CVE search results

11 – 20 of 275 results

Detailed view

Sort by:

CVE-2024-5535

Low priority

Some fixes available 5 of 21

Issue summary: Calling the OpenSSL API function SSL_select_next_proto with an empty supported client protocols buffer may cause a crash or memory contents to be sent to the peer. Impact summary: A buffer overread can have a range...

4 affected packages

edk2, nodejs, openssl, openssl1.0

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS
edk2	Needs evaluation	Needs evaluation	Needs evaluation	Needs evaluation
nodejs	Not affected	Vulnerable	Not affected	Needs evaluation
openssl	Fixed	Fixed	Fixed	Needs evaluation
openssl1.0	Not in release	Not in release	Not in release	Needs evaluation

CVE-2024-4741

Low priority

Some fixes available 5 of 20

Issue summary: Calling the OpenSSL API function SSL_free_buffers may cause memory to be accessed that was previously freed in some situations Impact summary: A use after free can have a range of potential consequences such as the...

4 affected packages

edk2, nodejs, openssl, openssl1.0

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS
edk2	Vulnerable	Vulnerable	Vulnerable	Needs evaluation
nodejs	Not affected	Vulnerable	Not affected	Needs evaluation
openssl	Fixed	Fixed	Fixed	Needs evaluation
openssl1.0	Not in release	Not in release	Not in release	Not affected

CVE-2024-4603

Low priority

Some fixes available 4 of 11

Issue summary: Checking excessively long DSA keys or parameters may be very slow. Impact summary: Applications that use the functions EVP_PKEY_param_check() or EVP_PKEY_public_check() to check a DSA public key or DSA parameters...

4 affected packages

edk2, nodejs, openssl, openssl1.0

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS
edk2	Vulnerable	Not affected	Not affected	Not affected
nodejs	Not affected	Vulnerable	Not affected	Needs evaluation
openssl	Fixed	Fixed	Not affected	Not affected
openssl1.0	Not in release	Not in release	Not in release	Not affected

CVE-2024-2467

Medium priority

Vulnerable

A timing-based side-channel flaw exists in the perl-Crypt-OpenSSL-RSA package, which could be sufficient to recover plaintext across a network in a Bleichenbacher-style attack. To achieve successful decryption, an attacker would...

1 affected package

libcrypt-openssl-rsa-perl

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS
libcrypt-openssl-rsa-perl	Vulnerable	Vulnerable	Vulnerable	Vulnerable

CVE-2024-2511

Low priority

Some fixes available 5 of 20

Issue summary: Some non-default TLS server configurations can cause unbounded memory growth when processing TLSv1.3 sessions Impact summary: An attacker may exploit certain server configurations to trigger unbounded memory growth...

4 affected packages

edk2, nodejs, openssl, openssl1.0

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS
edk2	Vulnerable	Vulnerable	Vulnerable	Needs evaluation
nodejs	Not affected	Vulnerable	Not affected	Needs evaluation
openssl	Fixed	Fixed	Fixed	Needs evaluation
openssl1.0	Not in release	Not in release	Not in release	Not affected

CVE-2024-3296

Medium priority

Needs evaluation

A timing-based side-channel flaw exists in the rust-openssl package, which could be sufficient to recover a plaintext across a network in a Bleichenbacher-style attack. To achieve successful decryption, an attacker would have to...

1 affected package

rust-openssl

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS
rust-openssl	Needs evaluation	Needs evaluation	Needs evaluation	—

CVE-2024-0727

Low priority

Some fixes available 10 of 21

Issue summary: Processing a maliciously formatted PKCS12 file may lead OpenSSL to crash leading to a potential Denial of Service attack Impact summary: Applications loading files in the PKCS12 format from untrusted sources might...

4 affected packages

edk2, nodejs, openssl, openssl1.0

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS
edk2	Vulnerable	Vulnerable	Vulnerable	Needs evaluation
nodejs	Not affected	Vulnerable	Not affected	Not affected
openssl	Fixed	Fixed	Fixed	Fixed
openssl1.0	Not in release	Not in release	Not in release	Fixed

CVE-2023-6237

Low priority

Some fixes available 5 of 10

Issue summary: Checking excessively long invalid RSA public keys may take a long time. Impact summary: Applications that use the function EVP_PKEY_public_check() to check RSA public keys may experience long delays. Where the key...

4 affected packages

edk2, nodejs, openssl, openssl1.0

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS
edk2	Vulnerable	Not affected	Not affected	Not affected
nodejs	Not affected	Vulnerable	Not affected	Not affected
openssl	Fixed	Fixed	Not affected	Not affected
openssl1.0	Not in release	Not in release	Not in release	Not affected

CVE-2023-6129

Low priority

Some fixes available 5 of 10

Issue summary: The POLY1305 MAC (message authentication code) implementation contains a bug that might corrupt the internal state of applications running on PowerPC CPU based platforms if the CPU provides vector instructions....

4 affected packages

edk2, nodejs, openssl, openssl1.0

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS
edk2	Vulnerable	Not affected	Not affected	Not affected
nodejs	Not affected	Vulnerable	Not affected	Not affected
openssl	Fixed	Fixed	Not affected	Not affected
openssl1.0	Not in release	Not in release	Not in release	Not affected

CVE-2023-5678

Low priority

Some fixes available 9 of 20

Issue summary: Generating excessively long X9.42 DH keys or checking excessively long X9.42 DH keys or parameters may be very slow. Impact summary: Applications that use the functions DH_generate_key() to generate an X9.42 DH key...

4 affected packages

edk2, nodejs, openssl, openssl1.0

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS
edk2	Vulnerable	Vulnerable	Vulnerable	Needs evaluation
nodejs	Not affected	Vulnerable	Not affected	Not affected
openssl	Fixed	Fixed	Fixed	Fixed
openssl1.0	Not in release	Not in release	Not in release	Fixed

Export to JSON

Results by page:

Search CVE reports