CVE search results

1 – 10 of 438 results

Detailed view

Sort by:

CVE-2025-26466

Medium priority

Fixed

A flaw was found in the OpenSSH package. For each ping packet the SSH server receives, a pong packet is allocated in a memory buffer and stored in a queue of packages. It is only freed when the server/client key exchange has...

2 affected packages

openssh, openssh-ssh1

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS	16.04 LTS
openssh	Fixed	Not affected	Not affected	Not affected	Not affected
openssh-ssh1	Not affected	Not affected	Not affected	Not affected	—

CVE-2025-26465

Medium priority

Some fixes available 6 of 11

A vulnerability was found in OpenSSH when the VerifyHostKeyDNS option is enabled. A machine-in-the-middle attack can be performed by a malicious machine impersonating a legit server. This issue occurs due to how OpenSSH mishandles...

2 affected packages

openssh, openssh-ssh1

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS	16.04 LTS
openssh	Fixed	Fixed	Fixed	Fixed	Fixed
openssh-ssh1	Ignored	Ignored	Ignored	Ignored	—

CVE-2024-12797

High priority

Fixed

Issue summary: Clients using RFC7250 Raw Public Keys (RPKs) to authenticate a server may fail to notice that the server was not authenticated, because handshakes don’t abort as expected when the SSL_VERIFY_PEER...

4 affected packages

edk2, nodejs, openssl, openssl1.0

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS	16.04 LTS
edk2	Not affected	Not affected	Not affected	Not affected	Not affected
nodejs	Not affected	Not affected	Not affected	Not affected	Not affected
openssl	Not affected	Not affected	Not affected	Not affected	Not affected
openssl1.0	Not in release	Not in release	Not in release	Not affected	—

CVE-2025-24898

Medium priority

Needs evaluation

rust-openssl is a set of OpenSSL bindings for the Rust programming language. In affected versions `ssl::select_next_proto` can return a slice pointing into the `server` argument’s buffer but with a lifetime bound to the `client`...

2 affected packages

rust-openssl, rust-openssl-sys

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS	16.04 LTS
rust-openssl	Needs evaluation	Needs evaluation	Needs evaluation	—	—
rust-openssl-sys	Needs evaluation	Needs evaluation	Needs evaluation	—	—

CVE-2024-13176

Low priority

Some fixes available 4 of 16

Issue summary: A timing side-channel which could potentially allow recovering the private key exists in the ECDSA signature computation. Impact summary: A timing side-channel in ECDSA signature computations could allow recovering...

4 affected packages

edk2, nodejs, openssl, openssl1.0

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS	16.04 LTS
edk2	Needs evaluation	Needs evaluation	Needs evaluation	Needs evaluation	Needs evaluation
nodejs	Not affected	Vulnerable	Not affected	Needs evaluation	Needs evaluation
openssl	Fixed	Fixed	Fixed	Needs evaluation	Needs evaluation
openssl1.0	Not in release	Not in release	Not in release	Needs evaluation	—

CVE-2024-9143

Low priority

Some fixes available 4 of 17

Issue summary: Use of the low-level GF(2^m) elliptic curve APIs with untrusted explicit values for the field polynomial can lead to out-of-bounds memory reads or writes. Impact summary: Out of bound memory writes can lead to an...

4 affected packages

edk2, nodejs, openssl, openssl1.0

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS	16.04 LTS
edk2	Needs evaluation	Needs evaluation	Needs evaluation	Needs evaluation	Needs evaluation
nodejs	Not affected	Vulnerable	Not affected	Needs evaluation	Needs evaluation
openssl	Fixed	Fixed	Fixed	Needs evaluation	Needs evaluation
openssl1.0	Not in release	Not in release	Not in release	Needs evaluation	—

CVE-2024-6119

Medium priority

Some fixes available 3 of 12

Issue summary: Applications performing certificate name checks (e.g., TLS clients checking server certificates) may attempt to read an invalid memory address resulting in abnormal termination of the application process. Impact...

4 affected packages

edk2, nodejs, openssl, openssl1.0

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS	16.04 LTS
edk2	Needs evaluation	Needs evaluation	Needs evaluation	Needs evaluation	Needs evaluation
nodejs	Not affected	Vulnerable	Not affected	Needs evaluation	Needs evaluation
openssl	Fixed	Fixed	Not affected	Not affected	Not affected
openssl1.0	Not in release	Not in release	Not in release	Not affected	—

CVE-2024-41996

Low priority

Vulnerable

Validating the order of the public keys in the Diffie-Hellman Key Agreement Protocol, when an approved safe prime is used, allows remote attackers (from the client side) to trigger unnecessarily expensive server-side...

4 affected packages

edk2, nodejs, openssl, openssl1.0

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS	16.04 LTS
edk2	Needs evaluation	Not affected	Not affected	Not affected	Not affected
nodejs	Not affected	Needs evaluation	Not affected	Not affected	Not affected
openssl	Vulnerable	Vulnerable	Not affected	Not affected	Not affected
openssl1.0	Not in release	Not in release	Not in release	Not affected	—

CVE-2024-7589

Medium priority

Not affected

A signal handler in sshd(8) may call a logging function that is not async-signal-safe. The signal handler is invoked when a client does not authenticate within the LoginGraceTime seconds (120 by default). This signal handler...

2 affected packages

openssh, openssh-ssh1

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS	16.04 LTS
openssh	Not affected	Not affected	Not affected	Not affected	Not affected
openssh-ssh1	Not affected	Not affected	Not affected	Not affected	—

CVE-2024-6409

Medium priority

Not affected

A race condition vulnerability was discovered in how signals are handled by OpenSSH’s server (sshd). If a remote attacker does not authenticate within a set time period, then sshd’s SIGALRM handler is called...

2 affected packages

openssh, openssh-ssh1

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS	16.04 LTS
openssh	Not affected	Not affected	Not affected	Not affected	Not affected
openssh-ssh1	Not affected	Not affected	Not affected	Not affected	—

Export to JSON

Results by page:

Search CVE reports