OpenSSL vulnerabilities

A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL protocol defined processing of ALERT packets during a connection handshake. A remote attacker could use this flaw to make a TLS/SSL server consume an excessive amount of CPU and fail to accept connections from other clients.

CVE-2017-3731 affects SSL/TLS servers and clients running on 32-bit hosts that may crash due to an out-of-bounds read caused by a truncated packet. For OpenSSL 1.1.0, the crash can be triggered using the CHACHA20/POLY1305 cipher, and for OpenSSL 1.0.2 using RC4-MD5.

In OpenSSL 1.1.0 before 1.1.0d, a malicious server can supply bad parameters for a DHE or ECDHE key exchange, leading to the client attempting to dereference a NULL pointer, resulting in a client crash.

In OpenSSL 1.1.0 before 1.1.0c, TLS connections using *-CHACHA20-POLY1305 ciphersuites are susceptible to a DoS attack by corrupting larger payloads. This can result in an OpenSSL crash.

OpenSSL 1.0.2i has a vulnerability that allows remote attackers to cause application crashes by triggering a CRL operation, leading to a NULL pointer dereference.

The ssl3_read_bytes function in OpenSSL 1.1.0 before version 1.1.0a allows remote attackers to cause a denial of service (infinite loop) by triggering a zero-length record in an SSL_peek call.

Multiple memory leaks in t1_lib.c in OpenSSL before 1.0.1u, 1.0.2 before 1.0.2i, and 1.1.0 before 1.1.0a allow remote attackers to cause a denial of service (memory consumption) via large OCSP Status Request extensions.

The tls_decrypt_ticket function in OpenSSL before 1.1.0 does not consider the HMAC size during validation of the ticket length, allowing remote attackers to cause a denial of service via a ticket that is too short.

The DTLS implementation in OpenSSL before 1.1.0 does not properly restrict the lifetime of queue entries associated with unused out-of-order messages. This allows remote attackers to cause a denial of service (memory consumption) by maintaining many crafted DTLS sessions simultaneously.

The X509_NAME_oneline function in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h allows remote attackers to obtain sensitive information from process stack memory or cause a denial of service (buffer over-read) via crafted EBCDIC ASN.1 data.

The asn1_d2i_read_bio function in the ASN.1 BIO implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h allows remote attackers to cause a denial of service (memory consumption) via a short invalid encoding.

Integer overflow in the EVP_EncryptUpdate function in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h allows remote attackers to cause a denial of service (heap memory corruption) via a large amount of data.

Integer overflow in the EVP_EncodeUpdate function in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h can lead to denial of service due to heap memory corruption when processing a large amount of binary data.

OpenSSL before version 0.9.6 has a flaw in handling C bitwise-shift operations that can lead to improper RSA key generation on 64-bit HP-UX platforms. This makes it easier for remote attackers to defeat cryptographic protection mechanisms.

A memory leak in the SRP_VBASE_get_by_user implementation in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g allows remote attackers to cause a denial of service (memory consumption) by providing an invalid username in a connection attempt.

Multiple integer overflows in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g can lead to denial of service through heap memory corruption or NULL pointer dereference. Attackers can exploit long digit strings mishandled by the BN_dec2bn or BN_hex2bn functions.

In OpenSSL 1.0.1 before 1.0.1q and 1.0.2 before 1.0.2e, a vulnerability allows remote attackers to cause a denial of service via an RSA PSS ASN.1 signature that lacks a mask generation function parameter.

The X509_cmp_time function in OpenSSL before versions 0.9.8zg, 1.0.0 before 1.0.0s, 1.0.1 before 1.0.1n, and 1.0.2 before 1.0.2b allows remote attackers to cause a denial of service via a crafted length field in ASN1_TIME data, leading to out-of-bounds read and application crash.

The dtls1_clear_queues function in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h frees data structures without considering that application data can arrive between a ChangeCipherSpec message and a Finished message. This allows remote DTLS peers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via unexpected application data.

An integer underflow in the EVP_DecodeUpdate function in OpenSSL allows remote attackers to cause memory corruption or denial of service via crafted base64 data that triggers a buffer overflow.

A memory leak in the tls_decrypt_ticket function in OpenSSL before 0.9.8zc, 1.0.0 before 1.0.0o, and 1.0.1 before 1.0.1j allows remote attackers to cause a denial of service via a crafted session ticket that triggers an integrity-check failure.

A memory leak in OpenSSL 1.0.1 before 1.0.1j in the DTLS SRTP extension allows remote attackers to cause a denial of service through a crafted handshake message.

OpenSSL versions before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h do not properly restrict processing of ChangeCipherSpec messages. This allows man-in-the-middle attackers to trigger the use of a zero-length master key in certain OpenSSL-to-OpenSSL communications, potentially hijacking sessions or obtaining sensitive information.

Clients using RFC7250 Raw Public Keys (RPKs) to authenticate a server may fail to notice that the server was not authenticated, because handshakes don't abort as expected when the SSL_VERIFY_PEER verification mode is set. Impact: TLS and DTLS connections using raw public keys...

If an application using the `SSL_CIPHER_find()` function in a QUIC protocol client or server receives an unknown cipher suite from the peer, a NULL dereference occurs. This leads to abnormal termination of the running process, causing Denial of Service (DoS).

Checking excessively long DSA keys or parameters may be very slow. Applications using EVP_PKEY_param_check() or EVP_PKEY_public_check() to verify DSA public keys or parameters may experience long delays.

A vulnerability in the assembly implementation of an internal cryptographic function on the ppc64le architecture leaks a few bits of secret scalars due to the use of a variable-time instruction. Based on how this function is used, the leakage is not sufficient to recover the private key.

A timing side-channel in ECDSA signature computations could potentially allow recovering the private key by an attacker. Measuring timing could lead to private key recovery.

A certificate with a URI containing an IPv6 address with a zone ID may incorrectly satisfy a URI name constraint in the certificate chain. This vulnerability only affects private PKIs using URIs, as certificates with URIs are not allowed in the public web PKI.

The vulnerability affects ChaCha20-Poly1305 and AES-OCB decryption with an empty ciphertext, which can report success without verifying the supplied authentication tag when the operation is finalized by calling the EVP_Cipher() function. Applications calling EVP_Cipher() on an empty ciphertext and expecting the call to check the AEAD tag may accept forged messages.

A vulnerability in OpenSSL CMP response validation passes an unexpected response sender distinguished name directly as a format string to ERR_raise_data(). An attacker can craft a sender DN with percent characters, causing a crash of the CMP client. This occurs when the client enforces an expected sender or uses a pinned server certificate.

The vulnerability in OpenSSL involves improper processing of AuthEnvelopedData containers in CMS, where insufficient validation of cipher and tag length fields allows an attacker to replace the cipher with an unauthenticated one (e.g., AES-256-OFB) or reduce the tag length to a single byte. This can lead to key-equivalent functionality for a chosen recipient and bypass of message integrity.

Converting an excessively large OCTET STRING value to a hexadecimal string leads to a heap buffer overflow on 32-bit platforms. This may cause a crash or potentially allow attacker-controlled code execution.

A vulnerability in OpenSSL when parsing CMS AuthEnvelopedData or EnvelopedData messages with maliciously crafted AEAD parameters can cause a stack buffer overflow. An attacker can supply a crafted CMS message with an oversized IV, leading to an out-of-bounds write before authentication verification.

Use of the low-level GF(2^m) elliptic curve APIs with untrusted explicit values for the field polynomial can lead to out-of-bounds memory reads or writes. This can cause an application crash or potentially remote code execution, though the likelihood of a vulnerable application is low because most protocols use only "named curves" or X9.62 encoding that cannot represent problematic values. The FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected.

A vulnerability in OpenSSL affects the SSL_select_next_proto function, which when called with an empty client protocol list (client_len of 0) may cause a buffer overread. This can lead to an application crash or up to 255 bytes of arbitrary memory data being sent to the peer, resulting in a loss of confidentiality. Only applications that directly call this function with a zero-length client protocol list are affected, which is typically due to a configuration or programming error.

Issue summary: Some non-default TLS server configurations can cause unbounded memory growth when processing TLSv1.3 sessions. Impact summary: An attacker may exploit certain server configurations to trigger unbounded memory growth that would lead to a Denial of Service. This problem can occur in TLSv1.3 if the non-default SSL_OP_NO_TICKET option is being used (but not if early_data support is also configured and the default anti-replay protection is in use). In this case, under certain conditions, the session cache can get into an incorrect state and it will fail to flush properly as it fills. The session cache will continue to grow in an unbounded manner. A malicious client could deliberately create the scenario for this failure to force a Denial of Service. It may also happen by accident in normal operation. This issue only affects TLS servers supporting TLSv1.3. It does not affect TLS clients. The FIPS modules in 3.2, 3.1 and 3.0 are not affected by this issue. OpenSSL 1.0.2 is also not affected by this issue.

A vulnerability in OpenSSL involves generating or checking excessively long X9.42 DH keys, which may cause very long delays. The DH_generate_key() and DH_check_pub_key() functions do not properly check for excessively large P and Q parameters, which can lead to a Denial of Service when data comes from an untrusted source.

A vulnerability in OpenSSL involves processing specially crafted ASN.1 object identifiers (OBJECT IDENTIFIERs) containing very large sub-identifiers. The OBJ_obj2txt() function converts such data to text with O(n^2) time complexity, causing significant delays and potentially leading to a Denial of Service. This affects applications calling OBJ_obj2txt() directly, and in OpenSSL 3.0+ the OCSP, PKCS7/SMIME, CMS, CMP/CRMF, and TS subsystems, as well as anything processing X.509 certificates.

A security vulnerability has been identified in all supported versions of OpenSSL related to the verification of X.509 certificate chains that include policy constraints. Attackers may be able to exploit this vulnerability by creating a malicious certificate chain that triggers exponential use of computational resources, leading to a denial-of-service (DoS) attack on affected systems. Policy processing is disabled by default but can be enabled by passing the `-policy' argument to the command line utilities or by calling the `X509_VERIFY_PARAM_set1_policies()' function.

There is a type confusion vulnerability in OpenSSL relating to X.400 address processing inside an X.509 GeneralName. X.400 addresses are parsed as an ASN1_STRING, but the public structure definition for GENERAL_NAME incorrectly specifies the x400Address field as ASN1_TYPE, which is then interpreted by GENERAL_NAME_cmp as an ASN1_TYPE rather than an ASN1_STRING. When CRL checking is enabled (X509_V_FLAG_CRL_CHECK), an attacker may pass arbitrary pointers to a memcmp call, enabling memory reads or denial of service.

A use-after-free vulnerability in the BIO_new_NDEF function of OpenSSL. When an error occurs (e.g., an invalid CMS recipient public key), the BIO chain is not properly cleaned up, and a subsequent BIO_pop() call leads to use-after-free. This affects SMIME, CMS, and PKCS7 functions as well as the cms and smime command-line applications.

A vulnerability in OpenSSL's PEM_read_bio_ex() function allows a double free when parsing specially crafted PEM files with zero payload data. This can lead to a crash and be exploited for denial of service.

A timing based side channel exists in the OpenSSL RSA Decryption implementation which could be sufficient to recover a plaintext across a network in a Bleichenbacher style attack. To achieve a successful decryption an attacker would have to be able to send a very large number of trial messages for decryption. The vulnerability affects all RSA padding modes: PKCS#1 v1.5, RSA-OEAP and RSASVE.

AES OCB mode for 32-bit x86 platforms using the AES-NI assembly optimised implementation will not encrypt the entirety of the data under some circumstances. This could reveal sixteen bytes of data that was preexisting in the memory that wasn't written. In the special case of "in place" encryption, sixteen bytes of the plaintext would be revealed. Since OpenSSL does not support OCB based cipher suites for TLS and DTLS, they are both unaffected. Fixed in OpenSSL 3.0.5 (Affected 3.0.0-3.0.4). Fixed in OpenSSL 1.1.1q (Affected 1.1.1-1.1.1p).

The OpenSSL 3.0.4 release introduced a serious bug in the RSA implementation for X86_64 CPUs supporting the AVX512IFMA instructions. This issue makes the RSA implementation with 2048 bit private keys incorrect on such machines and memory corruption will happen during the computation. As a consequence of the memory corruption an attacker may be able to trigger a remote code execution on the machine performing the computation.

The c_rehash script does not properly sanitize shell metacharacters, allowing command injection. This vulnerability is an extension of CVE-2022-1292 and affects additional places in the script where certificate filenames are passed to commands executed through the shell. The script is automatically executed on some operating systems, allowing an attacker to execute arbitrary commands with the script's privileges.

The c_rehash script does not properly sanitize shell metacharacters, allowing command injection. The script is distributed by some operating systems in a manner where it is automatically executed. On such systems, an attacker can execute arbitrary commands with the script's privileges.

The BN_mod_sqrt() function in OpenSSL contains a bug causing an infinite loop for non-prime moduli. A crafted certificate with invalid elliptic curve parameters can trigger a denial of service (DoS) attack. Affected versions include OpenSSL 1.0.2, 1.1.1, and 3.0.

A bug in the SM2 decryption implementation in OpenSSL causes the first call to EVP_PKEY_decrypt() to return a buffer size smaller than actually required, leading to a buffer overflow of up to 62 bytes on the second call. An attacker can exploit this to alter data or cause application crashes.