OpenSSL vulnerabilities

An error in the implementation of an additional security check in OpenSSL (the X509_V_FLAG_X509_STRICT flag) causes the result of a previous check confirming valid CA certificates in the chain to be overwritten. This effectively bypasses the check that non-CA certificates must not be able to issue other certificates. OpenSSL versions 1.1.1h through 1.1.1j are affected.

An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. If a TLSv1.2 renegotiation ClientHello omits the signature_algorithms extension but includes a signature_algorithms_cert extension, a NULL pointer dereference will result, leading to a crash and denial of service. All OpenSSL 1.1.1 versions are affected; fixed in 1.1.1k.

Server or client applications that call the SSL_check_chain() function during or after a TLS 1.3 handshake may crash due to a NULL pointer dereference. This results from incorrect handling of the "signature_algorithms_cert" TLS extension — the crash occurs if an invalid or unrecognised signature algorithm is received from the peer.

There is an overflow bug in the x64_64 Montgomery squaring procedure used in exponentiation with 512-bit moduli. No EC algorithms are affected. Attacks against DH512 are considered just feasible. Fixed in OpenSSL 1.1.1e and 1.0.2u.

OpenSSL allows a nonce (IV) longer than 12 bytes for the ChaCha20-Poly1305 cipher, with any leading excess bytes being ignored. If an application changes the nonce length to more than 12 bytes and modifies the leading bytes expecting a new unique value, it may inadvertently reuse a nonce, leading to serious confidentiality and integrity attacks. OpenSSL 1.1.1-1.1.1b and 1.1.0-1.1.0j are affected; internal use in SSL/TLS is safe.

The OpenSSL DSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing algorithm to recover the private key. Fixed in OpenSSL 1.1.1a, 1.1.0j, and 1.0.2q.

The OpenSSL ECDSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing algorithm to recover the private key. Affected versions are 1.1.0-1.1.0i and 1.1.1. Fixed in OpenSSL 1.1.0j and 1.1.1a.

During key agreement in a TLS handshake using a DH(E) based ciphersuite, a malicious server can send a very large prime value to the client. This causes the client to spend an unreasonably long period of time generating a key for this prime, resulting in a hang until the client has finished.

The OpenSSL RSA key generation algorithm is vulnerable to a cache timing side channel attack. An attacker with sufficient access to mount cache timing attacks during the RSA key generation process could recover the private key. Affected versions are 1.1.0-1.1.0h and 1.0.2b-1.0.2o.

The statem/statem.c file in OpenSSL 1.1.0a does not consider memory-block movement after a realloc call, allowing remote attackers to cause a denial of service (use-after-free) or possibly execute arbitrary code via a crafted TLS session.

Integer overflow in the MDC2_Update function in OpenSSL before version 1.1.0 may allow remote attackers to cause a denial of service through out-of-bounds write, leading to application crash.

The BN_bn2dec function in OpenSSL before 1.1.0 does not properly validate division results, which may lead to application crashes or denial of service.

OpenSSL through 1.0.2h incorrectly uses pointer arithmetic for heap-buffer boundary checks, which might allow remote attackers to cause a denial of service (integer overflow and application crash) or possibly have unspecified other impact.

The ASN.1 implementation in OpenSSL before 1.0.1o and 1.0.2 before 1.0.2c allows remote attackers to execute arbitrary code or cause a denial of service (buffer underflow and memory corruption) via an ANY field in crafted serialized data, aka the 'negative zero' issue.

The doapr_outch function in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g does not verify that a certain memory allocation succeeds, allowing remote attackers to cause a denial of service (out-of-bounds write or memory consumption) or possibly have unspecified other impact via a long string.

The fmtstr function in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g improperly calculates string lengths, which can lead to denial of service (overflow and out-of-bounds read) due to a long string.

A double free vulnerability in the dsa_priv_decode function in OpenSSL before version 1.0.1s and 1.0.2 before version 1.0.2g allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a malformed DSA private key.

The ssl3_get_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k allows remote SSL servers to conduct RSA-to-EXPORT_RSA downgrade attacks and facilitate brute-force decryption by offering a weak ephemeral RSA key in a noncompliant role, related to the "FREAK" issue. NOTE: the scope of this CVE is only client code based on OpenSSL, not EXPORT_RSA issues associated with servers or other TLS implementations.

A flaw was found in OpenSSL. When configured to use an RSA key with exponent 3, OpenSSL improperly removes PKCS-1 padding before generating a hash. This allows remote attackers to forge PKCS #1 v1.5 signatures. Consequently, OpenSSL may incorrectly verify X.509 and other certificates, leading to a bypass of trust and authentication mechanisms.

A malicious remote peer can flood the local QUIC stack with NEW_CONNECTION_ID frames by bypassing a limit on connection IDs. This causes RETIRE_CONN_ID frames to be sent and, with withheld ACKs, can allocate about 400 MB of memory.

OpenSSL 4.0 contains a use-after-free vulnerability (CWE-416) in the caching of X.509 certificate extensions. When several threads concurrently use the same certificate for the first time, one thread may free the cached extension data while another thread is still using it. This can crash the process, resulting in a Denial of Service.

The DTLS retransmission logic incorrectly handles a handshake message write that is suspended part-way through. The retransmitted message can be read past the message buffer, disclosing heap memory or causing a crash and Denial of Service.

SM2 signature generation uses non-constant-time arithmetic on secret values, forming a timing side-channel. An attacker able to measure SM2 signing times may learn information about the per-signature secret nonce, which over many signatures can lead to recovery of the private key. Applications performing SM2 signature generation are affected on all platforms.

An established DTLS 1.2 association using an AEAD cipher suite can be terminated by a single unauthenticated datagram whose encrypted fragment is shorter than the mandatory explicit IV and authentication tag overhead. The record layer passes the record length to the cipher before checking it is long enough, causing an internal error instead of treating the record as failed authentication.

A NULL pointer dereference vulnerability in the OpenSSL CMP client. When a client requests certificate revocation based on a PKCS#10 CSR and the server returns a specially crafted certificate name in its response, the client reads from a NULL pointer and crashes. Only clients that identify the certificate via CSR (e.g. 'openssl cmp -cmd rr -csr' or OSSL_CMP_exec_RR_ses() with OSSL_CMP_CTX_set1_p10CSR()) are affected.

The OpenSSL QUIC stack does not enforce connection-level flow control for streams. A malicious remote peer can send more bytes as long as they fit within stream flow control limits, leading to excessive memory allocation.

A TLS server that calls SSL_set_SSL_CTX() to switch a connection to a different SSL_CTX part way through a handshake may access memory beyond the end of an internal array if the replacement context knows about more provider signature algorithms than the context the connection was created from. A remote peer may be able to cause a small out-of-bounds read, and in some circumstances a fixed-value out-of-bounds write, on the server heap, potentially leading to a Denial of Service.

OpenSSL's optimized scalar point multiplication implementation for SM2 private key operations on ARM64 and RISC-V platforms is not constant-time. Conditional branches and table lookups depend on the bits of the secret scalar, so execution time and cache-access patterns leak information about the private key or signature nonce.

A vulnerability in the QUIC implementation in OpenSSL allows a remote attacker to keep allocated packet buffer memory for an extended period by sending specially crafted packets. The issue stems from missing resource allocation limits (CWE-770), potentially leading to excessive memory consumption.

The generic elliptic-curve scalar multiplication used for ECDSA and SM2 signature operations with curves lacking a dedicated implementation leaks information about the secret nonce through timing. An attacker measuring signing times may learn the nonce, which over many signatures can lead to private key recovery.

The QUIC stream reassembly algorithm in OpenSSL degrades progressively as packets arrive out of order, with worst-case quadratic complexity. A remote QUIC peer that completes the handshake can cause CPU pressure and potential DoS with low bandwidth.

The OpenSSL QUIC server, when address validation is disabled, can count incoming datagrams multiple times in its unvalidated credit computation. This violates the RFC 9000 3x amplification limit, allowing a remote attacker to use the server for DDoS amplification.

A certificate with many nameRelativeToCRLIssuer CRL distribution points causes disproportionate heap growth when OpenSSL caches X.509 extensions. Receiving a crafted certificate from a malicious peer can lead to significant memory pressure and possible Denial of Service.

The vulnerability in OpenSSL concerns the verification of password-based protection in the CMP protocol. The library only checks whether the protectionAlg parameter is not NULL, but does not verify its ASN.1 type, leading to dereferencing an invalid pointer. A remote, unauthenticated attacker can exploit this flaw to cause an application crash (Denial of Service).

A vulnerability in OpenSSL's QUIC implementation allows a remote attacker who completes a QUIC handshake to force uncontrolled connection-scoped memory growth. The QUIC stack stores metadata for ACK-only packets even though the protocol does not require them to be acknowledged. Sustained traffic or many concurrent connections can lead to memory exhaustion and denial of service (DoS).

The OpenSSL Certificate Management Protocol (CMP) caches additional certificates (extraCerts) sent in a CMP message, but never expunges them. If a server reuses an OSSL_CMP_CTX frequently, this cache may grow unboundedly, and a malicious client may flood a CMP server with requests driving this growth, leading to OOM conditions.

The vulnerability in OpenSSL affects the CMS_decrypt() function and involves incorrect sizing of the output buffer during key unwrap operations. An attacker can supply a crafted CMS message that causes an 8-byte out-of-bounds heap write, leading to heap corruption and typically resulting in a Denial of Service.

The vulnerability in OpenSSL concerns buffering of DTLS records for a future epoch during a handshake. An attacker can send small forged records, causing an endpoint to retain about 1.7 MB of memory per connection, resulting in a memory amplification factor of about 1200. This can lead to remote memory exhaustion (Denial of Service) on DTLS servers.

Double free of the QRX object in OpenSSL QUIC server stack during failed channel creation for an INITIAL packet. The bug leads to heap corruption and typically results in termination of the QUIC server process (Denial of Service).

In a server or client configuration with RFC7250 Raw Public Keys (RPKs) enabled and only the private key (with no associated certificate) configured locally, a NULL pointer dereference may occur when the remote peer solicits raw public keys and also sends the typically omitted "signature_algorithms_cert" TLS extension. The impact is limited to a possible Denial of Service as a result of an application abort, no data disclosure or remote command execution are possible.

A vulnerability in OpenSSL's QUIC server implementation allows a remote attacker to cause unbounded memory allocation by sending Initial packets with unknown connection IDs. The lack of a limit on pending connections can lead to memory exhaustion and denial of service (DoS). The issue is present since OpenSSL 3.5.

A malicious TLS server can cause a memory leak in a TLS client that has enabled OCSP response checking by sending an OCSP response with no single response entries. An attacker can leak a tunable amount of memory per TLS handshake, potentially leading to memory exhaustion and denial of service in long-running clients.

A vulnerability in OpenSSL during CMS password-based decryption (RFC 3211) allows an attacker to trigger a heap out-of-bounds read. The attacker can select a stream-mode cipher as the KEK, bypassing guards and causing a read beyond the allocated buffer.

A signed integer overflow in ASN1_mbstring_ncopy() when sizing the destination buffer for Unicode output can lead to a heap buffer overflow. This may allow attacker-controlled code execution or a crash.

Use-after-free vulnerability in OpenSSL during PKCS#7 or S/MIME signature verification. A specially crafted message can cause incorrect freeing of a BIO object, leading to process crashes, heap corruption, or potentially remote code execution.

The implementations of AES-SIV and AES-GCM-SIV in OpenSSL mishandle authentication of AAD with empty ciphertext, allowing forgery of such messages. An attacker can send arbitrary AAD with empty ciphertext and a zero tag, which will be accepted as valid.

A vulnerability in OpenSSL causes the supplied IV to be silently discarded when using the EVP_Cipher() one-shot interface for AES-OCB. Every message encrypted with the same key uses the same effective nonce, leading to loss of confidentiality and enabling authentication tag forgery.

OpenSSL has an out-of-bounds read vulnerability in X509_VERIFY_PARAM_set1_email when validating a crafted email address, e.g., in S/MIME verification. An internal helper function fails to enforce the 64-octet limit on the local part, leading to out-of-bounds read and potential crash.

The vulnerability in OpenSSL affects the EVP_PKEY_derive_set_peer() function when using a DHX (X9.42) peer key. A malicious peer can exploit the lack of proper subgroup membership check, leading to the recovery of the victim's private key after a few key exchange attempts.

A typo in the certificate chain building code for processing 'id-it-rootCaKeyUpdate' CMP messages caused an incorrect certificate to be added to the chain, rendering certificate verification ineffective. This could allow an attacker with RA-level credentials to escalate privileges to root CA level.