OpenSSL vulnerabilities

A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL protocol defined processing of ALERT packets during a connection handshake. A remote attacker could use this flaw to make a TLS/SSL server consume an excessive amount of CPU and fail to accept connections from other clients.

CVE-2017-3731 affects SSL/TLS servers and clients running on 32-bit hosts that may crash due to an out-of-bounds read caused by a truncated packet. For OpenSSL 1.1.0, the crash can be triggered using the CHACHA20/POLY1305 cipher, and for OpenSSL 1.0.2 using RC4-MD5.

In OpenSSL 1.1.0 before 1.1.0d, a malicious server can supply bad parameters for a DHE or ECDHE key exchange, leading to the client attempting to dereference a NULL pointer, resulting in a client crash.

In OpenSSL 1.1.0 before 1.1.0c, TLS connections using *-CHACHA20-POLY1305 ciphersuites are susceptible to a DoS attack by corrupting larger payloads. This can result in an OpenSSL crash.

OpenSSL 1.0.2i has a vulnerability that allows remote attackers to cause application crashes by triggering a CRL operation, leading to a NULL pointer dereference.

The ssl3_read_bytes function in OpenSSL 1.1.0 before version 1.1.0a allows remote attackers to cause a denial of service (infinite loop) by triggering a zero-length record in an SSL_peek call.

Multiple memory leaks in t1_lib.c in OpenSSL before 1.0.1u, 1.0.2 before 1.0.2i, and 1.1.0 before 1.1.0a allow remote attackers to cause a denial of service (memory consumption) via large OCSP Status Request extensions.

The tls_decrypt_ticket function in OpenSSL before 1.1.0 does not consider the HMAC size during validation of the ticket length, allowing remote attackers to cause a denial of service via a ticket that is too short.

The DTLS implementation in OpenSSL before 1.1.0 does not properly restrict the lifetime of queue entries associated with unused out-of-order messages. This allows remote attackers to cause a denial of service (memory consumption) by maintaining many crafted DTLS sessions simultaneously.

The X509_NAME_oneline function in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h allows remote attackers to obtain sensitive information from process stack memory or cause a denial of service (buffer over-read) via crafted EBCDIC ASN.1 data.

The asn1_d2i_read_bio function in the ASN.1 BIO implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h allows remote attackers to cause a denial of service (memory consumption) via a short invalid encoding.

Integer overflow in the EVP_EncryptUpdate function in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h allows remote attackers to cause a denial of service (heap memory corruption) via a large amount of data.

Integer overflow in the EVP_EncodeUpdate function in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h can lead to denial of service due to heap memory corruption when processing a large amount of binary data.

OpenSSL before version 0.9.6 has a flaw in handling C bitwise-shift operations that can lead to improper RSA key generation on 64-bit HP-UX platforms. This makes it easier for remote attackers to defeat cryptographic protection mechanisms.

A memory leak in the SRP_VBASE_get_by_user implementation in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g allows remote attackers to cause a denial of service (memory consumption) by providing an invalid username in a connection attempt.

Multiple integer overflows in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g can lead to denial of service through heap memory corruption or NULL pointer dereference. Attackers can exploit long digit strings mishandled by the BN_dec2bn or BN_hex2bn functions.

In OpenSSL 1.0.1 before 1.0.1q and 1.0.2 before 1.0.2e, a vulnerability allows remote attackers to cause a denial of service via an RSA PSS ASN.1 signature that lacks a mask generation function parameter.

The X509_cmp_time function in OpenSSL before versions 0.9.8zg, 1.0.0 before 1.0.0s, 1.0.1 before 1.0.1n, and 1.0.2 before 1.0.2b allows remote attackers to cause a denial of service via a crafted length field in ASN1_TIME data, leading to out-of-bounds read and application crash.

The dtls1_clear_queues function in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h frees data structures without considering that application data can arrive between a ChangeCipherSpec message and a Finished message. This allows remote DTLS peers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via unexpected application data.

An integer underflow in the EVP_DecodeUpdate function in OpenSSL allows remote attackers to cause memory corruption or denial of service via crafted base64 data that triggers a buffer overflow.

A memory leak in the tls_decrypt_ticket function in OpenSSL before 0.9.8zc, 1.0.0 before 1.0.0o, and 1.0.1 before 1.0.1j allows remote attackers to cause a denial of service via a crafted session ticket that triggers an integrity-check failure.

A memory leak in OpenSSL 1.0.1 before 1.0.1j in the DTLS SRTP extension allows remote attackers to cause a denial of service through a crafted handshake message.

OpenSSL versions before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h do not properly restrict processing of ChangeCipherSpec messages. This allows man-in-the-middle attackers to trigger the use of a zero-length master key in certain OpenSSL-to-OpenSSL communications, potentially hijacking sessions or obtaining sensitive information.

A timing side-channel in ECDSA signature computations could potentially allow recovering the private key by an attacker. Measuring timing could lead to private key recovery.

Clients using RFC7250 Raw Public Keys (RPKs) to authenticate a server may fail to notice that the server was not authenticated, because handshakes don't abort as expected when the SSL_VERIFY_PEER verification mode is set. Impact: TLS and DTLS connections using raw public keys...

If an application using the `SSL_CIPHER_find()` function in a QUIC protocol client or server receives an unknown cipher suite from the peer, a NULL dereference occurs. This leads to abnormal termination of the running process, causing Denial of Service (DoS).

A certificate with a URI containing an IPv6 address with a zone ID may incorrectly satisfy a URI name constraint in the certificate chain. This vulnerability only affects private PKIs using URIs, as certificates with URIs are not allowed in the public web PKI.

Generating or checking excessively long X9.42 DH keys may be very slow. Applications using DH_generate_key() or DH_check() functions may experience long delays.

A vulnerability in the assembly implementation of an internal cryptographic function on the ppc64le architecture leaks a few bits of secret scalars due to the use of a variable-time instruction. Based on how this function is used, the leakage is not sufficient to recover the private key.

A vulnerability in the OpenSSL library allows unbounded memory growth when processing TLSv1.3 sessions in certain non-default server configurations. An attacker can exploit this to cause a Denial of Service (DoS).

Processing a maliciously formatted PKCS12 file may cause OpenSSL to crash, leading to a potential Denial of Service attack. Applications loading PKCS12 files from untrusted sources might terminate abruptly.

Checking excessively long DSA keys or parameters may be very slow. Applications using EVP_PKEY_param_check() or EVP_PKEY_public_check() to verify DSA public keys or parameters may experience long delays.

Use of the low-level GF(2^m) elliptic curve APIs with untrusted explicit values for the field polynomial can lead to out-of-bounds memory reads or writes.

The vulnerability in OpenSSL involves improper processing of AuthEnvelopedData containers in CMS, where insufficient validation of cipher and tag length fields allows an attacker to replace the cipher with an unauthenticated one (e.g., AES-256-OFB) or reduce the tag length to a single byte. This can lead to key-equivalent functionality for a chosen recipient and bypass of message integrity.

Converting an excessively large OCTET STRING value to a hexadecimal string leads to a heap buffer overflow on 32-bit platforms. This may cause a crash or potentially allow attacker-controlled code execution.

A vulnerability in OpenSSL when parsing CMS AuthEnvelopedData or EnvelopedData messages with maliciously crafted AEAD parameters can cause a stack buffer overflow. An attacker can supply a crafted CMS message with an oversized IV, leading to an out-of-bounds write before authentication verification.

The statem/statem.c file in OpenSSL 1.1.0a does not consider memory-block movement after a realloc call, allowing remote attackers to cause a denial of service (use-after-free) or possibly execute arbitrary code via a crafted TLS session.

Integer overflow in the MDC2_Update function in OpenSSL before version 1.1.0 may allow remote attackers to cause a denial of service through out-of-bounds write, leading to application crash.

The BN_bn2dec function in OpenSSL before 1.1.0 does not properly validate division results, which may lead to application crashes or denial of service.

OpenSSL through 1.0.2h incorrectly uses pointer arithmetic for heap-buffer boundary checks, which might allow remote attackers to cause a denial of service (integer overflow and application crash) or possibly have unspecified other impact.

The ASN.1 implementation in OpenSSL before 1.0.1o and 1.0.2 before 1.0.2c allows remote attackers to execute arbitrary code or cause a denial of service (buffer underflow and memory corruption) via an ANY field in crafted serialized data, aka the 'negative zero' issue.

The doapr_outch function in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g does not verify that a certain memory allocation succeeds, allowing remote attackers to cause a denial of service (out-of-bounds write or memory consumption) or possibly have unspecified other impact via a long string.

The fmtstr function in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g improperly calculates string lengths, which can lead to denial of service (overflow and out-of-bounds read) due to a long string.

A double free vulnerability in the dsa_priv_decode function in OpenSSL before version 1.0.1s and 1.0.2 before version 1.0.2g allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a malformed DSA private key.

The vulnerability affects ChaCha20-Poly1305 and AES-OCB decryption with an empty ciphertext, which can report success without verifying the supplied authentication tag when the operation is finalized by calling the EVP_Cipher() function. Applications calling EVP_Cipher() on an empty ciphertext and expecting the call to check the AEAD tag may accept forged messages.

The vulnerability in OpenSSL concerns the verification of password-based protection in the CMP protocol. The library only checks whether the protectionAlg parameter is not NULL, but does not verify its ASN.1 type, leading to dereferencing an invalid pointer. A remote, unauthenticated attacker can exploit this flaw to cause an application crash (Denial of Service).

A vulnerability in OpenSSL's QUIC implementation allows a remote attacker who completes a QUIC handshake to force uncontrolled connection-scoped memory growth. The QUIC stack stores metadata for ACK-only packets even though the protocol does not require them to be acknowledged. Sustained traffic or many concurrent connections can lead to memory exhaustion and denial of service (DoS).

The OpenSSL Certificate Management Protocol (CMP) caches additional certificates (extraCerts) sent in a CMP message, but never expunges them. If a server reuses an OSSL_CMP_CTX frequently, this cache may grow unboundedly, and a malicious client may flood a CMP server with requests driving this growth, leading to OOM conditions.

A vulnerability in OpenSSL CMP response validation passes an unexpected response sender distinguished name directly as a format string to ERR_raise_data(). An attacker can craft a sender DN with percent characters, causing a crash of the CMP client. This occurs when the client enforces an expected sender or uses a pinned server certificate.

The vulnerability in OpenSSL affects the CMS_decrypt() function and involves incorrect sizing of the output buffer during key unwrap operations. An attacker can supply a crafted CMS message that causes an 8-byte out-of-bounds heap write, leading to heap corruption and typically resulting in a Denial of Service.