OpenSSL vulnerabilities

The CMS_decrypt and PKCS7_decrypt functions in OpenSSL are vulnerable to a Bleichenbacher-style attack when an attacker can provide CMS or S/MIME messages and observe the error code or decryption output. This allows the attacker to use the victim's application to decrypt or sign messages with the victim's private RSA key.

OpenSSL has a NULL pointer dereference vulnerability in the CMP client. An attacker controlling a CMP server (or acting as man-in-the-middle) can craft a CMP response containing a CRMF CertRepMessage with an EncryptedValue where the symmAlg field has an algorithm OID but no parameters. Processing this response causes a NULL dereference and crash (DoS). FIPS modules are not affected.

OpenSSL before a fixed version has a NULL pointer dereference vulnerability during password-based CMS decryption. A specially crafted CMS message can cause an application crash and Denial of Service.

OpenSSL has a NULL pointer dereference vulnerability when OCSP response checking for the whole chain (X509_V_FLAG_OCSP_RESP_CHECK_ALL) and partial chain verification (X509_V_FLAG_PARTIAL_CHAIN) are enabled. If the chain lacks a self-signed trusted anchor, a NULL dereference crashes the process.

Vulnerability in OpenSSL QUIC server. Receiving a QUIC initial packet with an invalid token may trigger a NULL pointer dereference when address validation is disabled, causing abnormal termination of the QUIC server process and denial of service. By default, address validation is enabled, so the default configuration is not vulnerable.

OpenSSL is vulnerable to a double-free in the client certificate verification path when OCSP stapling is used. A malicious server can trigger heap memory corruption via a crafted OCSP response.

A remote peer can exhaust heap memory of a QUIC server or client by flooding it with packets containing PATH_CHALLENGE frames. The local QUIC stack allocates a PATH_RESPONSE frame for each PATH_CHALLENGE, freed only upon acknowledgment by the remote peer – a malicious peer does not acknowledge, leading to unbounded memory allocation and denial of service. FIPS modules are not affected.

PKCS#12 file processing in OpenSSL fails to validate files using PBMAC1 integrity mechanism, allowing certificate and private key forgery. An attacker impersonating a user can cause a service to accept forged certificates with a 1 in 256 probability.

A heap buffer over-read vulnerability in OpenSSL's ASN.1 decoder occurs when parsing crafted DER structures with primitive elements exceeding 2 GB. Affects 64-bit Unix and Unix-like platforms.

Vulnerability in OpenSSL related to RSASVE, where a failed RSA encryption may return success, leaving an uninitialized buffer. An attacker can exploit this to leak sensitive data from previous process operations.

Vulnerability in OpenSSL when processing a crafted CMS EnvelopedData message with KeyTransportRecipientInfo. Missing check for the optional parameters field in RSA-OAEP leads to a NULL pointer dereference and crash.

Vulnerability in OpenSSL when processing a crafted CMS EnvelopedData message with KeyAgreeRecipientInfo. Missing check for the optional parameters field in KeyEncryptionAlgorithmIdentifier leads to a NULL pointer dereference and crash.

Vulnerability in OpenSSL when processing a delta CRL with a Delta CRL Indicator extension. Missing check for the CRL Number extension leads to a NULL pointer dereference, potentially causing an application crash.

In an uncommon client configuration using DANE TLSA-based server authentication, combined with unusual server TLSA records, a use-after-free and/or double-free may occur on the client side. The vulnerability only affects clients that support TLSA records with both PKIX-TA(0)/PKIX-EE(1) and DANE-TA(2) certificate usages. SMTP clients compliant with RFC7672 are not vulnerable.

Out-of-bounds read in OpenSSL when using AES-CFB128 on systems with AVX-512 and VAES. May cause application crash (DoS) under specific conditions.

A high-privileged remote attacker can influence parameters passed to the openssl command due to improper neutralization of special elements when adding a password-protected self-signed certificate.

An out-of-bounds read vulnerability in the OpenSSL HTTP client occurs when the 'no_proxy' environment variable is set and the host in the URL is an IPv6 address. This can cause a crash leading to Denial of Service (DoS).

A timing side-channel vulnerability in the SM2 algorithm implementation on 64-bit ARM platforms could allow remote recovery of the private key. This issue does not affect standard TLS configurations in OpenSSL but may be exploited in custom setups using SM2 certificates.

A vulnerability in OpenSSL when decrypting CMS messages using password-based encryption (PWRI) can cause an out-of-bounds read and write. This flaw exists in the CMS implementation, which rarely uses password-based encryption.

A flaw was found in OpenSSL's handling of the properties argument in certain functions. This vulnerability can allow use-after-free exploitation, which may result in undefined behavior or incorrect property parsing, leading to OpenSSL treating the input as an empty string.

Checking excessively long invalid RSA public keys may take a long time. Applications that use the function EVP_PKEY_public_check() to check RSA public keys may experience long delays. Where the key that is being checked has been obtained from an untrusted source this may lead to a Denial of Service.

Processing a maliciously formatted PKCS12 file may lead OpenSSL to crash leading to a potential Denial of Service attack. Applications loading files in the PKCS12 format from untrusted sources might terminate abruptly due to a NULL pointer dereference.

The POLY1305 MAC implementation in OpenSSL on PowerPC CPUs restores vector register contents in a different order than they were saved, corrupting their contents. The vulnerable code is used only on newer PowerPC processors supporting PowerISA 2.07 instructions. POLY1305 is most commonly used as part of the CHACHA20-POLY1305 AEAD cipher, typically in TLS 1.2 and 1.3.

The POLY1305 MAC implementation in OpenSSL on Windows 64-bit fails to save non-volatile XMM registers when computing the MAC for data larger than 64 bytes on newer x86_64 processors supporting AVX512-IFMA instructions. The registers are zeroed instead of restored, potentially corrupting the application's internal state. The vulnerability only affects Windows 64-bit on newer processors with AVX512-IFMA.

The X509_VERIFY_PARAM_add0_policy() function in OpenSSL is documented to implicitly enable certificate policy checking, but the implementation does not. Certificates with invalid or incorrect policies can therefore pass verification.

Applications using a non-default option when verifying certificates may be vulnerable to an attack from a malicious CA. Invalid certificate policies in leaf certificates are silently ignored, allowing a malicious CA to circumvent policy checking.

The OPENSSL_LH_flush() function in OpenSSL, which empties a hash table, contains a bug that breaks reuse of the memory occupied by removed hash table entries. This function is used when decoding certificates or keys. If a long-lived process periodically decodes certificates or keys, its memory usage will expand without bounds and the process might be terminated by the operating system, causing a denial of service. Also, traversing the empty hash table entries will take increasingly more time. The issue affects OpenSSL 3.0.0, 3.0.1, and 3.0.2; it is fixed in 3.0.3.

The OpenSSL 3.0 implementation of the RC4-MD5 ciphersuite incorrectly uses AAD data as the MAC key, making the MAC key trivially predictable. An attacker performing a man-in-the-middle attack could modify data sent from one endpoint to an OpenSSL 3.0 recipient such that the modified data still passes the MAC integrity check. This affects OpenSSL 3.0.0–3.0.2 and is fixed in 3.0.3.

The OCSP_basic_verify function in OpenSSL can return a positive result (successful verification) even when the OCSP response signing certificate fails to verify, if the OCSP_NOCHECKS flag is used. The issue also affects the command line "ocsp" application with the "-no_cert_checks" option, which reports success despite an actual verification failure. Fixed in OpenSSL 3.0.3 (affected 3.0.0, 3.0.1, 3.0.2).

In situations where an attacker receives automated notification of the success or failure of a decryption attempt an attacker, after sending a very large number of messages to be decrypted, can recover a CMS/PKCS7 transported encryption key or decrypt any RSA encrypted message that was encrypted with the public RSA key, using a Bleichenbacher padding oracle attack. Applications are not affected if they use a certificate together with the private RSA key to the CMS_decrypt or PKCS7_decrypt functions to select the correct recipient info to decrypt. Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c). Fixed in OpenSSL 1.1.0l (Affected 1.1.0-1.1.0k). Fixed in OpenSSL 1.0.2t (Affected 1.0.2-1.0.2s).

OpenSSL has internal defaults for OPENSSLDIR, where it finds its configuration file and certificates used for TLS verification. For versions 1.1.0 and 1.1.1, mingw configuration targets assume a Unix-like environment with prefix '/usr/local', which on Windows points to 'C:/usr/local' that may be world-writable, enabling untrusted users to modify OpenSSL's default configuration, insert CA certificates, or replace engine modules.