OpenSSL vulnerabilities

The ASN.1 implementation in OpenSSL before 1.0.1o and 1.0.2 before 1.0.2c allows remote attackers to execute arbitrary code or cause a denial of service (buffer underflow and memory corruption) via an ANY field in crafted serialized data, aka the 'negative zero' issue.

The doapr_outch function in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g does not verify that a certain memory allocation succeeds, allowing remote attackers to cause a denial of service (out-of-bounds write or memory consumption) or possibly have unspecified other impact via a long string.

The fmtstr function in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g improperly calculates string lengths, which can lead to denial of service (overflow and out-of-bounds read) due to a long string.

A double free vulnerability in the dsa_priv_decode function in OpenSSL before version 1.0.1s and 1.0.2 before version 1.0.2g allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a malformed DSA private key.

A malicious remote peer can flood the local QUIC stack with NEW_CONNECTION_ID frames by bypassing a limit on connection IDs. This causes RETIRE_CONN_ID frames to be sent and, with withheld ACKs, can allocate about 400 MB of memory.

OpenSSL 4.0 contains a use-after-free vulnerability (CWE-416) in the caching of X.509 certificate extensions. When several threads concurrently use the same certificate for the first time, one thread may free the cached extension data while another thread is still using it. This can crash the process, resulting in a Denial of Service.

The DTLS retransmission logic incorrectly handles a handshake message write that is suspended part-way through. The retransmitted message can be read past the message buffer, disclosing heap memory or causing a crash and Denial of Service.

SM2 signature generation uses non-constant-time arithmetic on secret values, forming a timing side-channel. An attacker able to measure SM2 signing times may learn information about the per-signature secret nonce, which over many signatures can lead to recovery of the private key. Applications performing SM2 signature generation are affected on all platforms.

An established DTLS 1.2 association using an AEAD cipher suite can be terminated by a single unauthenticated datagram whose encrypted fragment is shorter than the mandatory explicit IV and authentication tag overhead. The record layer passes the record length to the cipher before checking it is long enough, causing an internal error instead of treating the record as failed authentication.

A NULL pointer dereference vulnerability in the OpenSSL CMP client. When a client requests certificate revocation based on a PKCS#10 CSR and the server returns a specially crafted certificate name in its response, the client reads from a NULL pointer and crashes. Only clients that identify the certificate via CSR (e.g. 'openssl cmp -cmd rr -csr' or OSSL_CMP_exec_RR_ses() with OSSL_CMP_CTX_set1_p10CSR()) are affected.

The OpenSSL QUIC stack does not enforce connection-level flow control for streams. A malicious remote peer can send more bytes as long as they fit within stream flow control limits, leading to excessive memory allocation.

A TLS server that calls SSL_set_SSL_CTX() to switch a connection to a different SSL_CTX part way through a handshake may access memory beyond the end of an internal array if the replacement context knows about more provider signature algorithms than the context the connection was created from. A remote peer may be able to cause a small out-of-bounds read, and in some circumstances a fixed-value out-of-bounds write, on the server heap, potentially leading to a Denial of Service.

OpenSSL's optimized scalar point multiplication implementation for SM2 private key operations on ARM64 and RISC-V platforms is not constant-time. Conditional branches and table lookups depend on the bits of the secret scalar, so execution time and cache-access patterns leak information about the private key or signature nonce.

A vulnerability in the QUIC implementation in OpenSSL allows a remote attacker to keep allocated packet buffer memory for an extended period by sending specially crafted packets. The issue stems from missing resource allocation limits (CWE-770), potentially leading to excessive memory consumption.

The generic elliptic-curve scalar multiplication used for ECDSA and SM2 signature operations with curves lacking a dedicated implementation leaks information about the secret nonce through timing. An attacker measuring signing times may learn the nonce, which over many signatures can lead to private key recovery.

The QUIC stream reassembly algorithm in OpenSSL degrades progressively as packets arrive out of order, with worst-case quadratic complexity. A remote QUIC peer that completes the handshake can cause CPU pressure and potential DoS with low bandwidth.

The OpenSSL QUIC server, when address validation is disabled, can count incoming datagrams multiple times in its unvalidated credit computation. This violates the RFC 9000 3x amplification limit, allowing a remote attacker to use the server for DDoS amplification.

A certificate with many nameRelativeToCRLIssuer CRL distribution points causes disproportionate heap growth when OpenSSL caches X.509 extensions. Receiving a crafted certificate from a malicious peer can lead to significant memory pressure and possible Denial of Service.

The vulnerability in OpenSSL concerns the verification of password-based protection in the CMP protocol. The library only checks whether the protectionAlg parameter is not NULL, but does not verify its ASN.1 type, leading to dereferencing an invalid pointer. A remote, unauthenticated attacker can exploit this flaw to cause an application crash (Denial of Service).

A vulnerability in OpenSSL's QUIC implementation allows a remote attacker who completes a QUIC handshake to force uncontrolled connection-scoped memory growth. The QUIC stack stores metadata for ACK-only packets even though the protocol does not require them to be acknowledged. Sustained traffic or many concurrent connections can lead to memory exhaustion and denial of service (DoS).

The OpenSSL Certificate Management Protocol (CMP) caches additional certificates (extraCerts) sent in a CMP message, but never expunges them. If a server reuses an OSSL_CMP_CTX frequently, this cache may grow unboundedly, and a malicious client may flood a CMP server with requests driving this growth, leading to OOM conditions.

The vulnerability in OpenSSL affects the CMS_decrypt() function and involves incorrect sizing of the output buffer during key unwrap operations. An attacker can supply a crafted CMS message that causes an 8-byte out-of-bounds heap write, leading to heap corruption and typically resulting in a Denial of Service.

The vulnerability in OpenSSL concerns buffering of DTLS records for a future epoch during a handshake. An attacker can send small forged records, causing an endpoint to retain about 1.7 MB of memory per connection, resulting in a memory amplification factor of about 1200. This can lead to remote memory exhaustion (Denial of Service) on DTLS servers.

Double free of the QRX object in OpenSSL QUIC server stack during failed channel creation for an INITIAL packet. The bug leads to heap corruption and typically results in termination of the QUIC server process (Denial of Service).

In a server or client configuration with RFC7250 Raw Public Keys (RPKs) enabled and only the private key (with no associated certificate) configured locally, a NULL pointer dereference may occur when the remote peer solicits raw public keys and also sends the typically omitted "signature_algorithms_cert" TLS extension. The impact is limited to a possible Denial of Service as a result of an application abort, no data disclosure or remote command execution are possible.

A vulnerability in OpenSSL's QUIC server implementation allows a remote attacker to cause unbounded memory allocation by sending Initial packets with unknown connection IDs. The lack of a limit on pending connections can lead to memory exhaustion and denial of service (DoS). The issue is present since OpenSSL 3.5.

A malicious TLS server can cause a memory leak in a TLS client that has enabled OCSP response checking by sending an OCSP response with no single response entries. An attacker can leak a tunable amount of memory per TLS handshake, potentially leading to memory exhaustion and denial of service in long-running clients.

A vulnerability in OpenSSL during CMS password-based decryption (RFC 3211) allows an attacker to trigger a heap out-of-bounds read. The attacker can select a stream-mode cipher as the KEK, bypassing guards and causing a read beyond the allocated buffer.

A signed integer overflow in ASN1_mbstring_ncopy() when sizing the destination buffer for Unicode output can lead to a heap buffer overflow. This may allow attacker-controlled code execution or a crash.

Use-after-free vulnerability in OpenSSL during PKCS#7 or S/MIME signature verification. A specially crafted message can cause incorrect freeing of a BIO object, leading to process crashes, heap corruption, or potentially remote code execution.

The implementations of AES-SIV and AES-GCM-SIV in OpenSSL mishandle authentication of AAD with empty ciphertext, allowing forgery of such messages. An attacker can send arbitrary AAD with empty ciphertext and a zero tag, which will be accepted as valid.

A vulnerability in OpenSSL causes the supplied IV to be silently discarded when using the EVP_Cipher() one-shot interface for AES-OCB. Every message encrypted with the same key uses the same effective nonce, leading to loss of confidentiality and enabling authentication tag forgery.

OpenSSL has an out-of-bounds read vulnerability in X509_VERIFY_PARAM_set1_email when validating a crafted email address, e.g., in S/MIME verification. An internal helper function fails to enforce the 64-octet limit on the local part, leading to out-of-bounds read and potential crash.

The vulnerability in OpenSSL affects the EVP_PKEY_derive_set_peer() function when using a DHX (X9.42) peer key. A malicious peer can exploit the lack of proper subgroup membership check, leading to the recovery of the victim's private key after a few key exchange attempts.

A typo in the certificate chain building code for processing 'id-it-rootCaKeyUpdate' CMP messages caused an incorrect certificate to be added to the chain, rendering certificate verification ineffective. This could allow an attacker with RA-level credentials to escalate privileges to root CA level.

The CMS_decrypt and PKCS7_decrypt functions in OpenSSL are vulnerable to a Bleichenbacher-style attack when an attacker can provide CMS or S/MIME messages and observe the error code or decryption output. This allows the attacker to use the victim's application to decrypt or sign messages with the victim's private RSA key.

OpenSSL has a NULL pointer dereference vulnerability in the CMP client. An attacker controlling a CMP server (or acting as man-in-the-middle) can craft a CMP response containing a CRMF CertRepMessage with an EncryptedValue where the symmAlg field has an algorithm OID but no parameters. Processing this response causes a NULL dereference and crash (DoS). FIPS modules are not affected.

OpenSSL before a fixed version has a NULL pointer dereference vulnerability during password-based CMS decryption. A specially crafted CMS message can cause an application crash and Denial of Service.

OpenSSL has a NULL pointer dereference vulnerability when OCSP response checking for the whole chain (X509_V_FLAG_OCSP_RESP_CHECK_ALL) and partial chain verification (X509_V_FLAG_PARTIAL_CHAIN) are enabled. If the chain lacks a self-signed trusted anchor, a NULL dereference crashes the process.

Vulnerability in OpenSSL QUIC server. Receiving a QUIC initial packet with an invalid token may trigger a NULL pointer dereference when address validation is disabled, causing abnormal termination of the QUIC server process and denial of service. By default, address validation is enabled, so the default configuration is not vulnerable.

OpenSSL is vulnerable to a double-free in the client certificate verification path when OCSP stapling is used. A malicious server can trigger heap memory corruption via a crafted OCSP response.

A remote peer can exhaust heap memory of a QUIC server or client by flooding it with packets containing PATH_CHALLENGE frames. The local QUIC stack allocates a PATH_RESPONSE frame for each PATH_CHALLENGE, freed only upon acknowledgment by the remote peer – a malicious peer does not acknowledge, leading to unbounded memory allocation and denial of service. FIPS modules are not affected.

PKCS#12 file processing in OpenSSL fails to validate files using PBMAC1 integrity mechanism, allowing certificate and private key forgery. An attacker impersonating a user can cause a service to accept forged certificates with a 1 in 256 probability.

A heap buffer over-read vulnerability in OpenSSL's ASN.1 decoder occurs when parsing crafted DER structures with primitive elements exceeding 2 GB. Affects 64-bit Unix and Unix-like platforms.

Vulnerability in OpenSSL related to RSASVE, where a failed RSA encryption may return success, leaving an uninitialized buffer. An attacker can exploit this to leak sensitive data from previous process operations.

Vulnerability in OpenSSL when processing a crafted CMS EnvelopedData message with KeyTransportRecipientInfo. Missing check for the optional parameters field in RSA-OAEP leads to a NULL pointer dereference and crash.

Vulnerability in OpenSSL when processing a crafted CMS EnvelopedData message with KeyAgreeRecipientInfo. Missing check for the optional parameters field in KeyEncryptionAlgorithmIdentifier leads to a NULL pointer dereference and crash.

Vulnerability in OpenSSL when processing a delta CRL with a Delta CRL Indicator extension. Missing check for the CRL Number extension leads to a NULL pointer dereference, potentially causing an application crash.

In an uncommon client configuration using DANE TLSA-based server authentication, combined with unusual server TLSA records, a use-after-free and/or double-free may occur on the client side. The vulnerability only affects clients that support TLSA records with both PKIX-TA(0)/PKIX-EE(1) and DANE-TA(2) certificate usages. SMTP clients compliant with RFC7672 are not vulnerable.

Out-of-bounds read in OpenSSL when using AES-CFB128 on systems with AVX-512 and VAES. May cause application crash (DoS) under specific conditions.