE-2011-3210",
"published": "2011-09-06",
"quarter": "2011-Q3",
"title": "",
"description": "OpenSSL server code for ephemeral ECDH ciphersuites is not thread-safe, and furthermore can crash if a client violates the protocol by sending handshake messages in incorrect order. Only server-side applications that specifically support ephemeral ECDH ciphersuites are affected, and only if ephemeral ECDH ciphersuites are enabled in the configuration.",
"severity": "unknown",
"reporters": [
"Adam Langley"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20110906.txt",
"source_path": "secjson/CVE-2011-3210.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2011-3210.json"
},
{
"id": "CVE-2011-4108",
"published": "2012-01-04",
"quarter": "2012-Q1",
"title": "",
"description": "OpenSSL was susceptable an extension of the Vaudenay padding oracle attack on CBC mode encryption which enables an efficient plaintext recovery attack against the OpenSSL implementation of DTLS by exploiting timing differences arising during decryption processing.",
"severity": "unknown",
"reporters": [
"Nadhem Alfardan and Kenny Paterson"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20120104.txt",
"source_path": "secjson/CVE-2011-4108.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2011-4108.json"
},
{
"id": "CVE-2011-4109",
"published": "2012-01-04",
"quarter": "2012-Q1",
"title": "",
"description": "If X509_V_FLAG_POLICY_CHECK is set in OpenSSL 0.9.8, then a policy check failure can lead to a double-free. The bug does not occur unless this flag is set. Users of OpenSSL 1.0.0 are not affected.",
"severity": "unknown",
"reporters": [
"Ben Laurie"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20120104.txt",
"source_path": "secjson/CVE-2011-4109.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2011-4109.json"
},
{
"id": "CVE-2011-4576",
"published": "2012-01-04",
"quarter": "2012-Q1",
"title": "",
"description": "OpenSSL failed to clear the bytes used as block cipher padding in SSL 3.0 records which could leak the contents of memory in some circumstances.",
"severity": "unknown",
"reporters": [
"Adam Langley"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20120104.txt",
"source_path": "secjson/CVE-2011-4576.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2011-4576.json"
},
{
"id": "CVE-2011-4577",
"published": "2012-01-04",
"quarter": "2012-Q1",
"title": "",
"description": "RFC 3779 data can be included in certificates, and if it is malformed, may trigger an assertion failure. This could be used in a denial-of-service attack. Builds of OpenSSL are only vulnerable if configured with \"enable-rfc3779\", which is not a default.",
"severity": "unknown",
"reporters": [
"Andrew Chi"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20120104.txt",
"source_path": "secjson/CVE-2011-4577.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2011-4577.json"
},
{
"id": "CVE-2011-4619",
"published": "2012-01-04",
"quarter": "2012-Q1",
"title": "",
"description": "Support for handshake restarts for server gated cryptograpy (SGC) can be used in a denial-of-service attack.",
"severity": "unknown",
"reporters": [
"George Kadianakis"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20120104.txt",
"source_path": "secjson/CVE-2011-4619.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2011-4619.json"
},
{
"id": "CVE-2012-0027",
"published": "2012-01-04",
"quarter": "2012-Q1",
"title": "",
"description": "A malicious TLS client can send an invalid set of GOST parameters which will cause the server to crash due to lack of error checking. This could be used in a denial-of-service attack. Only users of the OpenSSL GOST ENGINE are affected by this bug.",
"severity": "unknown",
"reporters": [
"Andrey Kulikov"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20120104.txt",
"source_path": "secjson/CVE-2012-0027.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2012-0027.json"
},
{
"id": "CVE-2012-0050",
"published": "2012-01-04",
"quarter": "2012-Q1",
"title": "",
"description": "A flaw in the fix to CVE-2011-4108 can be exploited in a denial of service attack. Only DTLS applications are affected.",
"severity": "unknown",
"reporters": [
"Antonio Martin"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20120118.txt",
"source_path": "secjson/CVE-2012-0050.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2012-0050.json"
},
{
"id": "CVE-2012-0884",
"published": "2012-03-12",
"quarter": "2012-Q1",
"title": "",
"description": "A weakness in the OpenSSL CMS and PKCS #7 code can be exploited using Bleichenbacher's attack on PKCS #1 v1.5 RSA padding also known as the million message attack (MMA). Only users of CMS, PKCS #7, or S/MIME decryption operations are affected, SSL/TLS applications are not affected by this issue.",
"severity": "unknown",
"reporters": [
"Ivan Nestlerode"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20120312.txt",
"source_path": "secjson/CVE-2012-0884.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2012-0884.json"
},
{
"id": "CVE-2012-2110",
"published": "2012-04-19",
"quarter": "2012-Q2",
"title": "",
"description": "Multiple numeric conversion errors, leading to a buffer overflow, were found in the way OpenSSL parsed ASN.1 (Abstract Syntax Notation One) data from BIO (OpenSSL's I/O abstraction) inputs. Specially-crafted DER (Distinguished Encoding Rules) encoded data read from a file or other BIO input could cause an application using the OpenSSL library to crash or, potentially, execute arbitrary code.",
"severity": "unknown",
"reporters": [
"Tavis Ormandy"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20120419.txt",
"source_path": "secjson/CVE-2012-2110.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2012-2110.json"
},
{
"id": "CVE-2012-2131",
"published": "2012-04-24",
"quarter": "2012-Q2",
"title": "",
"description": "It was discovered that the fix for CVE-2012-2110 released on 19 Apr 2012 was not sufficient to correct the issue for OpenSSL 0.9.8. This issue only affects OpenSSL 0.9.8v. OpenSSL 1.0.1a and 1.0.0i already contain a patch sufficient to correct CVE-2012-2110.",
"severity": "unknown",
"reporters": [
"Red Hat"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20120424.txt",
"source_path": "secjson/CVE-2012-2131.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2012-2131.json"
},
{
"id": "CVE-2012-2333",
"published": "2012-05-10",
"quarter": "2012-Q2",
"title": "",
"description": "An integer underflow flaw, leading to a buffer over-read, was found in the way OpenSSL handled TLS 1.1, TLS 1.2, and DTLS (Datagram Transport Layer Security) application data record lengths when using a block cipher in CBC (cipher-block chaining) mode. A malicious TLS 1.1, TLS 1.2, or DTLS client or server could use this flaw to crash its connection peer.",
"severity": "unknown",
"reporters": [
"Codenomicon"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20120510.txt",
"source_path": "secjson/CVE-2012-2333.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2012-2333.json"
},
{
"id": "CVE-2013-0169",
"published": "2013-02-04",
"quarter": "2013-Q1",
"title": "",
"description": "A weakness in the handling of CBC ciphersuites in SSL, TLS and DTLS which could lead to plaintext recovery by exploiting timing differences arising during MAC processing.",
"severity": "unknown",
"reporters": [
"Nadhem J. AlFardan and Kenneth G. Paterson of the Information Security Group Royal Holloway, University of London"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20130205.txt",
"source_path": "secjson/CVE-2013-0169.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2013-0169.json"
},
{
"id": "CVE-2012-2686",
"published": "2013-02-05",
"quarter": "2013-Q1",
"title": "",
"description": "A flaw in the OpenSSL handling of CBC ciphersuites in TLS 1.1 and TLS 1.2 on AES-NI supporting platforms can be exploited in a DoS attack.",
"severity": "unknown",
"reporters": [
"Adam Langley and Wolfgang Ettlinger"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20130205.txt",
"source_path": "secjson/CVE-2012-2686.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2012-2686.json"
},
{
"id": "CVE-2013-0166",
"published": "2013-02-05",
"quarter": "2013-Q1",
"title": "",
"description": "A flaw in the OpenSSL handling of OCSP response verification can be exploited in a denial of service attack.",
"severity": "unknown",
"reporters": [
"Stephen Henson"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20130205.txt",
"source_path": "secjson/CVE-2013-0166.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2013-0166.json"
},
{
"id": "CVE-2013-6450",
"published": "2013-12-13",
"quarter": "2013-Q4",
"title": "",
"description": "A flaw in DTLS handling can cause an application using OpenSSL and DTLS to crash. This is not a vulnerability for OpenSSL prior to 1.0.0.",
"severity": "unknown",
"reporters": [
"Dmitry Sobinov"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": null,
"source_path": "secjson/CVE-2013-6450.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2013-6450.json"
},
{
"id": "CVE-2013-6449",
"published": "2013-12-14",
"quarter": "2013-Q4",
"title": "",
"description": "A flaw in OpenSSL can cause an application using OpenSSL to crash when using TLS version 1.2. This issue only affected OpenSSL 1.0.1 versions.",
"severity": "unknown",
"reporters": [
"Ron Barber"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": null,
"source_path": "secjson/CVE-2013-6449.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2013-6449.json"
},
{
"id": "CVE-2013-4353",
"published": "2014-01-06",
"quarter": "2014-Q1",
"title": "",
"description": "A carefully crafted invalid TLS handshake could crash OpenSSL with a NULL pointer exception. A malicious server could use this flaw to crash a connecting client. This issue only affected OpenSSL 1.0.1 versions.",
"severity": "unknown",
"reporters": [
"Anton Johansson"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": null,
"source_path": "secjson/CVE-2013-4353.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2013-4353.json"
},
{
"id": "CVE-2014-0076",
"published": "2014-02-14",
"quarter": "2014-Q1",
"title": "",
"description": "Fix for the attack described in the paper \"Recovering OpenSSL ECDSA Nonces Using the FLUSH+RELOAD Cache Side-channel Attack\".",
"severity": "unknown",
"reporters": [
"Yuval Yarom and Naomi Benger"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20140605.txt",
"source_path": "secjson/CVE-2014-0076.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2014-0076.json"
},
{
"id": "CVE-2014-0160",
"published": "2014-04-07",
"quarter": "2014-Q2",
"title": "",
"description": "A missing bounds check in the handling of the TLS heartbeat extension can be used to reveal up to 64kB of memory to a connected client or server (a.k.a. Heartbleed). This issue did not affect versions of OpenSSL prior to 1.0.1.",
"severity": "unknown",
"reporters": [
"Neel Mehta"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20140407.txt",
"source_path": "secjson/CVE-2014-0160.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2014-0160.json"
},
{
"id": "CVE-2010-5298",
"published": "2014-04-08",
"quarter": "2014-Q2",
"title": "",
"description": "A race condition in the ssl3_read_bytes function can allow remote attackers to inject data across sessions or cause a denial of service. This flaw only affects multithreaded applications using OpenSSL 1.0.0 and 1.0.1, where SSL_MODE_RELEASE_BUFFERS is enabled, which is not the default and not common.",
"severity": "unknown",
"reporters": [],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20140605.txt",
"source_path": "secjson/CVE-2010-5298.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2010-5298.json"
},
{
"id": "CVE-2014-0198",
"published": "2014-04-21",
"quarter": "2014-Q2",
"title": "",
"description": "A flaw in the do_ssl3_write function can allow remote attackers to cause a denial of service via a NULL pointer dereference. This flaw only affects OpenSSL 1.0.0 and 1.0.1 where SSL_MODE_RELEASE_BUFFERS is enabled, which is not the default and not common.",
"severity": "unknown",
"reporters": [],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20140605.txt",
"source_path": "secjson/CVE-2014-0198.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2014-0198.json"
},
{
"id": "CVE-2014-3470",
"published": "2014-05-30",
"quarter": "2014-Q2",
"title": "",
"description": "OpenSSL TLS clients enabling anonymous ECDH ciphersuites are subject to a denial of service attack.",
"severity": "unknown",
"reporters": [
"Felix Gröbert and Ivan Fratrić (Google)"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20140605.txt",
"source_path": "secjson/CVE-2014-3470.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2014-3470.json"
},
{
"id": "CVE-2014-0195",
"published": "2014-06-05",
"quarter": "2014-Q2",
"title": "",
"description": "A buffer overrun attack can be triggered by sending invalid DTLS fragments to an OpenSSL DTLS client or server. This is potentially exploitable to run arbitrary code on a vulnerable client or server. Only applications using OpenSSL as a DTLS client or server affected.",
"severity": "unknown",
"reporters": [
"Jüri Aedla"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20140605.txt",
"source_path": "secjson/CVE-2014-0195.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2014-0195.json"
},
{
"id": "CVE-2014-0221",
"published": "2014-06-05",
"quarter": "2014-Q2",
"title": "",
"description": "By sending an invalid DTLS handshake to an OpenSSL DTLS client the code can be made to recurse eventually crashing in a DoS attack. Only applications using OpenSSL as a DTLS client are affected.",
"severity": "unknown",
"reporters": [
"Imre Rad (Search-Lab Ltd.)"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20140605.txt",
"source_path": "secjson/CVE-2014-0221.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2014-0221.json"
},
{
"id": "CVE-2014-0224",
"published": "2014-06-05",
"quarter": "2014-Q2",
"title": "",
"description": "An attacker can force the use of weak keying material in OpenSSL SSL/TLS clients and servers. This can be exploited by a Man-in-the-middle (MITM) attack where the attacker can decrypt and modify traffic from the attacked client and server.",
"severity": "unknown",
"reporters": [
"KIKUCHI Masashi (Lepidum Co. Ltd.)"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20140605.txt",
"source_path": "secjson/CVE-2014-0224.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2014-0224.json"
},
{
"id": "CVE-2014-3505",
"published": "2014-08-06",
"quarter": "2014-Q3",
"title": "",
"description": "A Double Free was found when processing DTLS packets. An attacker can force an error condition which causes openssl to crash whilst processing DTLS packets due to memory being freed twice. This could lead to a Denial of Service attack.",
"severity": "unknown",
"reporters": [
"Adam Langley and Wan-Teh Chang (Google)"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20140806.txt",
"source_path": "secjson/CVE-2014-3505.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2014-3505.json"
},
{
"id": "CVE-2014-3506",
"published": "2014-08-06",
"quarter": "2014-Q3",
"title": "",
"description": "A DTLS flaw leading to memory exhaustion was found. An attacker can force openssl to consume large amounts of memory whilst processing DTLS handshake messages. This could lead to a Denial of Service attack.",
"severity": "unknown",
"reporters": [
"Adam Langley (Google)"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20140806.txt",
"source_path": "secjson/CVE-2014-3506.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2014-3506.json"
},
{
"id": "CVE-2014-3507",
"published": "2014-08-06",
"quarter": "2014-Q3",
"title": "",
"description": "A DTLS memory leak from zero-length fragments was found. By sending carefully crafted DTLS packets an attacker could cause OpenSSL to leak memory. This could lead to a Denial of Service attack.",
"severity": "unknown",
"reporters": [
"Adam Langley (Google)"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20140806.txt",
"source_path": "secjson/CVE-2014-3507.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2014-3507.json"
},
{
"id": "CVE-2014-3508",
"published": "2014-08-06",
"quarter": "2014-Q3",
"title": "",
"description": "A flaw in OBJ_obj2txt may cause pretty printing functions such as X509_name_oneline, X509_name_print_ex, to leak some information from the stack. Applications may be affected if they echo pretty printing output to the attacker. OpenSSL SSL/TLS clients and servers themselves are not affected.",
"severity": "unknown",
"reporters": [
"Ivan Fratric (Google)"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20140806.txt",
"source_path": "secjson/CVE-2014-3508.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2014-3508.json"
},
{
"id": "CVE-2014-3509",
"published": "2014-08-06",
"quarter": "2014-Q3",
"title": "",
"description": "A race condition was found in ssl_parse_serverhello_tlsext. If a multithreaded client connects to a malicious server using a resumed session and the server sends an ec point format extension, it could write up to 255 bytes to freed memory.",
"severity": "unknown",
"reporters": [
"Gabor Tyukasz (LogMeIn Inc)"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20140806.txt",
"source_path": "secjson/CVE-2014-3509.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2014-3509.json"
},
{
"id": "CVE-2014-3510",
"published": "2014-08-06",
"quarter": "2014-Q3",
"title": "",
"description": "A flaw in handling DTLS anonymous EC(DH) ciphersuites was found. OpenSSL DTLS clients enabling anonymous (EC)DH ciphersuites are subject to a denial of service attack. A malicious server can crash the client with a null pointer dereference (read) by specifying an anonymous (EC)DH ciphersuite and sending carefully crafted handshake messages.",
"severity": "unknown",
"reporters": [
"Felix Gröbert (Google)"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20140806.txt",
"source_path": "secjson/CVE-2014-3510.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2014-3510.json"
},
{
"id": "CVE-2014-3511",
"published": "2014-08-06",
"quarter": "2014-Q3",
"title": "",
"description": "A flaw in the OpenSSL SSL/TLS server code causes the server to negotiate TLS 1.0 instead of higher protocol versions when the ClientHello message is badly fragmented. This allows a man-in-the-middle attacker to force a downgrade to TLS 1.0 even if both the server and the client support a higher protocol version, by modifying the client's TLS records.",
"severity": "unknown",
"reporters": [
"David Benjamin and Adam Langley (Google)"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20140806.txt",
"source_path": "secjson/CVE-2014-3511.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2014-3511.json"
},
{
"id": "CVE-2014-3512",
"published": "2014-08-06",
"quarter": "2014-Q3",
"title": "",
"description": "A SRP buffer overrun was found. A malicious client or server can send invalid SRP parameters and overrun an internal buffer. Only applications which are explicitly set up for SRP use are affected.",
"severity": "unknown",
"reporters": [
"Sean Devlin and Watson Ladd (Cryptography Services, NCC Group)"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20140806.txt",
"source_path": "secjson/CVE-2014-3512.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2014-3512.json"
},
{
"id": "CVE-2014-5139",
"published": "2014-08-06",
"quarter": "2014-Q3",
"title": "",
"description": "A crash was found affecting SRP ciphersuites used in a Server Hello message. The issue affects OpenSSL clients and allows a malicious server to crash the client with a null pointer dereference (read) by specifying an SRP ciphersuite even though it was not properly negotiated with the client. This could lead to a Denial of Service.",
"severity": "unknown",
"reporters": [
"Joonas Kuorilehto and Riku Hietamäki (Codenomicon)"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20140806.txt",
"source_path": "secjson/CVE-2014-5139.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2014-5139.json"
},
{
"id": "CVE-2014-3513",
"published": "2014-10-15",
"quarter": "2014-Q4",
"title": "",
"description": "A flaw in the DTLS SRTP extension parsing code allows an attacker, who sends a carefully crafted handshake message, to cause OpenSSL to fail to free up to 64k of memory causing a memory leak. This could be exploited in a Denial Of Service attack. This issue affects OpenSSL 1.0.1 server implementations for both SSL/TLS and DTLS regardless of whether SRTP is used or configured. Implementations of OpenSSL that have been compiled with OPENSSL_NO_SRTP defined are not affected.",
"severity": "high",
"reporters": [
"LibreSSL project"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20141015.txt",
"source_path": "secjson/CVE-2014-3513.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2014-3513.json"
},
{
"id": "CVE-2014-3567",
"published": "2014-10-15",
"quarter": "2014-Q4",
"title": "",
"description": "When an OpenSSL SSL/TLS/DTLS server receives a session ticket the integrity of that ticket is first verified. In the event of a session ticket integrity check failing, OpenSSL will fail to free memory causing a memory leak. By sending a large number of invalid session tickets an attacker could exploit this issue in a Denial Of Service attack.",
"severity": "medium",
"reporters": [],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20141015.txt",
"source_path": "secjson/CVE-2014-3567.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2014-3567.json"
},
{
"id": "CVE-2014-3568",
"published": "2014-10-15",
"quarter": "2014-Q4",
"title": "",
"description": "When OpenSSL is configured with \"no-ssl3\" as a build option, servers could accept and complete a SSL 3.0 handshake, and clients could be configured to send them.",
"severity": "low",
"reporters": [
"Akamai Technologies"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20141015.txt",
"source_path": "secjson/CVE-2014-3568.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2014-3568.json"
},
{
"id": "CVE-2014-3569",
"published": "2014-10-21",
"quarter": "2014-Q4",
"title": "",
"description": "When openssl is built with the no-ssl3 option and a SSL v3 ClientHello is received the ssl method would be set to NULL which could later result in a NULL pointer dereference.",
"severity": "low",
"reporters": [
"Frank Schmirler"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20150108.txt",
"source_path": "secjson/CVE-2014-3569.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2014-3569.json"
},
{
"id": "CVE-2014-3571",
"published": "2015-01-05",
"quarter": "2015-Q1",
"title": "",
"description": "A carefully crafted DTLS message can cause a segmentation fault in OpenSSL due to a NULL pointer dereference. This could lead to a Denial Of Service attack.",
"severity": "medium",
"reporters": [
"Markus Stenberg of Cisco Systems, Inc"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20150108.txt",
"source_path": "secjson/CVE-2014-3571.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2014-3571.json"
},
{
"id": "CVE-2014-3572",
"published": "2015-01-05",
"quarter": "2015-Q1",
"title": "",
"description": "An OpenSSL client will accept a handshake using an ephemeral ECDH ciphersuite using an ECDSA certificate if the server key exchange message is omitted. This effectively removes forward secrecy from the ciphersuite.",
"severity": "low",
"reporters": [
"Karthikeyan Bhargavan of the PROSECCO team at INRIA"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20150108.txt",
"source_path": "secjson/CVE-2014-3572.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2014-3572.json"
},
{
"id": "CVE-2014-8275",
"published": "2015-01-05",
"quarter": "2015-Q1",
"title": "",
"description": "OpenSSL accepts several non-DER-variations of certificate signature algorithm and signature encodings. OpenSSL also does not enforce a match between the signature algorithm between the signed and unsigned portions of the certificate. By modifying the contents of the signature algorithm or the encoding of the signature, it is possible to change the certificate's fingerprint. This does not allow an attacker to forge certificates, and does not affect certificate verification or OpenSSL servers/clie",
"severity": "low",
"reporters": [
"Antti Karjalainen and Tuomo Untinen from the Codenomicon CROSS program/Konrad Kraszewski from Google"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20150108.txt",
"source_path": "secjson/CVE-2014-8275.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2014-8275.json"
},
{
"id": "CVE-2015-0204",
"published": "2015-01-06",
"quarter": "2015-Q1",
"title": "",
"description": "An OpenSSL client will accept the use of an RSA temporary key in a non-export RSA key exchange ciphersuite. A server could present a weak temporary key and downgrade the security of the session.",
"severity": "low",
"reporters": [
"Karthikeyan Bhargavan of the PROSECCO team at INRIA"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20150108.txt",
"source_path": "secjson/CVE-2015-0204.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2015-0204.json"
},
{
"id": "CVE-2014-3570",
"published": "2015-01-08",
"quarter": "2015-Q1",
"title": "",
"description": "Bignum squaring (BN_sqr) may produce incorrect results on some platforms, including x86_64. This bug occurs at random with a very low probability, and is not known to be exploitable in any way, though its exact impact is difficult to determine. The following has been determined: *) The probability of BN_sqr producing an incorrect result at random is very low: 1/2^64 on the single affected 32-bit platform (MIPS) and 1/2^128 on affected 64-bit platforms. *) On most platforms, RSA follows a differe",
"severity": "low",
"reporters": [
"Pieter Wuille (Blockstream)"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20150108.txt",
"source_path": "secjson/CVE-2014-3570.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2014-3570.json"
},
{
"id": "CVE-2015-0205",
"published": "2015-01-08",
"quarter": "2015-Q1",
"title": "",
"description": "An OpenSSL server will accept a DH certificate for client authentication without the certificate verify message. This effectively allows a client to authenticate without the use of a private key. This only affects servers which trust a client certificate authority which issues certificates containing DH keys: these are extremely rare and hardly ever encountered.",
"severity": "low",
"reporters": [
"Karthikeyan Bhargavan of the PROSECCO team at INRIA"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20150108.txt",
"source_path": "secjson/CVE-2015-0205.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2015-0205.json"
},
{
"id": "CVE-2015-0206",
"published": "2015-01-08",
"quarter": "2015-Q1",
"title": "",
"description": "A memory leak can occur in the dtls1_buffer_record function under certain conditions. In particular this could occur if an attacker sent repeated DTLS records with the same sequence number but for the next epoch. The memory leak could be exploited by an attacker in a Denial of Service attack through memory exhaustion.",
"severity": "medium",
"reporters": [
"Chris Mueller"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20150108.txt",
"source_path": "secjson/CVE-2015-0206.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2015-0206.json"
},
{
"id": "CVE-2015-0288",
"published": "2015-03-02",
"quarter": "2015-Q1",
"title": "",
"description": "X509_to_X509_REQ NULL pointer deref. The function X509_to_X509_REQ will crash with a NULL pointer dereference if the certificate key is invalid. This function is rarely used in practice.",
"severity": "low",
"reporters": [
"Brian Carpenter"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20150319.txt",
"source_path": "secjson/CVE-2015-0288.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2015-0288.json"
},
{
"id": "CVE-2015-0285",
"published": "2015-03-10",
"quarter": "2015-Q1",
"title": "",
"description": "Under certain conditions an OpenSSL 1.0.2 client can complete a handshake with an unseeded PRNG. If the handshake succeeds then the client random that has been used will have been generated from a PRNG with insufficient entropy and therefore the output may be predictable.",
"severity": "low",
"reporters": [
"Matt Caswell (OpenSSL development team)"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20150319.txt",
"source_path": "secjson/CVE-2015-0285.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2015-0285.json"
},
{
"id": "CVE-2015-0207",
"published": "2015-03-19",
"quarter": "2015-Q1",
"title": "",
"description": "Segmentation fault in DTLSv1_listen. A defect in the implementation of DTLSv1_listen means that state is preserved in the SSL object from one invocation to the next that can lead to a segmentation fault. Errors processing the initial ClientHello can trigger this scenario. An example of such an error could be that a DTLS1.0 only client is attempting to connect to a DTLS1.2 only server.",
"severity": "medium",
"reporters": [
"Per Allansson"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20150319.txt",
"source_path": "secjson/CVE-2015-0207.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2015-0207.json"
},
{
"id": "CVE-2015-0208",
"published": "2015-03-19",
"quarter": "2015-Q1",
"title": "",
"description": "Segmentation fault for invalid PSS parameters. The signature verification routines will crash with a NULL pointer dereference if presented with an ASN.1 signature using the RSA PSS algorithm and invalid parameters. Since these routines are used to verify certificate signature algorithms this can be used to crash any certificate verification operation and exploited in a DoS attack. Any application which performs certificate verification is vulnerable including OpenSSL clients and servers which en",
"severity": "medium",
"reporters": [
"Brian Carpenter"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20150319.txt",
"source_path": "secjson/CVE-2015-0208.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2015-0208.json"
},
{
"id": "CVE-2015-0209",
"published": "2015-03-19",
"quarter": "2015-Q1",
"title": "",
"description": "Use After Free following d2i_ECPrivatekey error. A malformed EC private key file consumed via the d2i_ECPrivateKey function could cause a use after free condition. This, in turn, could cause a double free in several private key parsing functions (such as d2i_PrivateKey or EVP_PKCS82PKEY) and could lead to a DoS attack or memory corruption for applications that receive EC private keys from untrusted sources. This scenario is considered rare.",
"severity": "low",
"reporters": [
"The BoringSSL project"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20150319.txt",
"source_path": "secjson/CVE-2015-0209.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2015-0209.json"
},
{
"id": "CVE-2015-0286",
"published": "2015-03-19",
"quarter": "2015-Q1",
"title": "",
"description": "Segmentation fault in ASN1_TYPE_cmp. The function ASN1_TYPE_cmp will crash with an invalid read if an attempt is made to compare ASN.1 boolean types. Since ASN1_TYPE_cmp is used to check certificate signature algorithm consistency this can be used to crash any certificate verification operation and exploited in a DoS attack. Any application which performs certificate verification is vulnerable including OpenSSL clients and servers which enable client authentication.",
"severity": "medium",
"reporters": [
"Stephen Henson (OpenSSL development team)"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20150319.txt",
"source_path": "secjson/CVE-2015-0286.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2015-0286.json"
},
{
"id": "CVE-2015-0287",
"published": "2015-03-19",
"quarter": "2015-Q1",
"title": "",
"description": "ASN.1 structure reuse memory corruption. Reusing a structure in ASN.1 parsing may allow an attacker to cause memory corruption via an invalid write. Such reuse is and has been strongly discouraged and is believed to be rare.",
"severity": "medium",
"reporters": [
"Emilia Käsper (OpenSSL development team)"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20150319.txt",
"source_path": "secjson/CVE-2015-0287.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2015-0287.json"
},
{
"id": "CVE-2015-0289",
"published": "2015-03-19",
"quarter": "2015-Q1",
"title": "",
"description": "PKCS#7 NULL pointer dereference. The PKCS#7 parsing code does not handle missing outer ContentInfo correctly. An attacker can craft malformed ASN.1-encoded PKCS#7 blobs with missing content and trigger a NULL pointer dereference on parsing. Applications that verify PKCS#7 signatures, decrypt PKCS#7 data or otherwise parse PKCS#7 structures from untrusted sources are affected. OpenSSL clients and servers are not affected.",
"severity": "medium",
"reporters": [
"Michal Zalewski (Google)"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20150319.txt",
"source_path": "secjson/CVE-2015-0289.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2015-0289.json"
},
{
"id": "CVE-2015-0290",
"published": "2015-03-19",
"quarter": "2015-Q1",
"title": "",
"description": "Multiblock corrupted pointer. OpenSSL 1.0.2 introduced the \"multiblock\" performance improvement. This feature only applies on 64 bit x86 architecture platforms that support AES NI instructions. A defect in the implementation of \"multiblock\" can cause OpenSSL's internal write buffer to become incorrectly set to NULL when using non-blocking IO. Typically, when the user application is using a socket BIO for writing, this will only result in a failed connection. However if some other BIO is used the",
"severity": "medium",
"reporters": [
"Daniel Danner and Rainer Mueller"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20150319.txt",
"source_path": "secjson/CVE-2015-0290.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2015-0290.json"
},
{
"id": "CVE-2015-0291",
"published": "2015-03-19",
"quarter": "2015-Q1",
"title": "",
"description": "ClientHello sigalgs DoS. If a client connects to an OpenSSL 1.0.2 server and renegotiates with an invalid signature algorithms extension a NULL pointer dereference will occur. This can be exploited in a DoS attack against the server.",
"severity": "high",
"reporters": [
"David Ramos (Stanford University)"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20150319.txt",
"source_path": "secjson/CVE-2015-0291.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2015-0291.json"
},
{
"id": "CVE-2015-0292",
"published": "2015-03-19",
"quarter": "2015-Q1",
"title": "",
"description": "A vulnerability existed in previous versions of OpenSSL related to the processing of base64 encoded data. Any code path that reads base64 data from an untrusted source could be affected (such as the PEM processing routines). Maliciously crafted base 64 data could trigger a segmenation fault or memory corruption.",
"severity": "medium",
"reporters": [
"Robert Dugal, also David Ramos, also Huzaifa Sidhpurwala (Red Hat)"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20150319.txt",
"source_path": "secjson/CVE-2015-0292.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2015-0292.json"
},
{
"id": "CVE-2015-0293",
"published": "2015-03-19",
"quarter": "2015-Q1",
"title": "",
"description": "DoS via reachable assert in SSLv2 servers. A malicious client can trigger an OPENSSL_assert in servers that both support SSLv2 and enable export cipher suites by sending a specially crafted SSLv2 CLIENT-MASTER-KEY message.",
"severity": "medium",
"reporters": [
"Sean Burford (Google) and Emilia Käsper (OpenSSL development team)"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20150319.txt",
"source_path": "secjson/CVE-2015-0293.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2015-0293.json"
},
{
"id": "CVE-2015-1787",
"published": "2015-03-19",
"quarter": "2015-Q1",
"title": "",
"description": "Empty CKE with client auth and DHE. If client auth is used then a server can seg fault in the event of a DHE ciphersuite being selected and a zero length ClientKeyExchange message being sent by the client. This could be exploited in a DoS attack.",
"severity": "medium",
"reporters": [
"Matt Caswell (OpenSSL development team)"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20150319.txt",
"source_path": "secjson/CVE-2015-1787.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2015-1787.json"
},
{
"id": "CVE-2015-1791",
"published": "2015-06-02",
"quarter": "2015-Q2",
"title": "",
"description": "If a NewSessionTicket is received by a multi-threaded client when attempting to reuse a previous ticket then a race condition can occur potentially leading to a double free of the ticket data.",
"severity": "low",
"reporters": [
"Emilia Käsper (OpenSSL)"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20150611.txt",
"source_path": "secjson/CVE-2015-1791.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2015-1791.json"
},
{
"id": "CVE-2014-8176",
"published": "2015-06-11",
"quarter": "2015-Q2",
"title": "",
"description": "This vulnerability does not affect current versions of OpenSSL. It existed in previous OpenSSL versions and was fixed in June 2014. If a DTLS peer receives application data between the ChangeCipherSpec and Finished messages, buffering of such data may cause an invalid free, resulting in a segmentation fault or potentially, memory corruption.",
"severity": "medium",
"reporters": [
"Praveen Kariyanahalli, and subsequently by Ivan Fratric and Felix Groebert (Google)"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20150611.txt",
"source_path": "secjson/CVE-2014-8176.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2014-8176.json"
},
{
"id": "CVE-2015-1788",
"published": "2015-06-11",
"quarter": "2015-Q2",
"title": "",
"description": "When processing an ECParameters structure OpenSSL enters an infinite loop if the curve specified is over a specially malformed binary polynomial field. This can be used to perform denial of service against any system which processes public keys, certificate requests or certificates. This includes TLS clients and TLS servers with client authentication enabled.",
"severity": "medium",
"reporters": [
"Joseph Birr-Pixton"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20150611.txt",
"source_path": "secjson/CVE-2015-1788.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2015-1788.json"
},
{
"id": "CVE-2015-1789",
"published": "2015-06-11",
"quarter": "2015-Q2",
"title": "",
"description": "X509_cmp_time does not properly check the length of the ASN1_TIME string and can read a few bytes out of bounds. In addition, X509_cmp_time accepts an arbitrary number of fractional seconds in the time string. An attacker can use this to craft malformed certificates and CRLs of various sizes and potentially cause a segmentation fault, resulting in a DoS on applications that verify certificates or CRLs. TLS clients that verify CRLs are affected. TLS clients and servers with client authentication ",
"severity": "medium",
"reporters": [
"Robert Święcki (Google Security Team)",
"Hanno Böck"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20150611.txt",
"source_path": "secjson/CVE-2015-1789.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2015-1789.json"
},
{
"id": "CVE-2015-1790",
"published": "2015-06-11",
"quarter": "2015-Q2",
"title": "",
"description": "The PKCS#7 parsing code does not handle missing inner EncryptedContent correctly. An attacker can craft malformed ASN.1-encoded PKCS#7 blobs with missing content and trigger a NULL pointer dereference on parsing. Applications that decrypt PKCS#7 data or otherwise parse PKCS#7 structures from untrusted sources are affected. OpenSSL clients and servers are not affected.",
"severity": "medium",
"reporters": [
"Michal Zalewski (Google)"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20150611.txt",
"source_path": "secjson/CVE-2015-1790.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2015-1790.json"
},
{
"id": "CVE-2015-1792",
"published": "2015-06-11",
"quarter": "2015-Q2",
"title": "",
"description": "When verifying a signedData message the CMS code can enter an infinite loop if presented with an unknown hash function OID. This can be used to perform denial of service against any system which verifies signedData messages using the CMS code.",
"severity": "medium",
"reporters": [
"Johannes Bauer"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20150611.txt",
"source_path": "secjson/CVE-2015-1792.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2015-1792.json"
},
{
"id": "CVE-2015-1793",
"published": "2015-07-09",
"quarter": "2015-Q3",
"title": "",
"description": "An error in the implementation of the alternative certificate chain logic could allow an attacker to cause certain checks on untrusted certificates to be bypassed, such as the CA flag, enabling them to use a valid leaf certificate to act as a CA and \"issue\" an invalid certificate.",
"severity": "high",
"reporters": [
"Adam Langley and David Benjamin (Google/BoringSSL)"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20150709.txt",
"source_path": "secjson/CVE-2015-1793.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2015-1793.json"
},
{
"id": "CVE-2015-1794",
"published": "2015-08-11",
"quarter": "2015-Q3",
"title": "",
"description": "If a client receives a ServerKeyExchange for an anonymous DH ciphersuite with the value of p set to 0 then a seg fault can occur leading to a possible denial of service attack.",
"severity": "low",
"reporters": [
"Guy Leaver (Cisco)"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20151203.txt",
"source_path": "secjson/CVE-2015-1794.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2015-1794.json"
},
{
"id": "CVE-2015-3193",
"published": "2015-12-03",
"quarter": "2015-Q4",
"title": "",
"description": "There is a carry propagating bug in the x86_64 Montgomery squaring procedure. No EC algorithms are affected. Analysis suggests that attacks against RSA and DSA as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH are considered just feasible (although very difficult) because most of the work necessary to deduce information about a private key may be performed offline. The amount of resources required for such an attack would be very signif",
"severity": "medium",
"reporters": [
"Hanno Böck"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20151203.txt",
"source_path": "secjson/CVE-2015-3193.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2015-3193.json"
},
{
"id": "CVE-2015-3194",
"published": "2015-12-03",
"quarter": "2015-Q4",
"title": "",
"description": "The signature verification routines will crash with a NULL pointer dereference if presented with an ASN.1 signature using the RSA PSS algorithm and absent mask generation function parameter. Since these routines are used to verify certificate signature algorithms this can be used to crash any certificate verification operation and exploited in a DoS attack. Any application which performs certificate verification is vulnerable including OpenSSL clients and servers which enable client authenticati",
"severity": "medium",
"reporters": [
"Loïc Jonas Etienne (Qnective AG)"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20151203.txt",
"source_path": "secjson/CVE-2015-3194.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2015-3194.json"
},
{
"id": "CVE-2015-3195",
"published": "2015-12-03",
"quarter": "2015-Q4",
"title": "",
"description": "When presented with a malformed X509_ATTRIBUTE structure OpenSSL will leak memory. This structure is used by the PKCS#7 and CMS routines so any application which reads PKCS#7 or CMS data from untrusted sources is affected. SSL/TLS is not affected.",
"severity": "medium",
"reporters": [
"Adam Langley (Google/BoringSSL) using libFuzzer"
],
"attribution_band": "fuzzing_marker",
"attribution_markers": [
"libFuzzer"
],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20151203.txt",
"source_path": "secjson/CVE-2015-3195.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2015-3195.json"
},
{
"id": "CVE-2015-3196",
"published": "2015-12-03",
"quarter": "2015-Q4",
"title": "",
"description": "If PSK identity hints are received by a multi-threaded client then the values are wrongly updated in the parent SSL_CTX structure. This can result in a race condition potentially leading to a double free of the identify hint data.",
"severity": "low",
"reporters": [
"Stephen Henson (OpenSSL)"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20151203.txt",
"source_path": "secjson/CVE-2015-3196.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2015-3196.json"
},
{
"id": "CVE-2015-3197",
"published": "2016-01-28",
"quarter": "2016-Q1",
"title": "",
"description": "A malicious client can negotiate SSLv2 ciphers that have been disabled on the server and complete SSLv2 handshakes even if all SSLv2 ciphers have been disabled, provided that the SSLv2 protocol was not also disabled via SSL_OP_NO_SSLv2.",
"severity": "low",
"reporters": [
"Nimrod Aviram and Sebastian Schinzel"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20160128.txt",
"source_path": "secjson/CVE-2015-3197.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2015-3197.json"
},
{
"id": "CVE-2016-0701",
"published": "2016-01-28",
"quarter": "2016-Q1",
"title": "",
"description": "Historically OpenSSL usually only ever generated DH parameters based on \"safe\" primes. More recently (in version 1.0.2) support was provided for generating X9.42 style parameter files such as those required for RFC 5114 support. The primes used in such files may not be \"safe\". Where an application is using DH configured with parameters based on primes that are not \"safe\" then an attacker could use this fact to find a peer's private DH exponent. This attack requires that the attacker complete mul",
"severity": "high",
"reporters": [
"Antonio Sanso (Adobe)"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20160128.txt",
"source_path": "secjson/CVE-2016-0701.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2016-0701.json"
},
{
"id": "CVE-2016-0702",
"published": "2016-03-01",
"quarter": "2016-Q1",
"title": "",
"description": "A side-channel attack was found which makes use of cache-bank conflicts on the Intel Sandy-Bridge microarchitecture which could lead to the recovery of RSA keys. The ability to exploit this issue is limited as it relies on an attacker who has control of code in a thread running on the same hyper-threaded core as the victim thread which is performing decryptions.",
"severity": "low",
"reporters": [
"Yuval Yarom, The University of Adelaide and NICTA, Daniel Genkin, Technion and Tel Aviv University, and Nadia Heninger, University of Pennsylvania"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20160301.txt",
"source_path": "secjson/CVE-2016-0702.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2016-0702.json"
},
{
"id": "CVE-2016-0703",
"published": "2016-03-01",
"quarter": "2016-Q1",
"title": "",
"description": "This issue only affected versions of OpenSSL prior to March 19th 2015 at which time the code was refactored to address vulnerability CVE-2015-0293. s2_srvr.c did not enforce that clear-key-length is 0 for non-export ciphers. If clear-key bytes are present for these ciphers, they *displace* encrypted-key bytes. This leads to an efficient divide-and-conquer key recovery attack: if an eavesdropper has intercepted an SSLv2 handshake, they can use the server as an oracle to determine the SSLv2 master",
"severity": "high",
"reporters": [
"David Adrian and J.Alex Halderman (University of Michigan)"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20160301.txt",
"source_path": "secjson/CVE-2016-0703.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2016-0703.json"
},
{
"id": "CVE-2016-0704",
"published": "2016-03-01",
"quarter": "2016-Q1",
"title": "",
"description": "This issue only affected versions of OpenSSL prior to March 19th 2015 at which time the code was refactored to address the vulnerability CVE-2015-0293. s2_srvr.c overwrite the wrong bytes in the master-key when applying Bleichenbacher protection for export cipher suites. This provides a Bleichenbacher oracle, and could potentially allow more efficient variants of the DROWN attack.",
"severity": "medium",
"reporters": [
"David Adrian and J.Alex Halderman (University of Michigan)"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20160301.txt",
"source_path": "secjson/CVE-2016-0704.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2016-0704.json"
},
{
"id": "CVE-2016-0705",
"published": "2016-03-01",
"quarter": "2016-Q1",
"title": "",
"description": "A double free bug was discovered when OpenSSL parses malformed DSA private keys and could lead to a DoS attack or memory corruption for applications that receive DSA private keys from untrusted sources. This scenario is considered rare.",
"severity": "low",
"reporters": [
"Adam Langley (Google/BoringSSL)"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20160301.txt",
"source_path": "secjson/CVE-2016-0705.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2016-0705.json"
},
{
"id": "CVE-2016-0797",
"published": "2016-03-01",
"quarter": "2016-Q1",
"title": "",
"description": "In the BN_hex2bn function the number of hex digits is calculated using an int value |i|. Later |bn_expand| is called with a value of |i * 4|. For large values of |i| this can result in |bn_expand| not allocating any memory because |i * 4| is negative. This can leave the internal BIGNUM data field as NULL leading to a subsequent NULL ptr deref. For very large values of |i|, the calculation |i * 4| could be a positive value smaller than |i|. In this case memory is allocated to the internal BIGNUM ",
"severity": "low",
"reporters": [
"Guido Vranken"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20160301.txt",
"source_path": "secjson/CVE-2016-0797.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2016-0797.json"
},
{
"id": "CVE-2016-0798",
"published": "2016-03-01",
"quarter": "2016-Q1",
"title": "",
"description": "The SRP user database lookup method SRP_VBASE_get_by_user had confusing memory management semantics; the returned pointer was sometimes newly allocated, and sometimes owned by the callee. The calling code has no way of distinguishing these two cases. Specifically, SRP servers that configure a secret seed to hide valid login information are vulnerable to a memory leak: an attacker connecting with an invalid username can cause a memory leak of around 300 bytes per connection. Servers that do not c",
"severity": "low",
"reporters": [
"Emilia Käsper (OpenSSL)"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20160301.txt",
"source_path": "secjson/CVE-2016-0798.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2016-0798.json"
},
{
"id": "CVE-2016-0799",
"published": "2016-03-01",
"quarter": "2016-Q1",
"title": "",
"description": "The internal |fmtstr| function used in processing a \"%s\" format string in the BIO_*printf functions could overflow while calculating the length of a string and cause an OOB read when printing very long strings. Additionally the internal |doapr_outch| function can attempt to write to an OOB memory location (at an offset from the NULL pointer) in the event of a memory allocation failure. In 1.0.2 and below this could be caused where the size of a buffer to be allocated is greater than INT_MAX. E.g",
"severity": "low",
"reporters": [
"Guido Vranken"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20160301.txt",
"source_path": "secjson/CVE-2016-0799.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2016-0799.json"
},
{
"id": "CVE-2016-0800",
"published": "2016-03-01",
"quarter": "2016-Q1",
"title": "",
"description": "A cross-protocol attack was discovered that could lead to decryption of TLS sessions by using a server supporting SSLv2 and EXPORT cipher suites as a Bleichenbacher RSA padding oracle. Note that traffic between clients and non-vulnerable servers can be decrypted provided another server supporting SSLv2 and EXPORT ciphers (even with a different protocol such as SMTP, IMAP or POP) shares the RSA keys of the non-vulnerable server. This vulnerability is known as DROWN (CVE-2016-0800). Recovering one",
"severity": "high",
"reporters": [
"Nimrod Aviram and Sebastian Schinzel"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20160301.txt",
"source_path": "secjson/CVE-2016-0800.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2016-0800.json"
},
{
"id": "CVE-2016-2105",
"published": "2016-05-03",
"quarter": "2016-Q2",
"title": "",
"description": "An overflow can occur in the EVP_EncodeUpdate() function which is used for Base64 encoding of binary data. If an attacker is able to supply very large amounts of input data then a length check can overflow resulting in a heap corruption. Internally to OpenSSL the EVP_EncodeUpdate() function is primarly used by the PEM_write_bio* family of functions. These are mainly used within the OpenSSL command line applications. These internal uses are not considered vulnerable because all calls are bounded ",
"severity": "low",
"reporters": [
"Guido Vranken"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20160503.txt",
"source_path": "secjson/CVE-2016-2105.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2016-2105.json"
},
{
"id": "CVE-2016-2106",
"published": "2016-05-03",
"quarter": "2016-Q2",
"title": "",
"description": "An overflow can occur in the EVP_EncryptUpdate() function. If an attacker is able to supply very large amounts of input data after a previous call to EVP_EncryptUpdate() with a partial block then a length check can overflow resulting in a heap corruption. Following an analysis of all OpenSSL internal usage of the EVP_EncryptUpdate() function all usage is one of two forms. The first form is where the EVP_EncryptUpdate() call is known to be the first called function after an EVP_EncryptInit(), and",
"severity": "low",
"reporters": [
"Guido Vranken"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20160503.txt",
"source_path": "secjson/CVE-2016-2106.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2016-2106.json"
},
{
"id": "CVE-2016-2107",
"published": "2016-05-03",
"quarter": "2016-Q2",
"title": "",
"description": "A MITM attacker can use a padding oracle attack to decrypt traffic when the connection uses an AES CBC cipher and the server support AES-NI. This issue was introduced as part of the fix for Lucky 13 padding attack (CVE-2013-0169). The padding check was rewritten to be in constant time by making sure that always the same bytes are read and compared against either the MAC or padding bytes. But it no longer checked that there was enough data to have both the MAC and padding bytes.",
"severity": "high",
"reporters": [
"Juraj Somorovsky"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20160503.txt",
"source_path": "secjson/CVE-2016-2107.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2016-2107.json"
},
{
"id": "CVE-2016-2108",
"published": "2016-05-03",
"quarter": "2016-Q2",
"title": "",
"description": "This issue affected versions of OpenSSL prior to April 2015. The bug causing the vulnerability was fixed on April 18th 2015, and released as part of the June 11th 2015 security releases. The security impact of the bug was not known at the time. In previous versions of OpenSSL, ASN.1 encoding the value zero represented as a negative integer can cause a buffer underflow with an out-of-bounds write in i2c_ASN1_INTEGER. The ASN.1 parser does not normally create \"negative zeroes\" when parsing ASN.1 i",
"severity": "high",
"reporters": [
"Huzaifa Sidhpurwala (Red Hat), Hanno Böck, David Benjamin (Google)"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20160503.txt",
"source_path": "secjson/CVE-2016-2108.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2016-2108.json"
},
{
"id": "CVE-2016-2109",
"published": "2016-05-03",
"quarter": "2016-Q2",
"title": "",
"description": "When ASN.1 data is read from a BIO using functions such as d2i_CMS_bio() a short invalid encoding can casuse allocation of large amounts of memory potentially consuming excessive resources or exhausting memory. Any application parsing untrusted data through d2i BIO functions is affected. The memory based functions such as d2i_X509() are *not* affected. Since the memory based functions are used by the TLS library, TLS applications are not affected.",
"severity": "low",
"reporters": [
"Brian Carpenter"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20160503.txt",
"source_path": "secjson/CVE-2016-2109.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2016-2109.json"
},
{
"id": "CVE-2016-2176",
"published": "2016-05-03",
"quarter": "2016-Q2",
"title": "",
"description": "ASN1 Strings that are over 1024 bytes can cause an overread in applications using the X509_NAME_oneline() function on EBCDIC systems. This could result in arbitrary stack data being returned in the buffer.",
"severity": "low",
"reporters": [
"Guido Vranken"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20160503.txt",
"source_path": "secjson/CVE-2016-2176.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2016-2176.json"
},
{
"id": "CVE-2016-2177",
"published": "2016-06-01",
"quarter": "2016-Q2",
"title": "",
"description": "Avoid some undefined pointer arithmetic A common idiom in the codebase is to check limits in the following manner: \"p + len > limit\" Where \"p\" points to some malloc'd data of SIZE bytes and limit == p + SIZE \"len\" here could be from some externally supplied data (e.g. from a TLS message). The rules of C pointer arithmetic are such that \"p + len\" is only well defined where len <= SIZE. Therefore the above idiom is actually undefined behaviour. For example this could cause problems if some malloc ",
"severity": "low",
"reporters": [
"Guido Vranken"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20160922.txt",
"source_path": "secjson/CVE-2016-2177.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2016-2177.json"
},
{
"id": "CVE-2016-2178",
"published": "2016-06-07",
"quarter": "2016-Q2",
"title": "",
"description": "Operations in the DSA signing algorithm should run in constant time in order to avoid side channel attacks. A flaw in the OpenSSL DSA implementation means that a non-constant time codepath is followed for certain operations. This has been demonstrated through a cache-timing attack to be sufficient for an attacker to recover the private DSA key.",
"severity": "low",
"reporters": [
"César Pereida (Aalto University), Billy Brumley (Tampere University of Technology), and Yuval Yarom (The University of Adelaide and NICTA)"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20160922.txt",
"source_path": "secjson/CVE-2016-2178.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2016-2178.json"
},
{
"id": "CVE-2016-2180",
"published": "2016-07-22",
"quarter": "2016-Q3",
"title": "",
"description": "The function TS_OBJ_print_bio() misuses OBJ_obj2txt(): the return value is the total length the OID text representation would use and not the amount of data written. This will result in OOB reads when large OIDs are presented.",
"severity": "low",
"reporters": [
"Shi Lei (Gear Team, Qihoo 360 Inc.)"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20160922.txt",
"source_path": "secjson/CVE-2016-2180.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2016-2180.json"
},
{
"id": "CVE-2016-2182",
"published": "2016-08-16",
"quarter": "2016-Q3",
"title": "",
"description": "The function BN_bn2dec() does not check the return value of BN_div_word(). This can cause an OOB write if an application uses this function with an overly large BIGNUM. This could be a problem if an overly large certificate or CRL is printed out from an untrusted source. TLS is not affected because record limits will reject an oversized certificate before it is parsed.",
"severity": "low",
"reporters": [
"Shi Lei (Gear Team, Qihoo 360 Inc.)"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20160922.txt",
"source_path": "secjson/CVE-2016-2182.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2016-2182.json"
},
{
"id": "CVE-2016-2181",
"published": "2016-08-19",
"quarter": "2016-Q3",
"title": "",
"description": "A flaw in the DTLS replay attack protection mechanism means that records that arrive for future epochs update the replay protection \"window\" before the MAC for the record has been validated. This could be exploited by an attacker by sending a record for the next epoch (which does not have to decrypt or have a valid MAC), with a very large sequence number. This means that all subsequent legitimate packets are dropped causing a denial of service for a specific DTLS connection.",
"severity": "low",
"reporters": [
"OCAP audit team"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20160922.txt",
"source_path": "secjson/CVE-2016-2181.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2016-2181.json"
},
{
"id": "CVE-2016-2179",
"published": "2016-08-22",
"quarter": "2016-Q3",
"title": "",
"description": "In a DTLS connection where handshake messages are delivered out-of-order those messages that OpenSSL is not yet ready to process will be buffered for later use. Under certain circumstances, a flaw in the logic means that those messages do not get removed from the buffer even though the handshake has been completed. An attacker could force up to approx. 15 messages to remain in the buffer when they are no longer required. These messages will be cleared when the DTLS connection is closed. The defa",
"severity": "low",
"reporters": [
"Quan Luo"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20160922.txt",
"source_path": "secjson/CVE-2016-2179.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2016-2179.json"
},
{
"id": "CVE-2016-6302",
"published": "2016-08-23",
"quarter": "2016-Q3",
"title": "",
"description": "If a server uses SHA512 for TLS session ticket HMAC it is vulnerable to a DoS attack where a malformed ticket will result in an OOB read which will ultimately crash. The use of SHA512 in TLS session tickets is comparatively rare as it requires a custom server callback and ticket lookup mechanism.",
"severity": "low",
"reporters": [
"Shi Lei (Gear Team, Qihoo 360 Inc.)"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20160922.txt",
"source_path": "secjson/CVE-2016-6302.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2016-6302.json"
},
{
"id": "CVE-2016-2183",
"published": "2016-08-24",
"quarter": "2016-Q3",
"title": "SWEET32 attack on Triple-DES",
"description": "Because DES (and triple-DES) has only a 64-bit block size, birthday attacks are a real concern. For example, with the ability to run Javascript in a browser, it is possible to send enough traffic to cause a collision, and then use that information to recover something like a session Cookie. Triple-DES, which shows up as “DES-CBC3” in an OpenSSL cipher string, is still used on the Web, and major browsers are not yet willing to completely disable it. If you run a server, you should disable triple-",
"severity": "low",
"reporters": [
"Karthik Bhargavan and Gaetan Leurent from Inria"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/blog/blog/2016/08/24/sweet32/",
"source_path": "secjson/CVE-2016-2183.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2016-2183.json"
},
{
"id": "CVE-2016-6303",
"published": "2016-08-24",
"quarter": "2016-Q3",
"title": "",
"description": "An overflow can occur in MDC2_Update() either if called directly or through the EVP_DigestUpdate() function using MDC2. If an attacker is able to supply very large amounts of input data after a previous call to EVP_EncryptUpdate() with a partial block then a length check can overflow resulting in a heap corruption. The amount of data needed is comparable to SIZE_MAX which is impractical on most platforms.",
"severity": "low",
"reporters": [
"Shi Lei (Gear Team, Qihoo 360 Inc.)"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20160922.txt",
"source_path": "secjson/CVE-2016-6303.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2016-6303.json"
},
{
"id": "CVE-2016-6306",
"published": "2016-09-21",
"quarter": "2016-Q3",
"title": "",
"description": "In OpenSSL 1.0.2 and earlier some missing message length checks can result in OOB reads of up to 2 bytes beyond an allocated buffer. There is a theoretical DoS risk but this has not been observed in practice on common platforms. The messages affected are client certificate, client certificate request and server certificate. As a result the attack can only be performed against a client or a server which enables client authentication.",
"severity": "low",
"reporters": [
"Shi Lei (Gear Team, Qihoo 360 Inc.)"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20160922.txt",
"source_path": "secjson/CVE-2016-6306.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2016-6306.json"
},
{
"id": "CVE-2016-6307",
"published": "2016-09-21",
"quarter": "2016-Q3",
"title": "",
"description": "A TLS message includes 3 bytes for its length in the header for the message. This would allow for messages up to 16Mb in length. Messages of this length are excessive and OpenSSL includes a check to ensure that a peer is sending reasonably sized messages in order to avoid too much memory being consumed to service a connection. A flaw in the logic of version 1.1.0 means that memory for the message is allocated too early, prior to the excessive message length check. Due to way memory is allocated ",
"severity": "low",
"reporters": [
"Shi Lei (Gear Team, Qihoo 360 Inc.)"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20160922.txt",
"source_path": "secjson/CVE-2016-6307.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2016-6307.json"
},
{
"id": "CVE-2016-6308",
"published": "2016-09-21",
"quarter": "2016-Q3",
"title": "",
"description": "A DTLS message includes 3 bytes for its length in the header for the message. This would allow for messages up to 16Mb in length. Messages of this length are excessive and OpenSSL includes a check to ensure that a peer is sending reasonably sized messages in order to avoid too much memory being consumed to service a connection. A flaw in the logic of version 1.1.0 means that memory for the message is allocated too early, prior to the excessive message length check. Due to way memory is allocated",
"severity": "low",
"reporters": [
"Shi Lei (Gear Team, Qihoo 360 Inc.)"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20160922.txt",
"source_path": "secjson/CVE-2016-6308.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2016-6308.json"
},
{
"id": "CVE-2016-6304",
"published": "2016-09-22",
"quarter": "2016-Q3",
"title": "",
"description": "A malicious client can send an excessively large OCSP Status Request extension. If that client continually requests renegotiation, sending a large OCSP Status Request extension each time, then there will be unbounded memory growth on the server. This will eventually lead to a Denial Of Service attack through memory exhaustion. Servers with a default configuration are vulnerable even if they do not support OCSP. Builds using the \"no-ocsp\" build time option are not affected. Servers using OpenSSL ",
"severity": "high",
"reporters": [
"Shi Lei (Gear Team, Qihoo 360 Inc.)"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20160922.txt",
"source_path": "secjson/CVE-2016-6304.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2016-6304.json"
},
{
"id": "CVE-2016-6305",
"published": "2016-09-22",
"quarter": "2016-Q3",
"title": "",
"description": "OpenSSL 1.1.0 SSL/TLS will hang during a call to SSL_peek() if the peer sends an empty record. This could be exploited by a malicious peer in a Denial Of Service attack.",
"severity": "medium",
"reporters": [
"Alex Gaynor"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20160922.txt",
"source_path": "secjson/CVE-2016-6305.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2016-6305.json"
},
{
"id": "CVE-2016-6309",
"published": "2016-09-26",
"quarter": "2016-Q3",
"title": "",
"description": "This issue only affects OpenSSL 1.1.0a, released on 22nd September 2016. The patch applied to address CVE-2016-6307 resulted in an issue where if a message larger than approx 16k is received then the underlying buffer to store the incoming message is reallocated and moved. Unfortunately a dangling pointer to the old location is left which results in an attempt to write to the previously freed location. This is likely to result in a crash, however it could potentially lead to execution of arbitra",
"severity": "critical",
"reporters": [
"Robert Święcki (Google Security Team)"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20160926.txt",
"source_path": "secjson/CVE-2016-6309.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2016-6309.json"
},
{
"id": "CVE-2016-7052",
"published": "2016-09-26",
"quarter": "2016-Q3",
"title": "Missing CRL sanity check",
"description": "This issue only affects OpenSSL 1.0.2i, released on 22nd September 2016. A bug fix which included a CRL sanity check was added to OpenSSL 1.1.0 but was omitted from OpenSSL 1.0.2i. As a result any attempt to use CRLs in OpenSSL 1.0.2i will crash with a null pointer exception.",
"severity": "medium",
"reporters": [
"Bruce Stephens and Thomas Jakobi"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20160926.txt",
"source_path": "secjson/CVE-2016-7052.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2016-7052.json"
},
{
"id": "CVE-2016-7053",
"published": "2016-11-10",
"quarter": "2016-Q4",
"title": "CMS Null dereference",
"description": "Applications parsing invalid CMS structures can crash with a NULL pointer dereference. This is caused by a bug in the handling of the ASN.1 CHOICE type in OpenSSL 1.1.0 which can result in a NULL value being passed to the structure callback if an attempt is made to free certain invalid encodings. Only CHOICE structures using a callback which do not handle NULL value are affected.",
"severity": "medium",
"reporters": [
"Tyler Nighswander (ForAllSecure)"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20161110.txt",
"source_path": "secjson/CVE-2016-7053.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2016-7053.json"
},
{
"id": "CVE-2016-7054",
"published": "2016-11-10",
"quarter": "2016-Q4",
"title": "ChaCha20/Poly1305 heap-buffer-overflow",
"description": "TLS connections using *-CHACHA20-POLY1305 ciphersuites are susceptible to a DoS attack by corrupting larger payloads. This can result in an OpenSSL crash. This issue is not considered to be exploitable beyond a DoS.",
"severity": "high",
"reporters": [
"Robert Święcki (Google Security Team)"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20161110.txt",
"source_path": "secjson/CVE-2016-7054.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2016-7054.json"
},
{
"id": "CVE-2016-7055",
"published": "2016-11-10",
"quarter": "2016-Q4",
"title": "Montgomery multiplication may produce incorrect results",
"description": "There is a carry propagating bug in the Broadwell-specific Montgomery multiplication procedure that handles input lengths divisible by, but longer than 256 bits. Analysis suggests that attacks against RSA, DSA and DH private keys are impossible. This is because the subroutine in question is not used in operations with the private key itself and an input of the attacker's direct choice. Otherwise the bug can manifest itself as transient authentication and key negotiation failures or reproducible ",
"severity": "low",
"reporters": [
"Publicly reported"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20161110.txt",
"source_path": "secjson/CVE-2016-7055.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2016-7055.json"
},
{
"id": "CVE-2017-3730",
"published": "2017-01-26",
"quarter": "2017-Q1",
"title": "Bad (EC)DHE parameters cause a client crash",
"description": "If a malicious server supplies bad parameters for a DHE or ECDHE key exchange then this can result in the client attempting to dereference a NULL pointer leading to a client crash. This could be exploited in a Denial of Service attack.",
"severity": "medium",
"reporters": [
"Guido Vranken"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20170126.txt",
"source_path": "secjson/CVE-2017-3730.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2017-3730.json"
},
{
"id": "CVE-2017-3731",
"published": "2017-01-26",
"quarter": "2017-Q1",
"title": "Truncated packet could crash via OOB read",
"description": "If an SSL/TLS server or client is running on a 32-bit host, and a specific cipher is being used, then a truncated packet can cause that server or client to perform an out-of-bounds read, usually resulting in a crash. For OpenSSL 1.1.0, the crash can be triggered when using CHACHA20/POLY1305; users should upgrade to 1.1.0d. For Openssl 1.0.2, the crash can be triggered when using RC4-MD5; users who have not disabled that algorithm should update to 1.0.2k.",
"severity": "medium",
"reporters": [
"Robert Święcki of Google"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20170126.txt",
"source_path": "secjson/CVE-2017-3731.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2017-3731.json"
},
{
"id": "CVE-2017-3732",
"published": "2017-01-26",
"quarter": "2017-Q1",
"title": "BN_mod_exp may produce incorrect results on x86_64",
"description": "There is a carry propagating bug in the x86_64 Montgomery squaring procedure. No EC algorithms are affected. Analysis suggests that attacks against RSA and DSA as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH are considered just feasible (although very difficult) because most of the work necessary to deduce information about a private key may be performed offline. The amount of resources required for such an attack would be very signif",
"severity": "medium",
"reporters": [
"OSS-Fuzz project"
],
"attribution_band": "fuzzing_marker",
"attribution_markers": [
"OSS-Fuzz",
"fuzzing"
],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20170126.txt",
"source_path": "secjson/CVE-2017-3732.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2017-3732.json"
},
{
"id": "CVE-2017-3733",
"published": "2017-02-16",
"quarter": "2017-Q1",
"title": "Encrypt-Then-Mac renegotiation crash",
"description": "During a renegotiation handshake if the Encrypt-Then-Mac extension is negotiated where it was not in the original handshake (or vice-versa) then this can cause OpenSSL to crash (dependent on ciphersuite). Both clients and servers are affected.",
"severity": "high",
"reporters": [
"Joe Orton (Red Hat)"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20170216.txt",
"source_path": "secjson/CVE-2017-3733.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2017-3733.json"
},
{
"id": "CVE-2017-3735",
"published": "2017-08-28",
"quarter": "2017-Q3",
"title": "Possible Overread in parsing X.509 IPAdressFamily",
"description": "While parsing an IPAdressFamily extension in an X.509 certificate, it is possible to do a one-byte overread. This would result in an incorrect text display of the certificate.",
"severity": "low",
"reporters": [
"Google OSS-Fuzz"
],
"attribution_band": "fuzzing_marker",
"attribution_markers": [
"OSS-Fuzz",
"fuzzing"
],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20170828.txt",
"source_path": "secjson/CVE-2017-3735.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2017-3735.json"
},
{
"id": "CVE-2017-3736",
"published": "2017-11-02",
"quarter": "2017-Q4",
"title": "bn_sqrx8x_internal carry bug on x86_64",
"description": "There is a carry propagating bug in the x86_64 Montgomery squaring procedure. No EC algorithms are affected. Analysis suggests that attacks against RSA and DSA as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH are considered just feasible (although very difficult) because most of the work necessary to deduce information about a private key may be performed offline. The amount of resources required for such an attack would be very signif",
"severity": "medium",
"reporters": [
"Google OSS-Fuzz"
],
"attribution_band": "fuzzing_marker",
"attribution_markers": [
"OSS-Fuzz",
"fuzzing"
],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20171102.txt",
"source_path": "secjson/CVE-2017-3736.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2017-3736.json"
},
{
"id": "CVE-2017-3737",
"published": "2017-12-07",
"quarter": "2017-Q4",
"title": "Read/write after SSL object in error state",
"description": "OpenSSL 1.0.2 (starting from version 1.0.2b) introduced an \"error state\" mechanism. The intent was that if a fatal error occurred during a handshake then OpenSSL would move into the error state and would immediately fail if you attempted to continue the handshake. This works as designed for the explicit handshake functions (SSL_do_handshake(), SSL_accept() and SSL_connect()), however due to a bug it does not work correctly if SSL_read() or SSL_write() is called directly. In that scenario, if the",
"severity": "medium",
"reporters": [
"David Benjamin (Google)"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20171207.txt",
"source_path": "secjson/CVE-2017-3737.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2017-3737.json"
},
{
"id": "CVE-2017-3738",
"published": "2017-12-07",
"quarter": "2017-Q4",
"title": "bn_sqrx8x_internal carry bug on x86_64",
"description": "There is an overflow bug in the AVX2 Montgomery multiplication procedure used in exponentiation with 1024-bit moduli. No EC algorithms are affected. Analysis suggests that attacks against RSA and DSA as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH1024 are considered just feasible, because most of the work necessary to deduce information about a private key may be performed offline. The amount of resources required for such an attack w",
"severity": "low",
"reporters": [
"David Benjamin (Google)/Google OSS-Fuzz"
],
"attribution_band": "fuzzing_marker",
"attribution_markers": [
"OSS-Fuzz",
"fuzzing"
],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20171207.txt",
"source_path": "secjson/CVE-2017-3738.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2017-3738.json"
},
{
"id": "CVE-2018-0733",
"published": "2018-03-27",
"quarter": "2018-Q1",
"title": "Incorrect CRYPTO_memcmp on HP-UX PA-RISC",
"description": "Because of an implementation bug the PA-RISC CRYPTO_memcmp function is effectively reduced to only comparing the least significant bit of each byte. This allows an attacker to forge messages that would be considered as authenticated in an amount of tries lower than that guaranteed by the security claims of the scheme. The module can only be compiled by the HP-UX assembler, so that only HP-UX PA-RISC targets are affected.",
"severity": "medium",
"reporters": [
"Peter Waltenberg (IBM)"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20180327.txt",
"source_path": "secjson/CVE-2018-0733.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2018-0733.json"
},
{
"id": "CVE-2018-0739",
"published": "2018-03-27",
"quarter": "2018-Q1",
"title": "Constructed ASN.1 types with a recursive definition could exceed the stack",
"description": "Constructed ASN.1 types with a recursive definition (such as can be found in PKCS7) could eventually exceed the stack given malicious input with excessive recursion. This could result in a Denial Of Service attack. There are no such structures used within SSL/TLS that come from untrusted sources so this is considered safe.",
"severity": "medium",
"reporters": [
"OSS-fuzz"
],
"attribution_band": "fuzzing_marker",
"attribution_markers": [
"OSS-Fuzz",
"fuzzing"
],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20180327.txt",
"source_path": "secjson/CVE-2018-0739.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2018-0739.json"
},
{
"id": "CVE-2018-0737",
"published": "2018-04-16",
"quarter": "2018-Q2",
"title": "Cache timing vulnerability in RSA Key Generation",
"description": "The OpenSSL RSA Key generation algorithm has been shown to be vulnerable to a cache timing side channel attack. An attacker with sufficient access to mount cache timing attacks during the RSA key generation process could recover the private key.",
"severity": "low",
"reporters": [
"Alejandro Cabrera Aldaya, Billy Brumley, Cesar Pereida Garcia and Luis Manuel Alvarez Tapia"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20180416.txt",
"source_path": "secjson/CVE-2018-0737.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2018-0737.json"
},
{
"id": "CVE-2018-0732",
"published": "2018-06-12",
"quarter": "2018-Q2",
"title": "Client DoS due to large DH parameter",
"description": "During key agreement in a TLS handshake using a DH(E) based ciphersuite a malicious server can send a very large prime value to the client. This will cause the client to spend an unreasonably long period of time generating a key for this prime resulting in a hang until the client has finished. This could be exploited in a Denial Of Service attack.",
"severity": "low",
"reporters": [
"Guido Vranken"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20180612.txt",
"source_path": "secjson/CVE-2018-0732.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2018-0732.json"
},
{
"id": "CVE-2018-0735",
"published": "2018-10-29",
"quarter": "2018-Q4",
"title": "Timing attack against ECDSA signature generation",
"description": "The OpenSSL ECDSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing algorithm to recover the private key.",
"severity": "low",
"reporters": [
"Samuel Weiser"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20181029.txt",
"source_path": "secjson/CVE-2018-0735.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2018-0735.json"
},
{
"id": "CVE-2018-0734",
"published": "2018-10-30",
"quarter": "2018-Q4",
"title": "Timing attack against DSA",
"description": "The OpenSSL DSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing algorithm to recover the private key.",
"severity": "low",
"reporters": [
"Samuel Weiser"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20181030.txt",
"source_path": "secjson/CVE-2018-0734.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2018-0734.json"
},
{
"id": "CVE-2018-5407",
"published": "2018-11-02",
"quarter": "2018-Q4",
"title": "Microarchitecture timing vulnerability in ECC scalar multiplication",
"description": "OpenSSL ECC scalar multiplication, used in e.g. ECDSA and ECDH, has been shown to be vulnerable to a microarchitecture timing side channel attack. An attacker with sufficient access to mount local timing attacks during ECDSA signature generation could recover the private key.",
"severity": "low",
"reporters": [
"Alejandro Cabrera Aldaya, Billy Brumley, Sohaib ul Hassan, Cesar Pereida Garcia and Nicola Tuveri"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20181112.txt",
"source_path": "secjson/CVE-2018-5407.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2018-5407.json"
},
{
"id": "CVE-2019-1559",
"published": "2019-02-26",
"quarter": "2019-Q1",
"title": "0-byte record padding oracle",
"description": "If an application encounters a fatal protocol error and then calls SSL_shutdown() twice (once to send a close_notify, and once to receive one) then OpenSSL can respond differently to the calling application if a 0 byte record is received with invalid padding compared to if a 0 byte record is received with an invalid MAC. If the application then behaves differently based on that in a way that is detectable to the remote peer, then this amounts to a padding oracle that could be used to decrypt dat",
"severity": "medium",
"reporters": [
"Juraj Somorovsky, Robert Merget and Nimrod Aviram, with additional investigation by Steven Collison and Andrew Hourselt"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20190226.txt",
"source_path": "secjson/CVE-2019-1559.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2019-1559.json"
},
{
"id": "CVE-2019-1543",
"published": "2019-03-06",
"quarter": "2019-Q1",
"title": "ChaCha20-Poly1305 with long nonces",
"description": "ChaCha20-Poly1305 is an AEAD cipher, and requires a unique nonce input for every encryption operation. RFC 7539 specifies that the nonce value (IV) should be 96 bits (12 bytes). OpenSSL allows a variable nonce length and front pads the nonce with 0 bytes if it is less than 12 bytes. However it also incorrectly allows a nonce to be set of up to 16 bytes. In this case only the last 12 bytes are significant and any additional leading bytes are ignored. It is a requirement of using this cipher that ",
"severity": "low",
"reporters": [
"Joran Dirk Greef of Ronomon"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20190306.txt",
"source_path": "secjson/CVE-2019-1543.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2019-1543.json"
},
{
"id": "CVE-2019-1552",
"published": "2019-07-30",
"quarter": "2019-Q3",
"title": "Windows builds with insecure path defaults",
"description": "OpenSSL has internal defaults for a directory tree where it can find a configuration file as well as certificates used for verification in TLS. This directory is most commonly referred to as OPENSSLDIR, and is configurable with the --prefix / --openssldir configuration options. For OpenSSL versions 1.1.0 and 1.1.1, the mingw configuration targets assume that resulting programs and libraries are installed in a Unix-like environment and the default prefix for program installation as well as for OP",
"severity": "low",
"reporters": [
"Rich Mirch"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20190730.txt",
"source_path": "secjson/CVE-2019-1552.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2019-1552.json"
},
{
"id": "CVE-2019-1547",
"published": "2019-09-10",
"quarter": "2019-Q3",
"title": "ECDSA remote timing attack",
"description": "Normally in OpenSSL EC groups always have a co-factor present and this is used in side channel resistant code paths. However, in some cases, it is possible to construct a group using explicit parameters (instead of using a named curve). In those cases it is possible that such a group does not have the cofactor present. This can occur even where all the parameters match a known named curve. If such a curve is used then OpenSSL falls back to non-side channel resistant code paths which may result i",
"severity": "low",
"reporters": [
"Cesar Pereida García, Sohaib ul Hassan, Nicola Tuveri, Iaroslav Gridin, Alejandro Cabrera Aldaya, and Billy Brumley"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20190910.txt",
"source_path": "secjson/CVE-2019-1547.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2019-1547.json"
},
{
"id": "CVE-2019-1549",
"published": "2019-09-10",
"quarter": "2019-Q3",
"title": "Fork Protection",
"description": "OpenSSL 1.1.1 introduced a rewritten random number generator (RNG). This was intended to include protection in the event of a fork() system call in order to ensure that the parent and child processes did not share the same RNG state. However this protection was not being used in the default case. A partial mitigation for this issue is that the output from a high precision timer is mixed into the RNG state so the likelihood of a parent and child process sharing state is significantly reduced. If ",
"severity": "low",
"reporters": [
"Matt Caswell"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20190910.txt",
"source_path": "secjson/CVE-2019-1549.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2019-1549.json"
},
{
"id": "CVE-2019-1563",
"published": "2019-09-10",
"quarter": "2019-Q3",
"title": "Padding Oracle in PKCS7_dataDecode and CMS_decrypt_set1_pkey",
"description": "In situations where an attacker receives automated notification of the success or failure of a decryption attempt an attacker, after sending a very large number of messages to be decrypted, can recover a CMS/PKCS7 transported encryption key or decrypt any RSA encrypted message that was encrypted with the public RSA key, using a Bleichenbacher padding oracle attack. Applications are not affected if they use a certificate together with the private RSA key to the CMS_decrypt or PKCS7_decrypt functi",
"severity": "low",
"reporters": [
"Bernd Edlinger"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20190910.txt",
"source_path": "secjson/CVE-2019-1563.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2019-1563.json"
},
{
"id": "CVE-2019-1551",
"published": "2019-12-06",
"quarter": "2019-Q4",
"title": "rsaz_512_sqr overflow bug on x86_64",
"description": "There is an overflow bug in the x86_64 Montgomery squaring procedure used in exponentiation with 512-bit moduli. No EC algorithms are affected. Analysis suggests that attacks against 2-prime RSA1024, 3-prime RSA1536, and DSA1024 as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH512 are considered just feasible. However, for an attack the target would have to re-use the DH512 private key, which is not recommended anyway. Also applications",
"severity": "low",
"reporters": [
"OSS-Fuzz and Guido Vranken"
],
"attribution_band": "fuzzing_marker",
"attribution_markers": [
"OSS-Fuzz",
"fuzzing"
],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20191206.txt",
"source_path": "secjson/CVE-2019-1551.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2019-1551.json"
},
{
"id": "CVE-2020-1967",
"published": "2020-04-21",
"quarter": "2020-Q2",
"title": "Segmentation fault in SSL_check_chain",
"description": "Server or client applications that call the SSL_check_chain() function during or after a TLS 1.3 handshake may crash due to a NULL pointer dereference as a result of incorrect handling of the \"signature_algorithms_cert\" TLS extension. The crash occurs if an invalid or unrecognised signature algorithm is received from the peer. This could be exploited by a malicious peer in a Denial of Service attack. OpenSSL version 1.1.1d, 1.1.1e, and 1.1.1f are affected by this issue. This issue did not affect",
"severity": "high",
"reporters": [
"Bernd Edlinger"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20200421.txt",
"source_path": "secjson/CVE-2020-1967.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2020-1967.json"
},
{
"id": "CVE-2020-1968",
"published": "2020-09-09",
"quarter": "2020-Q3",
"title": "Raccoon attack",
"description": "The Raccoon attack exploits a flaw in the TLS specification which can lead to an attacker being able to compute the pre-master secret in connections which have used a Diffie-Hellman (DH) based ciphersuite. In such a case this would result in the attacker being able to eavesdrop on all encrypted communications sent over that TLS connection. The attack can only be exploited if an implementation re-uses a DH secret across multiple TLS connections. Note that this issue only impacts DH ciphersuites a",
"severity": "low",
"reporters": [
"Robert Merget, Marcus Brinkmann, Nimrod Aviram, and Juraj Somorovsky"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20200909.txt",
"source_path": "secjson/CVE-2020-1968.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2020-1968.json"
},
{
"id": "CVE-2020-1971",
"published": "2020-12-08",
"quarter": "2020-Q4",
"title": "EDIPARTYNAME NULL pointer dereference",
"description": "The X.509 GeneralName type is a generic type for representing different types of names. One of those name types is known as EDIPartyName. OpenSSL provides a function GENERAL_NAME_cmp which compares different instances of a GENERAL_NAME to see if they are equal or not. This function behaves incorrectly when both GENERAL_NAMEs contain an EDIPARTYNAME. A NULL pointer dereference and a crash may occur leading to a possible denial of service attack. OpenSSL itself uses the GENERAL_NAME_cmp function f",
"severity": "high",
"reporters": [
"David Benjamin (Google)"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20201208.txt",
"source_path": "secjson/CVE-2020-1971.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2020-1971.json"
},
{
"id": "CVE-2021-23839",
"published": "2021-02-16",
"quarter": "2021-Q1",
"title": "Incorrect SSLv2 rollback protection",
"description": "OpenSSL 1.0.2 supports SSLv2. If a client attempts to negotiate SSLv2 with a server that is configured to support both SSLv2 and more recent SSL and TLS versions then a check is made for a version rollback attack when unpadding an RSA signature. Clients that support SSL or TLS versions greater than SSLv2 are supposed to use a special form of padding. A server that supports greater than SSLv2 is supposed to reject connection attempts from a client where this special form of padding is present, be",
"severity": "low",
"reporters": [
"D. Katz and Joel Luellwitz (Trustwave)"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20210216.txt",
"source_path": "secjson/CVE-2021-23839.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2021-23839.json"
},
{
"id": "CVE-2021-23840",
"published": "2021-02-16",
"quarter": "2021-Q1",
"title": "Integer overflow in CipherUpdate",
"description": "Calls to EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate may overflow the output length argument in some cases where the input length is close to the maximum permissable length for an integer on the platform. In such cases the return value from the function call will be 1 (indicating success), but the output length value will be negative. This could cause applications to behave incorrectly or crash. OpenSSL versions 1.1.1i and below are affected by this issue. Users of these versions s",
"severity": "low",
"reporters": [
"Paul Kehrer"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20210216.txt",
"source_path": "secjson/CVE-2021-23840.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2021-23840.json"
},
{
"id": "CVE-2021-23841",
"published": "2021-02-16",
"quarter": "2021-Q1",
"title": "Null pointer deref in X509_issuer_and_serial_hash()",
"description": "The OpenSSL public API function X509_issuer_and_serial_hash() attempts to create a unique hash value based on the issuer and serial number data contained within an X509 certificate. However it fails to correctly handle any errors that may occur while parsing the issuer field (which might occur if the issuer field is maliciously constructed). This may subsequently result in a NULL pointer deref and a crash leading to a potential denial of service attack. The function X509_issuer_and_serial_hash()",
"severity": "medium",
"reporters": [
"Tavis Ormandy (Google)"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20210216.txt",
"source_path": "secjson/CVE-2021-23841.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2021-23841.json"
},
{
"id": "CVE-2021-3449",
"published": "2021-03-25",
"quarter": "2021-Q1",
"title": "NULL pointer deref in signature_algorithms processing",
"description": "An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. If a TLSv1.2 renegotiation ClientHello omits the signature_algorithms extension (where it was present in the initial ClientHello), but includes a signature_algorithms_cert extension then a NULL pointer dereference will result, leading to a crash and a denial of service attack. A server is only vulnerable if it has TLSv1.2 and renegotiation enabled (which is the default configuration). O",
"severity": "high",
"reporters": [
"Peter Kästle (Nokia) and Samuel Sapalski (Nokia)"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20210325.txt",
"source_path": "secjson/CVE-2021-3449.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2021-3449.json"
},
{
"id": "CVE-2021-3450",
"published": "2021-03-25",
"quarter": "2021-Q1",
"title": "CA certificate check bypass with X509_V_FLAG_X509_STRICT",
"description": "The X509_V_FLAG_X509_STRICT flag enables additional security checks of the certificates present in a certificate chain. It is not set by default. Starting from OpenSSL version 1.1.1h a check to disallow certificates in the chain that have explicitly encoded elliptic curve parameters was added as an additional strict check. An error in the implementation of this check meant that the result of a previous check to confirm that certificates in the chain are valid CA certificates was overwritten. Thi",
"severity": "high",
"reporters": [
"Benjamin Kaduk (Akamai), Xiang Ding (Akamai), others at Akamai"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20210325.txt",
"source_path": "secjson/CVE-2021-3450.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2021-3450.json"
},
{
"id": "CVE-2021-3711",
"published": "2021-08-24",
"quarter": "2021-Q3",
"title": "SM2 Decryption Buffer Overflow",
"description": "In order to decrypt SM2 encrypted data an application is expected to call the API function EVP_PKEY_decrypt(). Typically an application will call this function twice. The first time, on entry, the \"out\" parameter can be NULL and, on exit, the \"outlen\" parameter is populated with the buffer size required to hold the decrypted plaintext. The application can then allocate a sufficiently sized buffer and call EVP_PKEY_decrypt() again, but this time passing a non-NULL value for the \"out\" parameter. A",
"severity": "high",
"reporters": [
"John Ouyang"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20210824.txt",
"source_path": "secjson/CVE-2021-3711.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2021-3711.json"
},
{
"id": "CVE-2021-3712",
"published": "2021-08-24",
"quarter": "2021-Q3",
"title": "Read buffer overruns processing ASN.1 strings",
"description": "ASN.1 strings are represented internally within OpenSSL as an ASN1_STRING structure which contains a buffer holding the string data and a field holding the buffer length. This contrasts with normal C strings which are repesented as a buffer for the string data which is terminated with a NUL (0) byte. Although not a strict requirement, ASN.1 strings that are parsed using OpenSSL's own \"d2i\" functions (and other similar parsing functions) as well as any string whose value has been set with the ASN",
"severity": "medium",
"reporters": [
"Ingo Schwarze"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20210824.txt",
"source_path": "secjson/CVE-2021-3712.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2021-3712.json"
},
{
"id": "CVE-2021-4044",
"published": "2021-12-14",
"quarter": "2021-Q4",
"title": "Invalid handling of X509_verify_cert() internal errors in libssl",
"description": "Internally libssl in OpenSSL calls X509_verify_cert() on the client side to verify a certificate supplied by a server. That function may return a negative return value to indicate an internal error (for example out of memory). Such a negative return value is mishandled by OpenSSL and will cause an IO function (such as SSL_connect() or SSL_do_handshake()) to not indicate success and a subsequent call to SSL_get_error() to return the value SSL_ERROR_WANT_RETRY_VERIFY. This return value is only sup",
"severity": "medium",
"reporters": [
"Tobias Nießen"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20211214.txt",
"source_path": "secjson/CVE-2021-4044.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2021-4044.json"
},
{
"id": "CVE-2021-4160",
"published": "2022-01-28",
"quarter": "2022-Q1",
"title": "BN_mod_exp may produce incorrect results on MIPS",
"description": "There is a carry propagation bug in the MIPS32 and MIPS64 squaring procedure. Many EC algorithms are affected, including some of the TLS 1.3 default curves. Impact was not analyzed in detail, because the pre-requisites for attack are considered unlikely and include reusing private keys. Analysis suggests that attacks against RSA and DSA as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH are considered just feasible (although very difficu",
"severity": "medium",
"reporters": [
"Bernd Edlinger"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20220128.txt",
"source_path": "secjson/CVE-2021-4160.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2021-4160.json"
},
{
"id": "CVE-2022-0778",
"published": "2022-03-15",
"quarter": "2022-Q1",
"title": "Infinite loop in BN_mod_sqrt() reachable when parsing certificates",
"description": "The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli. Internally this function is used when parsing certificates that contain elliptic curve public keys in compressed form or explicit elliptic curve parameters with a base point encoded in compressed form. It is possible to trigger the infinite loop by crafting a certificate that has invalid explicit curve parameters. Since certificate parsing happens prior to veri",
"severity": "high",
"reporters": [
"Tavis Ormandy (Google)"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20220315.txt",
"source_path": "secjson/CVE-2022-0778.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2022-0778.json"
},
{
"id": "CVE-2022-1292",
"published": "2022-05-03",
"quarter": "2022-Q2",
"title": "The c_rehash script allows command injection",
"description": "The c_rehash script does not properly sanitise shell metacharacters to prevent command injection. This script is distributed by some operating systems in a manner where it is automatically executed. On such operating systems, an attacker could execute arbitrary commands with the privileges of the script. Use of the c_rehash script is considered obsolete and should be replaced by the OpenSSL rehash command line tool.",
"severity": "medium",
"reporters": [
"Elison Niven (Sophos)"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20220503.txt",
"source_path": "secjson/CVE-2022-1292.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2022-1292.json"
},
{
"id": "CVE-2022-1343",
"published": "2022-05-03",
"quarter": "2022-Q2",
"title": "OCSP_basic_verify may incorrectly verify the response signing certificate",
"description": "The function `OCSP_basic_verify` verifies the signer certificate on an OCSP response. In the case where the (non-default) flag OCSP_NOCHECKS is used then the response will be positive (meaning a successful verification) even in the case where the response signing certificate fails to verify. It is anticipated that most users of `OCSP_basic_verify` will not use the OCSP_NOCHECKS flag. In this case the `OCSP_basic_verify` function will return a negative value (indicating a fatal error) in the case",
"severity": "medium",
"reporters": [
"Raul Metsma"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20220503.txt",
"source_path": "secjson/CVE-2022-1343.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2022-1343.json"
},
{
"id": "CVE-2022-1434",
"published": "2022-05-03",
"quarter": "2022-Q2",
"title": "Incorrect MAC key used in the RC4-MD5 ciphersuite",
"description": "The OpenSSL 3.0 implementation of the RC4-MD5 ciphersuite incorrectly uses the AAD data as the MAC key. This makes the MAC key trivially predictable. An attacker could exploit this issue by performing a man-in-the-middle attack to modify data being sent from one endpoint to an OpenSSL 3.0 recipient such that the modified data would still pass the MAC integrity check. Note that data sent from an OpenSSL 3.0 endpoint to a non-OpenSSL 3.0 endpoint will always be rejected by the recipient and the co",
"severity": "low",
"reporters": [
"Tom Colley (Broadcom)"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20220503.txt",
"source_path": "secjson/CVE-2022-1434.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2022-1434.json"
},
{
"id": "CVE-2022-1473",
"published": "2022-05-03",
"quarter": "2022-Q2",
"title": "Resource leakage when decoding certificates and keys",
"description": "The OPENSSL_LH_flush() function, which empties a hash table, contains a bug that breaks reuse of the memory occuppied by the removed hash table entries. This function is used when decoding certificates or keys. If a long lived process periodically decodes certificates or keys its memory usage will expand without bounds and the process might be terminated by the operating system causing a denial of service. Also traversing the empty hash table entries will take increasingly more time. Typically s",
"severity": "low",
"reporters": [
"Aliaksei Levin"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20220503.txt",
"source_path": "secjson/CVE-2022-1473.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2022-1473.json"
},
{
"id": "CVE-2022-2068",
"published": "2022-06-21",
"quarter": "2022-Q2",
"title": "The c_rehash script allows command injection",
"description": "In addition to the c_rehash shell command injection identified in CVE-2022-1292, further circumstances where the c_rehash script does not properly sanitise shell metacharacters to prevent command injection were found by code review. When the CVE-2022-1292 was fixed it was not discovered that there are other places in the script where the file names of certificates being hashed were possibly passed to a command executed through the shell. This script is distributed by some operating systems in a ",
"severity": "medium",
"reporters": [
"Chancen (Qingteng 73lab)"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20220621.txt",
"source_path": "secjson/CVE-2022-2068.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2022-2068.json"
},
{
"id": "CVE-2022-2097",
"published": "2022-07-05",
"quarter": "2022-Q3",
"title": "AES OCB fails to encrypt some bytes",
"description": "AES OCB mode for 32-bit x86 platforms using the AES-NI assembly optimised implementation will not encrypt the entirety of the data under some circumstances. This could reveal sixteen bytes of data that was preexisting in the memory that wasn't written. In the special case of \"in place\" encryption, sixteen bytes of the plaintext would be revealed. Since OpenSSL does not support OCB based cipher suites for TLS and DTLS, they are both unaffected.",
"severity": "medium",
"reporters": [
"Alex Chernyakhovsky"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20220705.txt",
"source_path": "secjson/CVE-2022-2097.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2022-2097.json"
},
{
"id": "CVE-2022-2274",
"published": "2022-07-05",
"quarter": "2022-Q3",
"title": "Bug in RSA implementation for AVX512IFMA capable CPUs",
"description": "The OpenSSL 3.0.4 release introduced a serious bug in the RSA implementation for X86_64 CPUs supporting the AVX512IFMA instructions. This issue makes the RSA implementation with 2048 bit private keys incorrect on such machines and memory corruption will happen during the computation. As a consequence of the memory corruption an attacker may be able to trigger a remote code execution on the machine performing the computation. SSL/TLS servers or other servers using 2048 bit RSA private keys runnin",
"severity": "high",
"reporters": [
"Xi Ruoyao"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20220705.txt",
"source_path": "secjson/CVE-2022-2274.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2022-2274.json"
},
{
"id": "CVE-2022-3358",
"published": "2022-09-29",
"quarter": "2022-Q3",
"title": "Using a Custom Cipher with NID_undef may lead to NULL encryption",
"description": "OpenSSL supports creating a custom cipher via the legacy EVP_CIPHER_meth_new() function and associated function calls. This function was deprecated in OpenSSL 3.0 and application authors are instead encouraged to use the new provider mechanism in order to implement custom ciphers. OpenSSL versions 3.0.0 to 3.0.5 incorrectly handle legacy custom ciphers passed to the EVP_EncryptInit_ex2(), EVP_DecryptInit_ex2() and EVP_CipherInit_ex2() functions (as well as other similarly named encryption and de",
"severity": "low",
"reporters": [
"Chris Rapier (Pittsburgh Supercomputing Center)"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20221011.txt",
"source_path": "secjson/CVE-2022-3358.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2022-3358.json"
},
{
"id": "CVE-2022-3602",
"published": "2022-11-01",
"quarter": "2022-Q4",
"title": "X.509 Email Address 4-byte Buffer Overflow",
"description": "A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after certificate chain signature verification and requires either a CA to have signed the malicious certificate or for the application to continue certificate verification despite failure to construct a path to a trusted issuer. An attacker can craft a malicious email address to overflow four attacker-controlled bytes on the stack. This buffer overflow could resul",
"severity": "high",
"reporters": [
"Polar Bear"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20221101.txt",
"source_path": "secjson/CVE-2022-3602.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2022-3602.json"
},
{
"id": "CVE-2022-3786",
"published": "2022-11-01",
"quarter": "2022-Q4",
"title": "X.509 Email Address Variable Length Buffer Overflow",
"description": "A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after certificate chain signature verification and requires either a CA to have signed a malicious certificate or for an application to continue certificate verification despite failure to construct a path to a trusted issuer. An attacker can craft a malicious email address in a certificate to overflow an arbitrary number of bytes containing the '.' character (deci",
"severity": "high",
"reporters": [
"Viktor Dukhovni"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20221101.txt",
"source_path": "secjson/CVE-2022-3786.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2022-3786.json"
},
{
"id": "CVE-2022-3996",
"published": "2022-12-13",
"quarter": "2022-Q4",
"title": "X.509 Policy Constraints Double Locking",
"description": "If an X.509 certificate contains a malformed policy constraint and policy processing is enabled, then a write lock will be taken twice recursively. On some operating systems (most widely: Windows) this results in a denial of service when the affected process hangs. Policy processing being enabled on a publicly facing server is not considered to be a common setup. Policy processing is enabled by passing the `-policy` argument to the command line utilities or by calling the `X509_VERIFY_PARAM_set1",
"severity": "low",
"reporters": [
"Polar Bear"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [
"CWE-667"
],
"advisory_url": "https://www.openssl.org/news/secadv/20221213.txt",
"source_path": "secjson/CVE-2022-3996.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2022-3996.json"
},
{
"id": "CVE-2022-4203",
"published": "2023-02-07",
"quarter": "2023-Q1",
"title": "X.509 Name Constraints Read Buffer Overflow",
"description": "A read buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after certificate chain signature verification and requires either a CA to have signed the malicious certificate or for the application to continue certificate verification despite failure to construct a path to a trusted issuer. The read buffer overrun might result in a crash which could lead to a denial of service attack. In theory it could also result in th",
"severity": "medium",
"reporters": [
"Corey Bonnell from Digicert"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20230207.txt",
"source_path": "secjson/CVE-2022-4203.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2022-4203.json"
},
{
"id": "CVE-2022-4304",
"published": "2023-02-07",
"quarter": "2023-Q1",
"title": "Timing Oracle in RSA Decryption",
"description": "A timing based side channel exists in the OpenSSL RSA Decryption implementation which could be sufficient to recover a plaintext across a network in a Bleichenbacher style attack. To achieve a successful decryption an attacker would have to be able to send a very large number of trial messages for decryption. The vulnerability affects all RSA padding modes: PKCS#1 v1.5, RSA-OEAP and RSASVE. For example, in a TLS connection, RSA is commonly used by a client to send an encrypted pre-master secret ",
"severity": "medium",
"reporters": [
"Hubert Kario from Red Hat"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20230207.txt",
"source_path": "secjson/CVE-2022-4304.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2022-4304.json"
},
{
"id": "CVE-2022-4450",
"published": "2023-02-07",
"quarter": "2023-Q1",
"title": "Double free after calling PEM_read_bio_ex",
"description": "The function PEM_read_bio_ex() reads a PEM file from a BIO and parses and decodes the \"name\" (e.g. \"CERTIFICATE\"), any header data and the payload data. If the function succeeds then the \"name_out\", \"header\" and \"data\" arguments are populated with pointers to buffers containing the relevant decoded data. The caller is responsible for freeing those buffers. It is possible to construct a PEM file that results in 0 bytes of payload data. In this case PEM_read_bio_ex() will return a failure code but",
"severity": "medium",
"reporters": [
"CarpetFuzz",
"Dawei Wang",
"Marc Schönefeld"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20230207.txt",
"source_path": "secjson/CVE-2022-4450.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2022-4450.json"
},
{
"id": "CVE-2023-0215",
"published": "2023-02-07",
"quarter": "2023-Q1",
"title": "Use-after-free following BIO_new_NDEF",
"description": "The public API function BIO_new_NDEF is a helper function used for streaming ASN.1 data via a BIO. It is primarily used internally to OpenSSL to support the SMIME, CMS and PKCS7 streaming capabilities, but may also be called directly by end user applications. The function receives a BIO from the caller, prepends a new BIO_f_asn1 filter BIO onto the front of it to form a BIO chain, and then returns the new head of the BIO chain to the caller. Under certain conditions, for example if a CMS recipie",
"severity": "medium",
"reporters": [
"Octavio Galland (Max Planck Institute for Security and Privacy)",
"Marcel Böhme (Max Planck Institute for Security and Privacy)"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20230207.txt",
"source_path": "secjson/CVE-2023-0215.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2023-0215.json"
},
{
"id": "CVE-2023-0216",
"published": "2023-02-07",
"quarter": "2023-Q1",
"title": "Invalid pointer dereference in d2i_PKCS7 functions",
"description": "An invalid pointer dereference on read can be triggered when an application tries to load malformed PKCS7 data with the d2i_PKCS7(), d2i_PKCS7_bio() or d2i_PKCS7_fp() functions. The result of the dereference is an application crash which could lead to a denial of service attack. The TLS implementation in OpenSSL does not call this function however third party applications might call these functions on untrusted data.",
"severity": "medium",
"reporters": [
"Marc Schönefeld"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20230207.txt",
"source_path": "secjson/CVE-2023-0216.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2023-0216.json"
},
{
"id": "CVE-2023-0217",
"published": "2023-02-07",
"quarter": "2023-Q1",
"title": "NULL dereference validating DSA public key",
"description": "An invalid pointer dereference on read can be triggered when an application tries to check a malformed DSA public key by the EVP_PKEY_public_check() function. This will most likely lead to an application crash. This function can be called on public keys supplied from untrusted sources which could allow an attacker to cause a denial of service attack. The TLS implementation in OpenSSL does not call this function but applications might call the function if there are additional security requirement",
"severity": "medium",
"reporters": [
"Kurt Roeckx"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20230207.txt",
"source_path": "secjson/CVE-2023-0217.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2023-0217.json"
},
{
"id": "CVE-2023-0286",
"published": "2023-02-07",
"quarter": "2023-Q1",
"title": "X.400 address type confusion in X.509 GeneralName",
"description": "There is a type confusion vulnerability relating to X.400 address processing inside an X.509 GeneralName. X.400 addresses were parsed as an ASN1_STRING but the public structure definition for GENERAL_NAME incorrectly specified the type of the x400Address field as ASN1_TYPE. This field is subsequently interpreted by the OpenSSL function GENERAL_NAME_cmp as an ASN1_TYPE rather than an ASN1_STRING. When CRL checking is enabled (i.e. the application sets the X509_V_FLAG_CRL_CHECK flag), this vulnera",
"severity": "high",
"reporters": [
"David Benjamin (Google)"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20230207.txt",
"source_path": "secjson/CVE-2023-0286.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2023-0286.json"
},
{
"id": "CVE-2023-0401",
"published": "2023-02-07",
"quarter": "2023-Q1",
"title": "NULL dereference during PKCS7 data verification",
"description": "A NULL pointer can be dereferenced when signatures are being verified on PKCS7 signed or signedAndEnveloped data. In case the hash algorithm used for the signature is known to the OpenSSL library but the implementation of the hash algorithm is not available the digest initialization will fail. There is a missing check for the return value from the initialization function which later leads to invalid usage of the digest API most likely leading to a crash. The unavailability of an algorithm can be",
"severity": "medium",
"reporters": [
"Hubert Kario (Red Hat)",
"Dmitry Belyavsky (Red Hat)"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20230207.txt",
"source_path": "secjson/CVE-2023-0401.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2023-0401.json"
},
{
"id": "CVE-2023-0464",
"published": "2023-03-21",
"quarter": "2023-Q1",
"title": "Excessive Resource Usage Verifying X.509 Policy Constraints",
"description": "A security vulnerability has been identified in all supported versions of OpenSSL related to the verification of X.509 certificate chains that include policy constraints. Attackers may be able to exploit this vulnerability by creating a malicious certificate chain that triggers exponential use of computational resources, leading to a denial-of-service (DoS) attack on affected systems. Policy processing is disabled by default but can be enabled by passing the `-policy` argument to the command lin",
"severity": "low",
"reporters": [
"David Benjamin (Google)"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20230322.txt",
"source_path": "secjson/CVE-2023-0464.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2023-0464.json"
},
{
"id": "CVE-2023-0466",
"published": "2023-03-21",
"quarter": "2023-Q1",
"title": "Certificate policy check not enabled",
"description": "The function X509_VERIFY_PARAM_add0_policy() is documented to implicitly enable the certificate policy check when doing certificate verification. However the implementation of the function does not enable the check which allows certificates with invalid or incorrect policies to pass the certificate verification. As suddenly enabling the policy check could break existing deployments it was decided to keep the existing behavior of the X509_VERIFY_PARAM_add0_policy() function. Instead the applicati",
"severity": "low",
"reporters": [
"David Benjamin (Google)"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20230328.txt",
"source_path": "secjson/CVE-2023-0466.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2023-0466.json"
},
{
"id": "CVE-2023-1255",
"published": "2023-03-21",
"quarter": "2023-Q1",
"title": "Input buffer over-read in AES-XTS implementation on 64 bit ARM",
"description": "Issue summary: The AES-XTS cipher decryption implementation for 64 bit ARM platform contains a bug that could cause it to read past the input buffer, leading to a crash. Impact summary: Applications that use the AES-XTS algorithm on the 64 bit ARM platform can crash in rare circumstances. The AES-XTS algorithm is usually used for disk encryption. The AES-XTS cipher decryption implementation for 64 bit ARM platform will read past the end of the ciphertext buffer if the ciphertext size is 4 mod 5 ",
"severity": "low",
"reporters": [
"Anton Romanov (Amazon)"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20230419.txt",
"source_path": "secjson/CVE-2023-1255.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2023-1255.json"
},
{
"id": "CVE-2023-0465",
"published": "2023-03-23",
"quarter": "2023-Q1",
"title": "Invalid certificate policies in leaf certificates are silently ignored",
"description": "Applications that use a non-default option when verifying certificates may be vulnerable to an attack from a malicious CA to circumvent certain checks. Invalid certificate policies in leaf certificates are silently ignored by OpenSSL and other certificate policy checks are skipped for that certificate. A malicious CA could use this to deliberately assert invalid certificate policies in order to circumvent policy checking on the certificate altogether. Policy processing is disabled by default but",
"severity": "low",
"reporters": [
"David Benjamin (Google)"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20230328.txt",
"source_path": "secjson/CVE-2023-0465.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2023-0465.json"
},
{
"id": "CVE-2023-2650",
"published": "2023-05-30",
"quarter": "2023-Q2",
"title": "Possible DoS translating ASN.1 object identifiers",
"description": "Issue summary: Processing some specially crafted ASN.1 object identifiers or data containing them may be very slow. Impact summary: Applications that use OBJ_obj2txt() directly, or use any of the OpenSSL subsystems OCSP, PKCS7/SMIME, CMS, CMP/CRMF or TS with no message size limit may experience notable to very long delays when processing those messages, which may lead to a Denial of Service. An OBJECT IDENTIFIER is composed of a series of numbers - sub-identifiers - most of which have no size li",
"severity": "medium",
"reporters": [
"OSSFuzz",
"Matt Caswell"
],
"attribution_band": "fuzzing_marker",
"attribution_markers": [
"OSS-Fuzz"
],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20230530.txt",
"source_path": "secjson/CVE-2023-2650.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2023-2650.json"
},
{
"id": "CVE-2023-2975",
"published": "2023-07-07",
"quarter": "2023-Q3",
"title": "AES-SIV implementation ignores empty associated data entries",
"description": "Issue summary: The AES-SIV cipher implementation contains a bug that causes it to ignore empty associated data entries which are unauthenticated as a consequence. Impact summary: Applications that use the AES-SIV algorithm and want to authenticate empty data entries as associated data can be misled by removing, adding or reordering such empty entries as these are ignored by the OpenSSL implementation. We are currently unaware of any such applications. The AES-SIV algorithm allows for authenticat",
"severity": "low",
"reporters": [
"Juerg Wullschleger (Google)"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20230714.txt",
"source_path": "secjson/CVE-2023-2975.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2023-2975.json"
},
{
"id": "CVE-2023-3446",
"published": "2023-07-13",
"quarter": "2023-Q3",
"title": "Excessive time spent checking DH keys and parameters",
"description": "Issue summary: Checking excessively long DH keys or parameters may be very slow. Impact summary: Applications that use the functions DH_check(), DH_check_ex() or EVP_PKEY_param_check() to check a DH key or DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. The function DH_check() performs various checks on DH parameters. One of those checks confirms that the modulus ('p' pa",
"severity": "low",
"reporters": [
"OSSfuzz"
],
"attribution_band": "fuzzing_marker",
"attribution_markers": [
"OSS-Fuzz"
],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20230719.txt",
"source_path": "secjson/CVE-2023-3446.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2023-3446.json"
},
{
"id": "CVE-2023-3817",
"published": "2023-07-31",
"quarter": "2023-Q3",
"title": "Excessive time spent checking DH q parameter value",
"description": "Issue summary: Checking excessively long DH keys or parameters may be very slow. Impact summary: Applications that use the functions DH_check(), DH_check_ex() or EVP_PKEY_param_check() to check a DH key or DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. The function DH_check() performs various checks on DH parameters. After fixing CVE-2023-3446 it was discovered that a l",
"severity": "low",
"reporters": [
"Bernd Edlinger"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20230731.txt",
"source_path": "secjson/CVE-2023-3817.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2023-3817.json"
},
{
"id": "CVE-2023-4807",
"published": "2023-09-08",
"quarter": "2023-Q3",
"title": "POLY1305 MAC implementation corrupts XMM registers on Windows",
"description": "Issue summary: The POLY1305 MAC (message authentication code) implementation contains a bug that might corrupt the internal state of applications on the Windows 64 platform when running on newer X86_64 processors supporting the AVX512-IFMA instructions. Impact summary: If in an application that uses the OpenSSL library an attacker can influence whether the POLY1305 MAC algorithm is used, the application state might be corrupted with various application dependent consequences. The POLY1305 MAC (m",
"severity": "low",
"reporters": [
"Zach Wilson"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20230908.txt",
"source_path": "secjson/CVE-2023-4807.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2023-4807.json"
},
{
"id": "CVE-2023-5363",
"published": "2023-10-24",
"quarter": "2023-Q4",
"title": "Incorrect cipher key & IV length processing",
"description": "Issue summary: A bug has been identified in the processing of key and initialisation vector (IV) lengths. This can lead to potential truncation or overruns during the initialisation of some symmetric ciphers. Impact summary: A truncation in the IV can result in non-uniqueness, which could result in loss of confidentiality for some cipher modes. When calling EVP_EncryptInit_ex2(), EVP_DecryptInit_ex2() or EVP_CipherInit_ex2() the provided OSSL_PARAM array is processed after the key and IV have be",
"severity": "medium",
"reporters": [
"Tony Battersby (Cybernetics)"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20231024.txt",
"source_path": "secjson/CVE-2023-5363.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2023-5363.json"
},
{
"id": "CVE-2023-5678",
"published": "2023-11-06",
"quarter": "2023-Q4",
"title": "Excessive time spent in DH check / generation with large Q parameter value",
"description": "Issue summary: Generating excessively long X9.42 DH keys or checking excessively long X9.42 DH keys or parameters may be very slow. Impact summary: Applications that use the functions DH_generate_key() to generate an X9.42 DH key may experience long delays. Likewise, applications that use DH_check_pub_key(), DH_check_pub_key_ex() or EVP_PKEY_public_check() to check an X9.42 DH key or X9.42 DH parameters may experience long delays. Where the key or parameters that are being checked have been obta",
"severity": "low",
"reporters": [
"David Benjamin (Google)"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20231106.txt",
"source_path": "secjson/CVE-2023-5678.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2023-5678.json"
},
{
"id": "CVE-2023-6129",
"published": "2024-01-09",
"quarter": "2024-Q1",
"title": "POLY1305 MAC implementation corrupts vector registers on PowerPC",
"description": "Issue summary: The POLY1305 MAC (message authentication code) implementation contains a bug that might corrupt the internal state of applications running on PowerPC CPU based platforms if the CPU provides vector instructions. Impact summary: If an attacker can influence whether the POLY1305 MAC algorithm is used, the application state might be corrupted with various application dependent consequences. The POLY1305 MAC (message authentication code) implementation in OpenSSL for PowerPC CPUs resto",
"severity": "low",
"reporters": [
"Sverker Eriksson"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20240109.txt",
"source_path": "secjson/CVE-2023-6129.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2023-6129.json"
},
{
"id": "CVE-2023-6237",
"published": "2024-01-15",
"quarter": "2024-Q1",
"title": "Excessive time spent checking invalid RSA public keys",
"description": "Issue summary: Checking excessively long invalid RSA public keys may take a long time. Impact summary: Applications that use the function EVP_PKEY_public_check() to check RSA public keys may experience long delays. Where the key that is being checked has been obtained from an untrusted source this may lead to a Denial of Service. When function EVP_PKEY_public_check() is called on RSA public keys, a computation is done to confirm that the RSA modulus, n, is composite. For valid RSA keys, n is a p",
"severity": "low",
"reporters": [
"OSS-Fuzz"
],
"attribution_band": "fuzzing_marker",
"attribution_markers": [
"OSS-Fuzz",
"fuzzing"
],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20240115.txt",
"source_path": "secjson/CVE-2023-6237.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2023-6237.json"
},
{
"id": "CVE-2024-0727",
"published": "2024-01-25",
"quarter": "2024-Q1",
"title": "PKCS12 Decoding crashes",
"description": "Issue summary: Processing a maliciously formatted PKCS12 file may lead OpenSSL to crash leading to a potential Denial of Service attack Impact summary: Applications loading files in the PKCS12 format from untrusted sources might terminate abruptly. A file in PKCS12 format can contain certificates and keys and may come from an untrusted source. The PKCS12 specification allows certain fields to be NULL, but OpenSSL does not correctly check for this case. This can lead to a NULL pointer dereference",
"severity": "low",
"reporters": [
"Bahaa Naamneh (Crosspoint Labs)"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20240125.txt",
"source_path": "secjson/CVE-2024-0727.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2024-0727.json"
},
{
"id": "CVE-2024-2511",
"published": "2024-04-08",
"quarter": "2024-Q2",
"title": "Unbounded memory growth with session handling in TLSv1.3",
"description": "Issue summary: Some non-default TLS server configurations can cause unbounded memory growth when processing TLSv1.3 sessions Impact summary: An attacker may exploit certain server configurations to trigger unbounded memory growth that would lead to a Denial of Service This problem can occur in TLSv1.3 if the non-default SSL_OP_NO_TICKET option is being used (but not if early_data support is also configured and the default anti-replay protection is in use). In this case, under certain conditions,",
"severity": "low",
"reporters": [
"Manish Patidar (Hewlett Packard Enterprise)"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20240408.txt",
"source_path": "secjson/CVE-2024-2511.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2024-2511.json"
},
{
"id": "CVE-2024-4603",
"published": "2024-05-16",
"quarter": "2024-Q2",
"title": "Excessive time spent checking DSA keys and parameters",
"description": "Issue summary: Checking excessively long DSA keys or parameters may be very slow. Impact summary: Applications that use the functions EVP_PKEY_param_check() or EVP_PKEY_public_check() to check a DSA public key or DSA parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. The functions EVP_PKEY_param_check() or EVP_PKEY_public_check() perform various checks on DSA parameters. Some ",
"severity": "low",
"reporters": [
"OSS-Fuzz"
],
"attribution_band": "fuzzing_marker",
"attribution_markers": [
"OSS-Fuzz",
"fuzzing"
],
"cwe_ids": [],
"advisory_url": "https://www.openssl.org/news/secadv/20240516.txt",
"source_path": "secjson/CVE-2024-4603.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2024-4603.json"
},
{
"id": "CVE-2024-4741",
"published": "2024-05-27",
"quarter": "2024-Q2",
"title": "Use After Free with SSL_free_buffers",
"description": "Issue summary: Calling the OpenSSL API function SSL_free_buffers may cause memory to be accessed that was previously freed in some situations Impact summary: A use after free can have a range of potential consequences such as the corruption of valid data, crashes or execution of arbitrary code. However, only applications that directly call the SSL_free_buffers function are affected by this issue. Applications that do not call this function are not vulnerable. Our investigations indicate that thi",
"severity": "low",
"reporters": [
"William Ahern (Akamai)"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [
"CWE-416"
],
"advisory_url": "https://www.openssl.org/news/secadv/20240528.txt",
"source_path": "secjson/CVE-2024-4741.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2024-4741.json"
},
{
"id": "CVE-2024-5535",
"published": "2024-06-26",
"quarter": "2024-Q2",
"title": "SSL_select_next_proto buffer overread",
"description": "Issue summary: Calling the OpenSSL API function SSL_select_next_proto with an empty supported client protocols buffer may cause a crash or memory contents to be sent to the peer. Impact summary: A buffer overread can have a range of potential consequences such as unexpected application beahviour or a crash. In particular this issue could result in up to 255 bytes of arbitrary private data from memory being sent to the peer leading to a loss of confidentiality. However, only applications that dir",
"severity": "low",
"reporters": [
"Joseph Birr-Pixton"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [
"CWE-125"
],
"advisory_url": "https://www.openssl.org/news/secadv/20240627.txt",
"source_path": "secjson/CVE-2024-5535.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2024-5535.json"
},
{
"id": "CVE-2024-6119",
"published": "2024-09-03",
"quarter": "2024-Q3",
"title": "Possible denial of service in X.509 name checks",
"description": "Issue summary: Applications performing certificate name checks (e.g., TLS clients checking server certificates) may attempt to read an invalid memory address resulting in abnormal termination of the application process. Impact summary: Abnormal termination of an application can a cause a denial of service. Applications performing certificate name checks (e.g., TLS clients checking server certificates) may attempt to read an invalid memory address when comparing the expected name with an `otherNa",
"severity": "medium",
"reporters": [
"David Benjamin (Google)"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [
"CWE-843"
],
"advisory_url": "https://openssl-library.org/news/secadv/20240903.txt",
"source_path": "secjson/CVE-2024-6119.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2024-6119.json"
},
{
"id": "CVE-2024-9143",
"published": "2024-10-16",
"quarter": "2024-Q4",
"title": "Low-level invalid GF(2^m) parameters lead to OOB memory access",
"description": "Issue summary: Use of the low-level GF(2^m) elliptic curve APIs with untrusted explicit values for the field polynomial can lead to out-of-bounds memory reads or writes. Impact summary: Out of bound memory writes can lead to an application crash or even a possibility of a remote code execution, however, in all the protocols involving Elliptic Curve Cryptography that we're aware of, either only \"named curves\" are supported, or, if explicit curve parameters are supported, they specify an X9.62 enc",
"severity": "low",
"reporters": [
"Google OSS-Fuzz-Gen"
],
"attribution_band": "fuzzing_marker",
"attribution_markers": [
"OSS-Fuzz",
"fuzzing"
],
"cwe_ids": [
"CWE-125",
"CWE-787"
],
"advisory_url": "https://openssl-library.org/news/secadv/20241016.txt",
"source_path": "secjson/CVE-2024-9143.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2024-9143.json"
},
{
"id": "CVE-2024-13176",
"published": "2025-01-20",
"quarter": "2025-Q1",
"title": "Timing side-channel in ECDSA signature computation",
"description": "Issue summary: A timing side-channel which could potentially allow recovering the private key exists in the ECDSA signature computation. Impact summary: A timing side-channel in ECDSA signature computations could allow recovering the private key by an attacker. However, measuring the timing would require either local access to the signing application or a very fast network connection with low latency. There is a timing signal of around 300 nanoseconds when the top word of the inverted ECDSA nonc",
"severity": "low",
"reporters": [
"George Pantelakis (Red Hat)",
"Alicja Kario (Red Hat)"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [
"CWE-385"
],
"advisory_url": "https://openssl-library.org/news/secadv/20250120.txt",
"source_path": "secjson/CVE-2024-13176.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2024-13176.json"
},
{
"id": "CVE-2024-12797",
"published": "2025-02-11",
"quarter": "2025-Q1",
"title": "RFC7250 handshakes with unauthenticated servers don't abort as expected",
"description": "Issue summary: Clients using RFC7250 Raw Public Keys (RPKs) to authenticate a server may fail to notice that the server was not authenticated, because handshakes don't abort as expected when the SSL_VERIFY_PEER verification mode is set. Impact summary: TLS and DTLS connections using raw public keys may be vulnerable to man-in-middle attacks when server authentication failure is not detected by clients. RPKs are disabled by default in both TLS clients and TLS servers. The issue only arises when T",
"severity": "high",
"reporters": [
"Apple Inc."
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [
"CWE-392"
],
"advisory_url": "https://openssl-library.org/news/secadv/20250211.txt",
"source_path": "secjson/CVE-2024-12797.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2024-12797.json"
},
{
"id": "CVE-2025-4575",
"published": "2025-05-22",
"quarter": "2025-Q2",
"title": "The x509 application adds trusted use instead of rejected use",
"description": "Issue summary: Use of -addreject option with the openssl x509 application adds a trusted use instead of a rejected use for a certificate. Impact summary: If a user intends to make a trusted certificate rejected for a particular use it will be instead marked as trusted for that use. A copy & paste error during minor refactoring of the code introduced this issue in the OpenSSL 3.5 version. If, for example, a trusted CA certificate should be trusted only for the purpose of authenticating TLS server",
"severity": "low",
"reporters": [
"Alexandr Sosedkin (Red Hat)"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [
"CWE-295"
],
"advisory_url": "https://openssl-library.org/news/secadv/20250522.txt",
"source_path": "secjson/CVE-2025-4575.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2025-4575.json"
},
{
"id": "CVE-2025-9230",
"published": "2025-09-30",
"quarter": "2025-Q3",
"title": "Out-of-bounds read & write in RFC 3211 KEK Unwrap",
"description": "Issue summary: An application trying to decrypt CMS messages encrypted using password based encryption can trigger an out-of-bounds read and write. Impact summary: This out-of-bounds read may trigger a crash which leads to Denial of Service for an application. The out-of-bounds write can cause a memory corruption which can have various consequences including a Denial of Service or Execution of attacker-supplied code. Although the consequences of a successful exploit of this vulnerability could b",
"severity": "medium",
"reporters": [
"Stanislav Fort (Aisle Research)"
],
"attribution_band": "ai_affiliation_only",
"attribution_markers": [
"Aisle Research"
],
"cwe_ids": [
"CWE-125",
"CWE-787"
],
"advisory_url": "https://openssl-library.org/news/secadv/20250930.txt",
"source_path": "secjson/CVE-2025-9230.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2025-9230.json"
},
{
"id": "CVE-2025-9231",
"published": "2025-09-30",
"quarter": "2025-Q3",
"title": "Timing side-channel in SM2 algorithm on 64 bit ARM",
"description": "Issue summary: A timing side-channel which could potentially allow remote recovery of the private key exists in the SM2 algorithm implementation on 64 bit ARM platforms. Impact summary: A timing side-channel in SM2 signature computations on 64 bit ARM platforms could allow recovering the private key by an attacker.. While remote key recovery over a network was not attempted by the reporter, timing measurements revealed a timing signal which may allow such an attack. OpenSSL does not directly sup",
"severity": "medium",
"reporters": [
"Stanislav Fort (Aisle Research)"
],
"attribution_band": "ai_affiliation_only",
"attribution_markers": [
"Aisle Research"
],
"cwe_ids": [
"CWE-385"
],
"advisory_url": "https://openssl-library.org/news/secadv/20250930.txt",
"source_path": "secjson/CVE-2025-9231.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2025-9231.json"
},
{
"id": "CVE-2025-9232",
"published": "2025-09-30",
"quarter": "2025-Q3",
"title": "Out-of-bounds read in HTTP client no_proxy handling",
"description": "Issue summary: An application using the OpenSSL HTTP client API functions may trigger an out-of-bounds read if the 'no_proxy' environment variable is set and the host portion of the authority component of the HTTP URL is an IPv6 address. Impact summary: An out-of-bounds read can trigger a crash which leads to Denial of Service for an application. The OpenSSL HTTP client API functions can be used directly by applications but they are also used by the OCSP client functions and CMP (Certificate Man",
"severity": "low",
"reporters": [
"Stanislav Fort (Aisle Research)"
],
"attribution_band": "ai_affiliation_only",
"attribution_markers": [
"Aisle Research"
],
"cwe_ids": [
"CWE-125"
],
"advisory_url": "https://openssl-library.org/news/secadv/20250930.txt",
"source_path": "secjson/CVE-2025-9232.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2025-9232.json"
},
{
"id": "CVE-2025-11187",
"published": "2026-01-27",
"quarter": "2026-Q1",
"title": "Improper validation of PBMAC1 parameters in PKCS#12 MAC verification",
"description": "Issue summary: PBMAC1 parameters in PKCS#12 files are missing validation which can trigger a stack-based buffer overflow, invalid pointer or NULL pointer dereference during MAC verification. Impact summary: The stack buffer overflow or NULL pointer dereference may cause a crash leading to Denial of Service for an application that parses untrusted PKCS#12 files. The buffer overflow may also potentially enable code execution depending on platform mitigations. When verifying a PKCS#12 file that use",
"severity": "medium",
"reporters": [
"Stanislav Fort (Aisle Research)",
"Petr Šimeček (Aisle Research)",
"Hamza (Metadust)"
],
"attribution_band": "ai_affiliation_only",
"attribution_markers": [
"Aisle Research"
],
"cwe_ids": [
"CWE-787",
"CWE-476"
],
"advisory_url": "https://openssl-library.org/news/secadv/20260127.txt",
"source_path": "secjson/CVE-2025-11187.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2025-11187.json"
},
{
"id": "CVE-2025-15467",
"published": "2026-01-27",
"quarter": "2026-Q1",
"title": "Stack buffer overflow in CMS (Auth)EnvelopedData parsing",
"description": "Issue summary: Parsing CMS AuthEnvelopedData or EnvelopedData message with maliciously crafted AEAD parameters can trigger a stack buffer overflow. Impact summary: A stack buffer overflow may lead to a crash, causing Denial of Service, or potentially remote code execution. When parsing CMS (Auth)EnvelopedData structures that use AEAD ciphers such as AES-GCM, the IV (Initialization Vector) encoded in the ASN.1 parameters is copied into a fixed-size stack buffer without verifying that its length f",
"severity": "high",
"reporters": [
"Stanislav Fort (Aisle Research)"
],
"attribution_band": "ai_affiliation_only",
"attribution_markers": [
"Aisle Research"
],
"cwe_ids": [
"CWE-787"
],
"advisory_url": "https://openssl-library.org/news/secadv/20260127.txt",
"source_path": "secjson/CVE-2025-15467.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2025-15467.json"
},
{
"id": "CVE-2025-15468",
"published": "2026-01-27",
"quarter": "2026-Q1",
"title": "NULL dereference in SSL_CIPHER_find() function on unknown cipher ID",
"description": "Issue summary: If an application using the SSL_CIPHER_find() function in a QUIC protocol client or server receives an unknown cipher suite from the peer, a NULL dereference occurs. Impact summary: A NULL pointer dereference leads to abnormal termination of the running process causing Denial of Service. Some applications call SSL_CIPHER_find() from the client_hello_cb callback on the cipher ID received from the peer. If this is done with an SSL object implementing the QUIC protocol, NULL pointer ",
"severity": "low",
"reporters": [
"Stanislav Fort (Aisle Research)"
],
"attribution_band": "ai_affiliation_only",
"attribution_markers": [
"Aisle Research"
],
"cwe_ids": [
"CWE-476"
],
"advisory_url": "https://openssl-library.org/news/secadv/20260127.txt",
"source_path": "secjson/CVE-2025-15468.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2025-15468.json"
},
{
"id": "CVE-2025-15469",
"published": "2026-01-27",
"quarter": "2026-Q1",
"title": "'openssl dgst' one-shot codepath silently truncates inputs >16MB",
"description": "Issue summary: The 'openssl dgst' command-line tool silently truncates input data to 16MB when using one-shot signing algorithms and reports success instead of an error. Impact summary: A user signing or verifying files larger than 16MB with one-shot algorithms (such as Ed25519, Ed448, or ML-DSA) may believe the entire file is authenticated while trailing data beyond 16MB remains unauthenticated. When the 'openssl dgst' command is used with algorithms that only support one-shot signing (Ed25519,",
"severity": "low",
"reporters": [
"Stanislav Fort (Aisle Research)"
],
"attribution_band": "ai_affiliation_only",
"attribution_markers": [
"Aisle Research"
],
"cwe_ids": [
"CWE-347"
],
"advisory_url": "https://openssl-library.org/news/secadv/20260127.txt",
"source_path": "secjson/CVE-2025-15469.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2025-15469.json"
},
{
"id": "CVE-2025-66199",
"published": "2026-01-27",
"quarter": "2026-Q1",
"title": "TLS 1.3 CompressedCertificate excessive memory allocation",
"description": "Issue summary: A TLS 1.3 connection using certificate compression can be forced to allocate a large buffer before decompression without checking against the configured certificate size limit. Impact summary: An attacker can cause per-connection memory allocations of up to approximately 22 MiB and extra CPU work, potentially leading to service degradation or resource exhaustion (Denial of Service). In affected configurations, the peer-supplied uncompressed certificate length from a CompressedCert",
"severity": "low",
"reporters": [
"Tomas Dulka (Aisle Research)",
"Stanislav Fort (Aisle Research)"
],
"attribution_band": "ai_affiliation_only",
"attribution_markers": [
"Aisle Research"
],
"cwe_ids": [
"CWE-789"
],
"advisory_url": "https://openssl-library.org/news/secadv/20260127.txt",
"source_path": "secjson/CVE-2025-66199.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2025-66199.json"
},
{
"id": "CVE-2025-68160",
"published": "2026-01-27",
"quarter": "2026-Q1",
"title": "Heap out-of-bounds write in BIO_f_linebuffer on short writes",
"description": "Issue summary: Writing large, newline-free data into a BIO chain using the line-buffering filter where the next BIO performs short writes can trigger a heap-based out-of-bounds write. Impact summary: This out-of-bounds write can cause memory corruption which typically results in a crash, leading to Denial of Service for an application. The line-buffering BIO filter (BIO_f_linebuffer) is not used by default in TLS/SSL data paths. In OpenSSL command-line applications, it is typically only pushed o",
"severity": "low",
"reporters": [
"Petr Šimeček (Aisle Research)",
"Stanislav Fort (Aisle Research)"
],
"attribution_band": "ai_affiliation_only",
"attribution_markers": [
"Aisle Research"
],
"cwe_ids": [
"CWE-787"
],
"advisory_url": "https://openssl-library.org/news/secadv/20260127.txt",
"source_path": "secjson/CVE-2025-68160.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2025-68160.json"
},
{
"id": "CVE-2025-69418",
"published": "2026-01-27",
"quarter": "2026-Q1",
"title": "Unauthenticated/unencrypted trailing bytes with low-level OCB function calls",
"description": "Issue summary: When using the low-level OCB API directly with AES-NI or
other hardware-accelerated code paths, inputs whose length is not a multiple
of 16 bytes can leave the final partial block unencrypted and unauthenticated.
Impact summary: The trailing 1-15 bytes of a message may be exposed in
cleartext on encryption and are not covered by the authentication tag,
allowing an attacker to read or tamper with those bytes without detection.
The low-level OCB encrypt and",
"severity": "low",
"reporters": [
"Stanislav Fort (Aisle Research)"
],
"attribution_band": "ai_affiliation_only",
"attribution_markers": [
"Aisle Research"
],
"cwe_ids": [
"CWE-325"
],
"advisory_url": "https://openssl-library.org/news/secadv/20260127.txt",
"source_path": "secjson/CVE-2025-69418.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2025-69418.json"
},
{
"id": "CVE-2025-69419",
"published": "2026-01-27",
"quarter": "2026-Q1",
"title": "Out of bounds write in PKCS12_get_friendlyname() UTF-8 conversion",
"description": "Issue summary: Calling PKCS12_get_friendlyname() function on a maliciously crafted PKCS#12 file with a BMPString (UTF-16BE) friendly name containing non-ASCII BMP code point can trigger a one byte write before the allocated buffer. Impact summary: The out-of-bounds write can cause a memory corruption which can have various consequences including a Denial of Service. The OPENSSL_uni2utf8() function performs a two-pass conversion of a PKCS#12 BMPString (UTF-16BE) to UTF-8. In the second pass, when",
"severity": "low",
"reporters": [
"Stanislav Fort (Aisle Research)"
],
"attribution_band": "ai_affiliation_only",
"attribution_markers": [
"Aisle Research"
],
"cwe_ids": [
"CWE-787"
],
"advisory_url": "https://openssl-library.org/news/secadv/20260127.txt",
"source_path": "secjson/CVE-2025-69419.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2025-69419.json"
},
{
"id": "CVE-2025-69420",
"published": "2026-01-27",
"quarter": "2026-Q1",
"title": "Missing ASN1_TYPE validation in TS_RESP_verify_response() function",
"description": "Issue summary: A type confusion vulnerability exists in the TimeStamp Response verification code where an ASN1_TYPE union member is accessed without first validating the type, causing an invalid or NULL pointer dereference when processing a malformed TimeStamp Response file. Impact summary: An application calling TS_RESP_verify_response() with a malformed TimeStamp Response can be caused to dereference an invalid or NULL pointer when reading, resulting in a Denial of Service. The functions ossl_",
"severity": "low",
"reporters": [
"Luigino Camastra (Aisle Research)"
],
"attribution_band": "ai_affiliation_only",
"attribution_markers": [
"Aisle Research"
],
"cwe_ids": [
"CWE-754"
],
"advisory_url": "https://openssl-library.org/news/secadv/20260127.txt",
"source_path": "secjson/CVE-2025-69420.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2025-69420.json"
},
{
"id": "CVE-2025-69421",
"published": "2026-01-27",
"quarter": "2026-Q1",
"title": "NULL Pointer Dereference in PKCS12_item_decrypt_d2i_ex function",
"description": "Issue summary: Processing a malformed PKCS#12 file can trigger a NULL pointer dereference in the PKCS12_item_decrypt_d2i_ex() function. Impact summary: A NULL pointer dereference can trigger a crash which leads to Denial of Service for an application processing PKCS#12 files. The PKCS12_item_decrypt_d2i_ex() function does not check whether the oct parameter is NULL before dereferencing it. When called from PKCS12_unpack_p7encdata() with a malformed PKCS#12 file, this parameter can be NULL, causi",
"severity": "low",
"reporters": [
"Luigino Camastra (Aisle Research)"
],
"attribution_band": "ai_affiliation_only",
"attribution_markers": [
"Aisle Research"
],
"cwe_ids": [
"CWE-476"
],
"advisory_url": "https://openssl-library.org/news/secadv/20260127.txt",
"source_path": "secjson/CVE-2025-69421.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2025-69421.json"
},
{
"id": "CVE-2026-22795",
"published": "2026-01-27",
"quarter": "2026-Q1",
"title": "Missing ASN1_TYPE validation in PKCS#12 parsing",
"description": "Issue summary: An invalid or NULL pointer dereference can happen in an application processing a malformed PKCS#12 file. Impact summary: An application processing a malformed PKCS#12 file can be caused to dereference an invalid or NULL pointer on memory read, resulting in a Denial of Service. A type confusion vulnerability exists in PKCS#12 parsing code where an ASN1_TYPE union member is accessed without first validating the type, causing an invalid pointer read. The location is constrained to a ",
"severity": "low",
"reporters": [
"Luigino Camastra (Aisle Research)"
],
"attribution_band": "ai_affiliation_only",
"attribution_markers": [
"Aisle Research"
],
"cwe_ids": [
"CWE-754"
],
"advisory_url": "https://openssl-library.org/news/secadv/20260127.txt",
"source_path": "secjson/CVE-2026-22795.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2026-22795.json"
},
{
"id": "CVE-2026-22796",
"published": "2026-01-27",
"quarter": "2026-Q1",
"title": "ASN1_TYPE Type Confusion in the PKCS7_digest_from_attributes() function",
"description": "Issue summary: A type confusion vulnerability exists in the signature verification of signed PKCS#7 data where an ASN1_TYPE union member is accessed without first validating the type, causing an invalid or NULL pointer dereference when processing malformed PKCS#7 data. Impact summary: An application performing signature verification of PKCS#7 data or calling directly the PKCS7_digest_from_attributes() function can be caused to dereference an invalid or NULL pointer when reading, resulting in a D",
"severity": "low",
"reporters": [
"Luigino Camastra (Aisle Research)"
],
"attribution_band": "ai_affiliation_only",
"attribution_markers": [
"Aisle Research"
],
"cwe_ids": [
"CWE-754"
],
"advisory_url": "https://openssl-library.org/news/secadv/20260127.txt",
"source_path": "secjson/CVE-2026-22796.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2026-22796.json"
},
{
"id": "CVE-2026-2673",
"published": "2026-03-13",
"quarter": "2026-Q1",
"title": "OpenSSL TLS 1.3 server may choose unexpected key agreement group",
"description": "Issue summary: An OpenSSL TLS 1.3 server may fail to negotiate the expected preferred key exchange group when its key exchange group configuration includes the default by using the 'DEFAULT' keyword. Impact summary: A less preferred key exchange may be used even when a more preferred group is supported by both client and server, if the group was not included among the client's initial predicated keyshares. This will sometimes be the case with the new hybrid post-quantum groups, if the client cho",
"severity": "low",
"reporters": [
"Viktor Dukhovni"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [
"CWE-757"
],
"advisory_url": "https://openssl-library.org/news/secadv/20260313.txt",
"source_path": "secjson/CVE-2026-2673.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2026-2673.json"
},
{
"id": "CVE-2026-28386",
"published": "2026-04-07",
"quarter": "2026-Q2",
"title": "Out-of-bounds Read in AES-CFB-128 on X86-64 with AVX-512 Support",
"description": "Issue summary: Applications using AES-CFB128 encryption or decryption on systems with AVX-512 and VAES support can trigger an out-of-bounds read of up to 15 bytes when processing partial cipher blocks. Impact summary: This out-of-bounds read may trigger a crash which leads to Denial of Service for an application if the input buffer ends at a memory page boundary and the following page is unmapped. There is no information disclosure as the over-read bytes are not written to output. The vulnerable",
"severity": "low",
"reporters": [
"Stanislav Fort (Aisle Research)",
"Pavel Kohout (Aisle Research)",
"Alex Gaynor (Anthropic)"
],
"attribution_band": "ai_affiliation_only",
"attribution_markers": [
"Aisle Research",
"Anthropic"
],
"cwe_ids": [
"CWE-125"
],
"advisory_url": "https://openssl-library.org/news/secadv/20260407.txt",
"source_path": "secjson/CVE-2026-28386.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2026-28386.json"
},
{
"id": "CVE-2026-28387",
"published": "2026-04-07",
"quarter": "2026-Q2",
"title": "Potential Use-after-free in DANE Client Code",
"description": "Issue summary: An uncommon configuration of clients performing DANE TLSA-based server authentication, when paired with uncommon server DANE TLSA records, may result in a use-after-free and/or double-free on the client side. Impact summary: A use after free can have a range of potential consequences such as the corruption of valid data, crashes or execution of arbitrary code. However, the issue only affects clients that make use of TLSA records with both the PKIX-TA(0/PKIX-EE(1) certificate usage",
"severity": "low",
"reporters": [
"Igor Morgenstern (Aisle Research)"
],
"attribution_band": "ai_affiliation_only",
"attribution_markers": [
"Aisle Research"
],
"cwe_ids": [
"CWE-416"
],
"advisory_url": "https://openssl-library.org/news/secadv/20260407.txt",
"source_path": "secjson/CVE-2026-28387.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2026-28387.json"
},
{
"id": "CVE-2026-28388",
"published": "2026-04-07",
"quarter": "2026-Q2",
"title": "NULL Pointer Dereference When Processing a Delta CRL",
"description": "Issue summary: When a delta CRL that contains a Delta CRL Indicator extension is processed a NULL pointer dereference might happen if the required CRL Number extension is missing. Impact summary: A NULL pointer dereference can trigger a crash which leads to a Denial of Service for an application. When CRL processing and delta CRL processing is enabled during X.509 certificate verification, the delta CRL processing does not check whether the CRL Number extension is NULL before dereferencing it. W",
"severity": "low",
"reporters": [
"Igor Morgenstern (Aisle Research)"
],
"attribution_band": "ai_affiliation_only",
"attribution_markers": [
"Aisle Research"
],
"cwe_ids": [
"CWE-476"
],
"advisory_url": "https://openssl-library.org/news/secadv/20260407.txt",
"source_path": "secjson/CVE-2026-28388.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2026-28388.json"
},
{
"id": "CVE-2026-28389",
"published": "2026-04-07",
"quarter": "2026-Q2",
"title": "Possible NULL Dereference When Processing CMS KeyAgreeRecipientInfo",
"description": "Issue summary: During processing of a crafted CMS EnvelopedData message with KeyAgreeRecipientInfo a NULL pointer dereference can happen. Impact summary: Applications that process attacker-controlled CMS data may crash before authentication or cryptographic operations occur resulting in Denial of Service. When a CMS EnvelopedData message that uses KeyAgreeRecipientInfo is processed, the optional parameters field of KeyEncryptionAlgorithmIdentifier is examined without checking for its presence. T",
"severity": "low",
"reporters": [
"Nathan Sportsman (Praetorian)",
"Daniel Rhea",
"Jaeho Nam (Seoul National University)",
"Muhammad Daffa",
"Zhanpeng Liu (Tencent Xuanwu Lab)",
"Guannan Wang (Tencent Xuanwu Lab)",
"Guancheng Li (Tencent Xuanwu Lab)",
"Joshua Rogers (Aisle Research)"
],
"attribution_band": "ai_affiliation_only",
"attribution_markers": [
"Aisle Research"
],
"cwe_ids": [
"CWE-476"
],
"advisory_url": "https://openssl-library.org/news/secadv/20260407.txt",
"source_path": "secjson/CVE-2026-28389.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2026-28389.json"
},
{
"id": "CVE-2026-28390",
"published": "2026-04-07",
"quarter": "2026-Q2",
"title": "Possible NULL Dereference When Processing CMS KeyTransportRecipientInfo",
"description": "Issue summary: During processing of a crafted CMS EnvelopedData message with KeyTransportRecipientInfo a NULL pointer dereference can happen. Impact summary: Applications that process attacker-controlled CMS data may crash before authentication or cryptographic operations occur resulting in Denial of Service. When a CMS EnvelopedData message that uses KeyTransportRecipientInfo with RSA-OAEP encryption is processed, the optional parameters field of RSA-OAEP SourceFunc algorithm identifier is exam",
"severity": "low",
"reporters": [
"Muhammad Daffa",
"Zhanpeng Liu (Tencent Xuanwu Lab)",
"Guannan Wang (Tencent Xuanwu Lab)",
"Guancheng Li (Tencent Xuanwu Lab)",
"Joshua Rogers (Aisle Research)",
"Chanho Kim"
],
"attribution_band": "ai_affiliation_only",
"attribution_markers": [
"Aisle Research"
],
"cwe_ids": [
"CWE-476"
],
"advisory_url": "https://openssl-library.org/news/secadv/20260407.txt",
"source_path": "secjson/CVE-2026-28390.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2026-28390.json"
},
{
"id": "CVE-2026-31789",
"published": "2026-04-07",
"quarter": "2026-Q2",
"title": "Heap Buffer Overflow in Hexadecimal Conversion",
"description": "Issue summary: Converting an excessively large OCTET STRING value to a hexadecimal string leads to a heap buffer overflow on 32 bit platforms. Impact summary: A heap buffer overflow may lead to a crash or possibly an attacker controlled code execution or other undefined behavior. If an attacker can supply a crafted X.509 certificate with an excessively large OCTET STRING value in extensions such as the Subject Key Identifier (SKID) or Authority Key Identifier (AKID) which are being converted to ",
"severity": "low",
"reporters": [
"Quoc Tran (Xint.io - US Team)"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [
"CWE-787"
],
"advisory_url": "https://openssl-library.org/news/secadv/20260407.txt",
"source_path": "secjson/CVE-2026-31789.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2026-31789.json"
},
{
"id": "CVE-2026-31790",
"published": "2026-04-07",
"quarter": "2026-Q2",
"title": "Incorrect Failure Handling in RSA KEM RSASVE Encapsulation",
"description": "Issue summary: Applications using RSASVE key encapsulation to establish a secret encryption key can send contents of an uninitialized memory buffer to a malicious peer. Impact summary: The uninitialized buffer might contain sensitive data from the previous execution of the application process which leads to sensitive data leakage to an attacker. RSA_public_encrypt() returns the number of bytes written on success and -1 on error. The affected code tests only whether the return value is non-zero. ",
"severity": "medium",
"reporters": [
"Simo Sorce (Red Hat)"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [
"CWE-754"
],
"advisory_url": "https://openssl-library.org/news/secadv/20260407.txt",
"source_path": "secjson/CVE-2026-31790.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2026-31790.json"
},
{
"id": "CVE-2026-34180",
"published": "2026-06-09",
"quarter": "2026-Q2",
"title": "Heap Buffer Over-read in ASN.1 Content Parsing",
"description": "Issue summary: Parsing a crafted DER-encoded ASN.1 structure with a primitive element whose content exceeds 2 gigabytes in length may cause a heap buffer over-read on 64-bit Unix and Unix-like platforms. Impact summary: The heap buffer over-read may crash the application (Denial of Service) or to load into the decoded ASN.1 object contents of memory beyond the end of the input buffer. More typically such ASN.1 elements would instead be truncated. An integer truncation in OpenSSL's ASN.1 decoder ",
"severity": "low",
"reporters": [
"Frank Buss"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [
"CWE-125"
],
"advisory_url": "https://openssl-library.org/news/secadv/20260609.txt",
"source_path": "secjson/CVE-2026-34180.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2026-34180.json"
},
{
"id": "CVE-2026-34181",
"published": "2026-06-09",
"quarter": "2026-Q2",
"title": "PKCS#12 Files with PBMAC1 Are Accepted with Short HMAC Keys",
"description": "Issue Summary: The PKCS#12 file processing fails to perform sufficient input validation for files that use Password-Based Message Authentication Code 1 (PBMAC1) integrity mechanism allowing a certificate and private key forgery. Impact Summary: An attacker impersonating a user can cause a service reading PKCS#12 files to accept forged certificates and private keys with a 1 in 256 probability. If a service accepting PKCS#12 files is using passwords for authenticating the received files, the attac",
"severity": "low",
"reporters": [
"Pavol Žáčik (Red Hat)",
"Alex Gaynor (Anthropic)"
],
"attribution_band": "ai_affiliation_only",
"attribution_markers": [
"Anthropic"
],
"cwe_ids": [
"CWE-354"
],
"advisory_url": "https://openssl-library.org/news/secadv/20260609.txt",
"source_path": "secjson/CVE-2026-34181.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2026-34181.json"
},
{
"id": "CVE-2026-34182",
"published": "2026-06-09",
"quarter": "2026-Q2",
"title": "CMS AuthEnvelopedData Processing May Accept Forged Messages",
"description": "Issue Summary: Cryptographic Message Services (CMS) processing fails to perform sufficient input validation on the cipher and tag length fields of AuthEnvelopedData containers, leading to various potential compromises. Impact Summary: Attackers making use of these vulnerabilities may achieve key-equivalent functionality for a given CMS recipient and/or bypass integrity validation for a given message. In one use case, an attacker may send a CMS message containing AuthEnvelopedData with the cipher",
"severity": "medium",
"reporters": [
"Asim Viladi Oglu Manizada",
"Alex Gaynor (Anthropic)",
"Ying Dong",
"Haiyang Huang"
],
"attribution_band": "ai_affiliation_only",
"attribution_markers": [
"Anthropic"
],
"cwe_ids": [
"CWE-354"
],
"advisory_url": "https://openssl-library.org/news/secadv/20260609.txt",
"source_path": "secjson/CVE-2026-34182.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2026-34182.json"
},
{
"id": "CVE-2026-34183",
"published": "2026-06-09",
"quarter": "2026-Q2",
"title": "Unbounded Memory Growth in the QUIC PATH_CHALLENGE Handler",
"description": "Issue summary: Remote peer may exhaust heap memory of the QUIC server or client by flooding it with packets containing PATH_CHALLENGE frames. Impact summary: A malicious remote peer can cause an unbounded memory allocation which can lead to an abnormal termination of the application acting as a QUIC client or server and a Denial of Service. A remote peer may exhaust heap memory by flooding the local QUIC stack with PATH_CHALLENGE frames. The local QUIC stack allocates a PATH_RESPONSE frame for e",
"severity": "medium",
"reporters": [
"Abhinav Agarwal"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [
"CWE-1325"
],
"advisory_url": "https://openssl-library.org/news/secadv/20260609.txt",
"source_path": "secjson/CVE-2026-34183.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2026-34183.json"
},
{
"id": "CVE-2026-35188",
"published": "2026-06-09",
"quarter": "2026-Q2",
"title": "Double-free When Checking OCSP Stapled Response",
"description": "Issue summary: A malicious server can exploit TLS OCSP stapling by delivering a crafted response through the status_request extension, triggering a double-free in the client's certificate verification path. Impact summary: Successful exploitation allows an attacker to corrupt heap memory via a double-free, potentially leading to a Denial of Service or possibly an attacker controlled code execution or other undefined behavior. If OCSP stapling is enabled and the TLS client connects to a malicious",
"severity": "medium",
"reporters": [
"Wang Kenaz (University of Illinois)",
"Guido Vranken (Aisle Research)",
"Aaron Grattafiori (Nvidia)"
],
"attribution_band": "ai_affiliation_only",
"attribution_markers": [
"Aisle Research"
],
"cwe_ids": [
"CWE-415"
],
"advisory_url": "https://openssl-library.org/news/secadv/20260609.txt",
"source_path": "secjson/CVE-2026-35188.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2026-35188.json"
},
{
"id": "CVE-2026-42764",
"published": "2026-06-09",
"quarter": "2026-Q2",
"title": "NULL Pointer Dereference in QUIC Server Initial Packet Handling",
"description": "Issue summary: Receiving a QUIC initial packet with an invalid token may trigger a NULL pointer dereference in the OpenSSL QUIC server with address validation disabled. Impact summary: NULL pointer dereference typically causes abnormal termination of the affected QUIC server process and a Denial of Service. If the address validation is disabled in the OpenSSL QUIC server implementation, an attacker can crash the server by sending an initial packet with an invalid or expired token. By default, th",
"severity": "medium",
"reporters": [
"Sunwoo Lee (KENTECH)",
"Hyuk Lim (KENTECH)",
"Seunghyun Yoon (KENTECH)"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [
"CWE-476"
],
"advisory_url": "https://openssl-library.org/news/secadv/20260609.txt",
"source_path": "secjson/CVE-2026-42764.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2026-42764.json"
},
{
"id": "CVE-2026-42765",
"published": "2026-06-09",
"quarter": "2026-Q2",
"title": "NULL Dereference in Certificate Verification with OCSP Checking",
"description": "Issue summary: When a partial-chain certificate verification is enabled together with OCSP response checking for the whole chain, a NULL dereference will happen if the verified chain does not have a self-signed trusted anchor, crashing the process. Impact summary: A NULL pointer dereference can trigger a crash which leads to a Denial of Service for an application. When performing OCSP response checking for certificates in the verification chain, the code always tries to access the next certifica",
"severity": "low",
"reporters": [
"Joshua Rogers (Aisle Research)"
],
"attribution_band": "ai_affiliation_only",
"attribution_markers": [
"Aisle Research"
],
"cwe_ids": [
"CWE-476"
],
"advisory_url": "https://openssl-library.org/news/secadv/20260609.txt",
"source_path": "secjson/CVE-2026-42765.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2026-42765.json"
},
{
"id": "CVE-2026-42766",
"published": "2026-06-09",
"quarter": "2026-Q2",
"title": "Possible NULL Dereference in Password-Based CMS Decryption",
"description": "Issue summary: A specially crafted password-encrypted CMS message can trigger a NULL pointer dereference during CMS decryption. Impact summary: This NULL pointer dereference leads to an application crash and a Denial of Service. The CMS PasswordRecipientInfo.keyDerivationAlgorithm field is defined as OPTIONAL in the ASN.1 specification and may therefore be absent in specially crafted inputs. During the password-based CMS decryption the OpenSSL CMS implementation dereferences this field without f",
"severity": "low",
"reporters": [
"Mayank Jangid",
"Kushal Khemka",
"Hari Priandana",
"Bhabani Sankar Das",
"Qifan Zhang (Palo Alto Networks)"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [
"CWE-476"
],
"advisory_url": "https://openssl-library.org/news/secadv/20260609.txt",
"source_path": "secjson/CVE-2026-42766.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2026-42766.json"
},
{
"id": "CVE-2026-42767",
"published": "2026-06-09",
"quarter": "2026-Q2",
"title": "NULL Pointer Dereference in CRMF EncryptedValue Decryption",
"description": "Issue summary: An attacker-controlled CMP (Certificate Management Protocol) server could trigger a NULL pointer dereference in a CMP client application. Impact summary: A NULL pointer dereference causes a crash of the application and a Denial of Service. An attacker controlling a CMP server (or acting as a man-in-the-middle) could craft a CMP response containing a CRMF (Certificate Request Message Format) CertRepMessage with an EncryptedValue structure where the symmAlg field has an algorithm OI",
"severity": "low",
"reporters": [
"Zhanpeng Liu (Tencent Xuanwu Lab)",
"Guannan Wang (Tencent Xuanwu Lab)",
"Guancheng Li (Tencent Xuanwu Lab)",
"Bhabani Sankar Das"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [
"CWE-476"
],
"advisory_url": "https://openssl-library.org/news/secadv/20260609.txt",
"source_path": "secjson/CVE-2026-42767.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2026-42767.json"
},
{
"id": "CVE-2026-42768",
"published": "2026-06-09",
"quarter": "2026-Q2",
"title": "Multi-RecipientInfo Bleichenbacher Oracle in CMS_decrypt() and PKCS7_decrypt()",
"description": "Issue summary: The CMS_decrypt and PKCS7_decrypt functions are vulnerable to Bleichenbacher-style attack when an attacker is able to provide the CMS or S/MIME messages and observe the error code and/or decryption output. Impact summary: The Bleichenbacher-style attack allows an attacker to use the victim's vulnerable application as a way to decrypt or sign messages with the victim's private RSA key. The attack is possible in 2 variants. 1. The decryption API (CMS_decrypt(), PKCS7_decrypt()) is u",
"severity": "low",
"reporters": [
"Alex Gaynor (Anthropic)"
],
"attribution_band": "ai_affiliation_only",
"attribution_markers": [
"Anthropic"
],
"cwe_ids": [
"CWE-514"
],
"advisory_url": "https://openssl-library.org/news/secadv/20260609.txt",
"source_path": "secjson/CVE-2026-42768.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2026-42768.json"
},
{
"id": "CVE-2026-42769",
"published": "2026-06-09",
"quarter": "2026-Q2",
"title": "Trust-Anchor Substitution via cert/issuer Typo in CMP rootCaKeyUpdate",
"description": "Issue Summary: An error in the callback used to verify the certificate provided in a Root CA key update Certificate Management Protocol (CMP) message response rendered the certificate validation ineffectual, which could lead to escalation of credentials from the Registration Authority (RA) level to the root Certification Authority (root CA) level. Impact Summary: The Registration Autority could replace the root CA certificate for the CMP clients with an arbitrary root CA certificate. One of the ",
"severity": "low",
"reporters": [
"Alex Gaynor (Anthropic)"
],
"attribution_band": "ai_affiliation_only",
"attribution_markers": [
"Anthropic"
],
"cwe_ids": [
"CWE-295"
],
"advisory_url": "https://openssl-library.org/news/secadv/20260609.txt",
"source_path": "secjson/CVE-2026-42769.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2026-42769.json"
},
{
"id": "CVE-2026-42770",
"published": "2026-06-09",
"quarter": "2026-Q2",
"title": "FFC-DH Peer Validation Uses Attacker-Supplied q",
"description": "Issue summary: When EVP_PKEY_derive_set_peer() is called with a DHX (X9.42) peer key, the peer key is not properly checked for the subgroup membership. Impact summary: A malicious peer which presents an X9.42 key carrying the victim's p and g parameters, a forged q = r (a small prime factor of the cofactor (p−1)/q_local), and a public value Y of order r can recover the victim's private key after a small number of key exchange attempts. When EVP_PKEY_derive_set_peer() is called with a DHX (X9.42)",
"severity": "low",
"reporters": [
"Alex Gaynor (Anthropic)"
],
"attribution_band": "ai_affiliation_only",
"attribution_markers": [
"Anthropic"
],
"cwe_ids": [
"CWE-325"
],
"advisory_url": "https://openssl-library.org/news/secadv/20260609.txt",
"source_path": "secjson/CVE-2026-42770.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2026-42770.json"
},
{
"id": "CVE-2026-42771",
"published": "2026-06-09",
"quarter": "2026-Q2",
"title": "Possible Out of Bounds Read in X509_VERIFY_PARAM_set1_email()",
"description": "Issue summary: When the X509_VERIFY_PARAM_set1_email is called by an application to validate a crafted e-mail address, such as during S/MIME message validation, an out of bounds read can happen. Impact summary: This out of bounds read will not directly exfiltrate the data read to the attacker so the most likely result is a crash and a Denial of Service. An internal helper function called from X509_VERIFY_PARAM_[set|add]_email() used a wrong length when validating the local part of an email addre",
"severity": "low",
"reporters": [
"TrendAI Zero Day Initiative"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [
"CWE-125"
],
"advisory_url": "https://openssl-library.org/news/secadv/20260609.txt",
"source_path": "secjson/CVE-2026-42771.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2026-42771.json"
},
{
"id": "CVE-2026-45445",
"published": "2026-06-09",
"quarter": "2026-Q2",
"title": "AES-OCB IV Ignored on EVP_Cipher() Path",
"description": "Issue summary: When an application drives an AES-OCB context through the public EVP_Cipher() one-shot interface, the application-supplied initialisation vector (IV) is silently discarded. Impact summary: Every message encrypted under the same key uses the same effective nonce regardless of the IV supplied by the caller, resulting in (key, nonce) reuse and loss of confidentiality. If the same code path is used to compute the authentication tag, the tag depends only on the (key, IV) pair and not o",
"severity": "medium",
"reporters": [
"Alex Gaynor (Anthropic)"
],
"attribution_band": "ai_affiliation_only",
"attribution_markers": [
"Anthropic"
],
"cwe_ids": [
"CWE-325"
],
"advisory_url": "https://openssl-library.org/news/secadv/20260609.txt",
"source_path": "secjson/CVE-2026-45445.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2026-45445.json"
},
{
"id": "CVE-2026-45446",
"published": "2026-06-09",
"quarter": "2026-Q2",
"title": "Incorrect Tag Processing for Empty Messages in AES-GCM-SIV and AES-SIV modes",
"description": "Issue summary: The implementations of AES-SIV (RFC 5297) and AES-GCM-SIV (RFC 8452) mishandle the authentication of AAD (Additional Authenticated Data) with an empty ciphertext allowing a forgery of such messages. Impact summary: An attacker can forge empty messages with arbitrary AAD to the victim's application using these ciphers. AES-SIV (RFC 5297) and AES-GCM-SIV (RFC 8452) are nonce-misuse-resistant AEAD modes: they accept a key, nonce, optional AAD (bytes that are authenticated but not enc",
"severity": "low",
"reporters": [
"Alex Gaynor (Anthropic)"
],
"attribution_band": "ai_affiliation_only",
"attribution_markers": [
"Anthropic"
],
"cwe_ids": [
"CWE-325"
],
"advisory_url": "https://openssl-library.org/news/secadv/20260609.txt",
"source_path": "secjson/CVE-2026-45446.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2026-45446.json"
},
{
"id": "CVE-2026-45447",
"published": "2026-06-09",
"quarter": "2026-Q2",
"title": "Heap Use-After-Free in the PKCS7_verify() Function",
"description": "Issue summary: A specially crafted PKCS#7 or S/MIME signed message could trigger a use-after-free during PKCS#7 signature verification. Impact summary: A use-after-free may result in process crashes, heap corruption, or potentially remote code execution. When processing a PKCS#7 or S/MIME signed message, if the SignedData digestAlgorithms field is present as an empty ASN.1 SET, OpenSSL may incorrectly free a caller-owned BIO during PKCS7_verify(). A subsequent use of the BIO by the calling appli",
"severity": "high",
"reporters": [
"Thai Duong (Calif.io in collaboration with Claude and Anthropic Research)"
],
"attribution_band": "explicit_ai_marker",
"attribution_markers": [
"Claude"
],
"cwe_ids": [
"CWE-416"
],
"advisory_url": "https://openssl-library.org/news/secadv/20260609.txt",
"source_path": "secjson/CVE-2026-45447.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2026-45447.json"
},
{
"id": "CVE-2026-7383",
"published": "2026-06-09",
"quarter": "2026-Q2",
"title": "Possible Heap Buffer Overflow in ASN.1 Multibyte String Conversion",
"description": "Issue summary: A signed integer overflow when sizing the destination buffer for Unicode output in ASN1_mbstring_ncopy() can lead to a heap buffer overflow. Impact summary: A heap buffer overflow may lead to a crash or possibly attacker controlled code execution or other undefined behaviour. In ASN1_mbstring_copy() and ASN1_mbstring_ncopy() the destination size for Unicode output is computed in a signed int: by left shift of the input character count for BMPSTRING (UTF-16) and UNIVERSALSTRING (UT",
"severity": "low",
"reporters": [
"Zehua Qiao",
"Jinwen He"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [
"CWE-787"
],
"advisory_url": "https://openssl-library.org/news/secadv/20260609.txt",
"source_path": "secjson/CVE-2026-7383.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2026-7383.json"
},
{
"id": "CVE-2026-9076",
"published": "2026-06-09",
"quarter": "2026-Q2",
"title": "Out-of-Bounds Read in CMS Password-Based Decryption",
"description": "Issue summary: When CMS password-based decryption (RFC 3211 / PWRI key unwrap) processes attacker-supplied CMS data, an attacker-chosen stream-mode KEK cipher can trigger a heap out-of-bounds read in kek_unwrap_key(). Impact summary: A heap buffer over-read may trigger a crash which leads to Denial of Service for an application if the input buffer ends at a memory page boundary and the following page is unmapped. There is no information disclosure as the over-read bytes are not revealed to the a",
"severity": "low",
"reporters": [
"Bhabani Sankar Das",
"Haruki Oyama (Waseda University)"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [
"CWE-125"
],
"advisory_url": "https://openssl-library.org/news/secadv/20260609.txt",
"source_path": "secjson/CVE-2026-9076.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2026-9076.json"
},
{
"id": "CVE-2026-54876",
"published": "2026-08-05",
"quarter": "2026-Q3",
"title": "Client-Side Memory Leak in OCSP Response Checking",
"description": "Issue summary: A malicious TLS server can cause a memory leak in a TLS client that has enabled OCSP response checking by sending an OCSP response that contains no single response entries. Impact summary: An attacker can leak an attacker-tunable amount of memory per TLS handshake in a victim client application. A long-running client that repeatedly connects to a malicious server can have its memory exhausted, resulting in a Denial of Service. CWE: CWE-401: Missing Release of Memory after Effectiv",
"severity": "low",
"reporters": [
"Bhabani Sankar Das",
"Zhenzhe Shao"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [
"CWE-401"
],
"advisory_url": "https://openssl-library.org/news/secadv/20260805.txt",
"source_path": "secjson/CVE-2026-54876.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2026-54876.json"
},
{
"id": "CVE-2026-14456",
"published": "2026-08-13",
"quarter": "2026-Q3",
"title": "Unbounded Memory Growth in QUIC Server Incoming Channel Queue",
"description": "Issue summary: When an OpenSSL QUIC server (Listener SSL object) processes valid QUIC Initial packets for unknown destination connection IDs, it can allocate and queue new incoming channels without enforcing any limit. Impact summary: A remote peer that can make many Initial packets reach the server listener faster than the application accepts connections, can cause the memory allocated to store the per-channel state to grow without any limits, potentially making the QUIC listener unavailable an",
"severity": "low",
"reporters": [
"Filipe Casal (Trail of Bits)"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [
"CWE-770"
],
"advisory_url": "https://openssl-library.org/news/secadv/20260813.txt",
"source_path": "secjson/CVE-2026-14456.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2026-14456.json"
},
{
"id": "CVE-2026-14457",
"published": "2026-08-25",
"quarter": "2026-Q3",
"title": "RPK Server Signature Algorithm Selection Can Dereference a Missing Certificate",
"description": "Issue summary: In a server or client configuration with RFC7250 Raw Public Keys (RPKs) enabled, and only the private key (with no associated certificate) configured locally, a NULL pointer dereference may occur when the remote peer solicits raw public keys and also sends the typically omitted \"signature_algorithms_cert\" TLS extension. Impact summary: The impact is limited to a possible Denial of Service as a result of an application abort, no data disclosure or remote command execution are possi",
"severity": "low",
"reporters": [
"Filipe Casal (Trail of Bits)"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [
"CWE-476"
],
"advisory_url": "https://openssl-library.org/news/secadv/20260825.txt",
"source_path": "secjson/CVE-2026-14457.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2026-14457.json"
},
{
"id": "CVE-2026-18798",
"published": "2026-08-25",
"quarter": "2026-Q3",
"title": "QUIC Server May Trigger Double Free When Processing INITIAL Packet",
"description": "Issue summary: QUIC server may double free QRX (QUIC record layer RX) object when channel creation fails for initial packet. Impact summary: Double free leads to heap corruption, which typically results in termination of QUIC server process, leading to Denial of Service. There is so far no evidence that this double free is exploitable for remote code execution, thus it is considered highly improbable. CWE: CWE-415: Double Free Description: In order to validate initial packet, OpenSSL QUIC stack ",
"severity": "medium",
"reporters": [
"Fuzz0x (ZKSC Institute of Security Research)",
"Emilio Galle",
"Feng Xue (ThreatBoon)"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [
"CWE-415"
],
"advisory_url": "https://openssl-library.org/news/secadv/20260825.txt",
"source_path": "secjson/CVE-2026-18798.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2026-18798.json"
},
{
"id": "CVE-2026-54874",
"published": "2026-08-25",
"quarter": "2026-Q3",
"title": "Excessive Memory Use Buffering DTLS Records for a Future Epoch",
"description": "Issue summary: Receiving a DTLS record for a future epoch while a handshake is in progress causes OpenSSL to buffer far more memory than the record itself requires. Impact summary: A peer can use a small amount of network traffic to make an OpenSSL DTLS endpoint retain a disproportionately large amount of memory, which may lead to a Denial of Service. CWE: CWE-405: Asymmetric Resource Consumption (Amplification) Description: While a DTLS handshake is in progress, a peer may legitimately have alr",
"severity": "low",
"reporters": [
"Amazon Web Services"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [
"CWE-405"
],
"advisory_url": "https://openssl-library.org/news/secadv/20260825.txt",
"source_path": "secjson/CVE-2026-54874.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2026-54874.json"
},
{
"id": "CVE-2026-63072",
"published": "2026-08-25",
"quarter": "2026-Q3",
"title": "Heap Buffer Overflow in CMS Key Unwrapping",
"description": "Issue summary: OpenSSL CMS decryption sizes the key-unwrap output buffer based on querying the unwrapped key size, but the AES-WRAP-PAD unwrap primitive can write and cleanse more bytes than that query reports, causing an 8-byte out-of-bounds heap write. Impact summary: An attacker who supplies a crafted CMS message can trigger a deterministic 8-byte out-of-bounds heap write when the victim decrypts it with CMS_decrypt(), corrupting the heap and typically resulting in a Denial of Service. CWE: C",
"severity": "medium",
"reporters": [
"Bhabani Sankar Das",
"Filipe Casal(Trail of Bits)"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [
"CWE-787"
],
"advisory_url": "https://openssl-library.org/news/secadv/20260825.txt",
"source_path": "secjson/CVE-2026-63072.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2026-63072.json"
},
{
"id": "CVE-2026-63073",
"published": "2026-08-25",
"quarter": "2026-Q3",
"title": "Untrusted Sender DN Used as Format String in CMP Response Validation",
"description": "Issue summary: OpenSSL CMP response validation passed an unexpected response sender distinguished name directly as the format string to `ERR_raise_data()`. Impact summary: A malicious or intercepted CMP endpoint can crash a CMP client that enforces an expected sender or uses a pinned server certificate whose subject becomes the default expected sender. CWE: CWE-134 (Use of Externally-Controlled Format String) Description: When validating a received CMP message, ossl_cmp_msg_check_update() conver",
"severity": "low",
"reporters": [
"Filipe Casal (Trail of Bits)",
"Brandon Luo",
"TrendAI Zero Day Initiative"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [
"CWE-134"
],
"advisory_url": "https://openssl-library.org/news/secadv/20260825.txt",
"source_path": "secjson/CVE-2026-63073.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2026-63073.json"
},
{
"id": "CVE-2026-63074",
"published": "2026-08-25",
"quarter": "2026-Q3",
"title": "CMP Indefinite Cache Growth of ExtraCerts",
"description": "Issue summary: The OpenSSL Certificate Management Protocol (CMP) caches additional certificates (extraCerts) sent in a CMP message, but never expunges them (for instance if they are invalid). If a server reuses an OSSL_CMP_CTX frequently, this cache of extraCerts may grow unboundedly, and a malicious client may flood a CMP server with requests driving this growth. Impact summary: Users utilizing a CMP server that reuses a single OSSL_CMP_CTX for the lifetime of a server process may observe unbou",
"severity": "low",
"reporters": [
"Pavоl Žáčik (Red Hat)"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [
"CWE-770"
],
"advisory_url": "https://openssl-library.org/news/secadv/20260825.txt",
"source_path": "secjson/CVE-2026-63074.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2026-63074.json"
},
{
"id": "CVE-2026-63075",
"published": "2026-08-25",
"quarter": "2026-Q3",
"title": "QUIC ACK-only Packet Retention Can Cause Memory Exhaustion",
"description": "Issue summary: When OpenSSL processes QUIC traffic from a peer that repeatedly sends ack-eliciting packets while not acknowledging ACK-only responses, the QUIC stack can retain ACK-only packet metadata for the lifetime of the connection. Impact summary: A remote peer that can complete a QUIC handshake can cause connection-scoped memory growth which may lead to Denial of Service through memory exhaustion, especially with sustained traffic or many concurrent QUIC connections. CWE: CWE-770: Allocat",
"severity": "low",
"reporters": [
"Opal Wright (Trail of Bits)"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [
"CWE-770"
],
"advisory_url": "https://openssl-library.org/news/secadv/20260825.txt",
"source_path": "secjson/CVE-2026-63075.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2026-63075.json"
},
{
"id": "CVE-2026-63076",
"published": "2026-08-25",
"quarter": "2026-Q3",
"title": "Invalid Pointer Dereference in CMP Server via Crafted protectionAlg",
"description": "Issue summary: OpenSSL CMP password based protection verification only checks whether the protectionAlg parameter was not NULL and not its ASN.1 type, before treating it as a PBMParameter. A crafted message can contain a parameter of a different type, which is then dereferenced as an invalid pointer. Impact summary: A remote, unauthenticated attacker can crash an application acting as a CMP server that accepts PBM-protected messages, or a CMP client talking to a malicious or intercepted CMP serv",
"severity": "medium",
"reporters": [
"Ying Dong",
"Bhabani Sankar Das"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [
"CWE-476"
],
"advisory_url": "https://openssl-library.org/news/secadv/20260825.txt",
"source_path": "secjson/CVE-2026-63076.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2026-63076.json"
},
{
"id": "CVE-2026-75803",
"published": "2026-08-25",
"quarter": "2026-Q3",
"title": "AEAD Forgeries with Empty Ciphertext When Using EVP_Cipher()",
"description": "Issue summary: ChaCha20-Poly1305 and AES-OCB decryption with an empty ciphertext can report success without verifying the supplied authentication tag when the operation is finalized by calling the EVP_Cipher() function. Impact summary: Applications calling EVP_Cipher() on an empty ciphertext and expecting the call to check the AEAD tag may accept forged messages. CWE: CWE-354 (Improper Validation of Integrity Check Value) Description: The EVP_Cipher() API call for AEAD ciphers behaves like a one",
"severity": "low",
"reporters": [
"Billy Brumley (Rochester Institute of Technology)"
],
"attribution_band": "other_or_unmarked",
"attribution_markers": [],
"cwe_ids": [
"CWE-354"
],
"advisory_url": "https://openssl-library.org/news/secadv/20260825.txt",
"source_path": "secjson/CVE-2026-75803.json",
"source_url": "https://github.com/openssl/release-metadata/blob/18c7d2226fd32d230d7b976b899a0a346592688c/secjson/CVE-2026-75803.json"
}
]
}