Catalog
Findings
Filter the merged record by severity, source, stack, and weakness type.
- High7.4There is a type confusion vulnerability relating to X.400 address processing inside an X.509 GeneralName.EPSS 71.2%Feb 8, 2023
- High7.5The public API function BIO_new_NDEF is a helper function used for streaming ASN.1 data via a BIO.EPSS 5.0%Feb 8, 2023
- High7.5The function PEM_read_bio_ex() reads a PEM file from a BIO and parses and decodes the "name" (e.g.EPSS 28.6%Feb 8, 2023
- Medium5.9A timing based side channel exists in the OpenSSL RSA Decryption implementation which could be sufficient to recover a plaintext across a network in a Bleichenbacher style attack.EPSS 23.5%Feb 8, 2023
- Medium5.3AES OCB mode for 32-bit x86 platforms using the AES-NI assembly optimised implementation will not encrypt the entirety of the data under some circumstances.EPSS 4.9%Jul 5, 2022
- Critical9.8The OpenSSL 3.0.4 release introduced a serious bug in the RSA implementation for X86_64 CPUs supporting the AVX512IFMA instructions.EPSS 48.2%Jul 1, 2022
- High7.3In addition to the c_rehash shell command injection identified in CVE-2022-1292, further circumstances where the c_rehash script does not properly sanitise shell metac…EPSS 96.4%Jun 21, 2022
- High7.5The OPENSSL_LH_flush() function, which empties a hash table, contains a bug that breaks reuse of the memory occuppied by the removed hash table entries.EPSS 4.6%May 3, 2022
- Medium5.9The OpenSSL 3.0 implementation of the RC4-MD5 ciphersuite incorrectly uses the AAD data as the MAC key.EPSS 1.2%May 3, 2022
- Medium5.3The function verifies the signer certificate on an OCSP response.EPSS 2.1%May 3, 2022
- High7.5The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli.EPSS 73.2%Mar 15, 2022
- Medium5.9The OpenSSL RSA Key generation algorithm has been shown to be vulnerable to a cache timing side channel attack.Apr 16, 2018
- Medium4.3The ssl3_get_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k allows remote SSL servers to conduct RSA-to-EXPORT_RSA downgEPSS 98.7%Jan 9, 2015
- High7.5OpenSSL Information Disclosure VulnerabilityKEVEPSS 100.0%Apr 7, 2014
39 records · page 2 of 2
PreviousNext