OpenSSL.

NULL dereference in SSL_CIPHER_find() function on unknown cipher ID

• OpenSSL
• Memory corruption

Stack buffer overflow in CMS (Auth)EnvelopedData parsing

• OpenSSL
• Memory corruption

Improper validation of PBMAC1 parameters in PKCS#12 MAC verification

• OpenSSL
• Memory corruption

Out-of-bounds read in HTTP client no_proxy handling

• OpenSSL
• Memory corruption

Timing side-channel in SM2 algorithm on 64 bit ARM

• OpenSSL
• CWE-385

Out-of-bounds read & write in RFC 3211 KEK Unwrap

• OpenSSL
• Memory corruption

The x509 application adds trusted use instead of rejected use

• OpenSSL
• Weak cryptography or TLS

Timing side-channel in ECDSA signature computation

• OpenSSL
• CWE-385

Use After Free with SSL_free_buffers

• OpenSSL
• Memory corruption

Low-level invalid GF(2^m) parameters lead to OOB memory access

• OpenSSL
• Memory corruption

Possible denial of service in X.509 name checks

• OpenSSL
• Memory corruption

SSL_select_next_proto buffer overread

• OpenSSL
• Memory corruption

Excessive time spent checking DSA keys and parameters

• OpenSSL
• Denial of service
• CWE-606

Excessive time spent checking invalid RSA public keys

• OpenSSL
• CWE-606

Unbounded memory growth with session handling in TLSv1.3

• OpenSSL
• CWE-1325

POLY1305 MAC implementation corrupts vector registers on PowerPC

• OpenSSL
• CWE-440

Excessive time spent in DH check / generation with large Q parameter value

• OpenSSL
• CWE-606

Incorrect cipher key & IV length processing

• OpenSSL
• CWE-684

POLY1305 MAC implementation corrupts XMM registers on Windows

• OpenSSL
• CWE-440

Excessive time spent checking DH q parameter value

• OpenSSL
• CWE-606

Excessive time spent checking DH keys and parameters

• OpenSSL
• CWE-606

AES-SIV implementation ignores empty associated data entries

• OpenSSL
• CWE-354

Possible DoS translating ASN.1 object identifiers

• OpenSSL
• Denial of service

Input buffer over-read in AES-XTS implementation on 64 bit ARM

• OpenSSL
• Memory corruption

Certificate policy check not enabled

• OpenSSL

Invalid certificate policies in leaf certificates are silently ignored

• OpenSSL
• Weak cryptography or TLS

Excessive Resource Usage Verifying X.509 Policy Constraints

• OpenSSL
• Weak cryptography or TLS

The c_rehash script allows command injection

• OpenSSL
• Command injection

The c_rehash script allows command injection

• OpenSSL
• Command injection

BN_mod_exp may produce incorrect results on MIPS

• OpenSSL

Incorrect SSLv2 rollback protection

• OpenSSL

EDIPARTYNAME NULL pointer dereference

• OpenSSL
• Memory corruption

Raccoon attack

• OpenSSL
• Information disclosure

rsaz_512_sqr overflow bug on x86_64

• OpenSSL

Padding Oracle in PKCS7_dataDecode and CMS_decrypt_set1_pkey

• OpenSSL

Fork Protection

• OpenSSL

ECDSA remote timing attack

• OpenSSL

Windows builds with insecure path defaults

• OpenSSL

ChaCha20-Poly1305 with long nonces

• OpenSSL

0-byte record padding oracle

• OpenSSL

Timing attack against DSA

• OpenSSL

Timing attack against ECDSA signature generation

• OpenSSL

openssl: A timing attack flaw was found in OpenSSL 1.0.1u and before that could allow a malicious…

• openssl
• CWE-385

Client DoS due to large DH parameter

• OpenSSL

Cache timing vulnerability in RSA Key Generation

• OpenSSL

Constructed ASN.1 types with a recursive definition could exceed the stack

• OpenSSL

Incorrect CRYPTO_memcmp on HP-UX PA-RISC

• OpenSSL

OpenSSL: There is an overflow bug in the AVX2 Montgomery multiplication procedure used in…

• OpenSSL

OpenSSL 1.0.2 (starting from version 1.0.2b) introduced an "error state" mechanism.

• OpenSSL

Uncontrolled resource consumption in OpenSSL

• OpenSSL
• Denial of service

OpenSSL: There is a carry propagating bug in the x86_64 Montgomery squaring procedure in OpenSSL…

• OpenSSL

OpenSSL: While parsing an IPAddressFamily extension in an X.509 certificate…

• OpenSSL

Encrypt-Then-Mac renegotiation crash

• OpenSSL

BN_mod_exp may produce incorrect results on x86_64

• OpenSSL

Truncated packet could crash via OOB read

• OpenSSL

Bad (EC)DHE parameters cause a client crash

• OpenSSL

ChaCha20/Poly1305 heap-buffer-overflow

• OpenSSL

CMS Null dereference

• OpenSSL