OpenSSL vulnerabilities

The vulnerability in OpenSSL concerns buffering of DTLS records for a future epoch during a handshake. An attacker can send small forged records, causing an endpoint to retain about 1.7 MB of memory per connection, resulting in a memory amplification factor of about 1200. This can lead to remote memory exhaustion (Denial of Service) on DTLS servers.

Double free of the QRX object in OpenSSL QUIC server stack during failed channel creation for an INITIAL packet. The bug leads to heap corruption and typically results in termination of the QUIC server process (Denial of Service).

In a server or client configuration with RFC7250 Raw Public Keys (RPKs) enabled and only the private key (with no associated certificate) configured locally, a NULL pointer dereference may occur when the remote peer solicits raw public keys and also sends the typically omitted "signature_algorithms_cert" TLS extension. The impact is limited to a possible Denial of Service as a result of an application abort, no data disclosure or remote command execution are possible.

A vulnerability in OpenSSL's QUIC server implementation allows a remote attacker to cause unbounded memory allocation by sending Initial packets with unknown connection IDs. The lack of a limit on pending connections can lead to memory exhaustion and denial of service (DoS). The issue is present since OpenSSL 3.5.

A malicious TLS server can cause a memory leak in a TLS client that has enabled OCSP response checking by sending an OCSP response with no single response entries. An attacker can leak a tunable amount of memory per TLS handshake, potentially leading to memory exhaustion and denial of service in long-running clients.

A vulnerability in OpenSSL during CMS password-based decryption (RFC 3211) allows an attacker to trigger a heap out-of-bounds read. The attacker can select a stream-mode cipher as the KEK, bypassing guards and causing a read beyond the allocated buffer.

A signed integer overflow in ASN1_mbstring_ncopy() when sizing the destination buffer for Unicode output can lead to a heap buffer overflow. This may allow attacker-controlled code execution or a crash.

Use-after-free vulnerability in OpenSSL during PKCS#7 or S/MIME signature verification. A specially crafted message can cause incorrect freeing of a BIO object, leading to process crashes, heap corruption, or potentially remote code execution.

The implementations of AES-SIV and AES-GCM-SIV in OpenSSL mishandle authentication of AAD with empty ciphertext, allowing forgery of such messages. An attacker can send arbitrary AAD with empty ciphertext and a zero tag, which will be accepted as valid.

A vulnerability in OpenSSL causes the supplied IV to be silently discarded when using the EVP_Cipher() one-shot interface for AES-OCB. Every message encrypted with the same key uses the same effective nonce, leading to loss of confidentiality and enabling authentication tag forgery.

OpenSSL has an out-of-bounds read vulnerability in X509_VERIFY_PARAM_set1_email when validating a crafted email address, e.g., in S/MIME verification. An internal helper function fails to enforce the 64-octet limit on the local part, leading to out-of-bounds read and potential crash.

The vulnerability in OpenSSL affects the EVP_PKEY_derive_set_peer() function when using a DHX (X9.42) peer key. A malicious peer can exploit the lack of proper subgroup membership check, leading to the recovery of the victim's private key after a few key exchange attempts.

A typo in the certificate chain building code for processing 'id-it-rootCaKeyUpdate' CMP messages caused an incorrect certificate to be added to the chain, rendering certificate verification ineffective. This could allow an attacker with RA-level credentials to escalate privileges to root CA level.

The CMS_decrypt and PKCS7_decrypt functions in OpenSSL are vulnerable to a Bleichenbacher-style attack when an attacker can provide CMS or S/MIME messages and observe the error code or decryption output. This allows the attacker to use the victim's application to decrypt or sign messages with the victim's private RSA key.

OpenSSL has a NULL pointer dereference vulnerability in the CMP client. An attacker controlling a CMP server (or acting as man-in-the-middle) can craft a CMP response containing a CRMF CertRepMessage with an EncryptedValue where the symmAlg field has an algorithm OID but no parameters. Processing this response causes a NULL dereference and crash (DoS). FIPS modules are not affected.

OpenSSL before a fixed version has a NULL pointer dereference vulnerability during password-based CMS decryption. A specially crafted CMS message can cause an application crash and Denial of Service.

OpenSSL has a NULL pointer dereference vulnerability when OCSP response checking for the whole chain (X509_V_FLAG_OCSP_RESP_CHECK_ALL) and partial chain verification (X509_V_FLAG_PARTIAL_CHAIN) are enabled. If the chain lacks a self-signed trusted anchor, a NULL dereference crashes the process.

Vulnerability in OpenSSL QUIC server. Receiving a QUIC initial packet with an invalid token may trigger a NULL pointer dereference when address validation is disabled, causing abnormal termination of the QUIC server process and denial of service. By default, address validation is enabled, so the default configuration is not vulnerable.

OpenSSL is vulnerable to a double-free in the client certificate verification path when OCSP stapling is used. A malicious server can trigger heap memory corruption via a crafted OCSP response.

A remote peer can exhaust heap memory of a QUIC server or client by flooding it with packets containing PATH_CHALLENGE frames. The local QUIC stack allocates a PATH_RESPONSE frame for each PATH_CHALLENGE, freed only upon acknowledgment by the remote peer – a malicious peer does not acknowledge, leading to unbounded memory allocation and denial of service. FIPS modules are not affected.

PKCS#12 file processing in OpenSSL fails to validate files using PBMAC1 integrity mechanism, allowing certificate and private key forgery. An attacker impersonating a user can cause a service to accept forged certificates with a 1 in 256 probability.

A heap buffer over-read vulnerability in OpenSSL's ASN.1 decoder occurs when parsing crafted DER structures with primitive elements exceeding 2 GB. Affects 64-bit Unix and Unix-like platforms.

Vulnerability in OpenSSL related to RSASVE, where a failed RSA encryption may return success, leaving an uninitialized buffer. An attacker can exploit this to leak sensitive data from previous process operations.

Vulnerability in OpenSSL when processing a crafted CMS EnvelopedData message with KeyTransportRecipientInfo. Missing check for the optional parameters field in RSA-OAEP leads to a NULL pointer dereference and crash.

Vulnerability in OpenSSL when processing a crafted CMS EnvelopedData message with KeyAgreeRecipientInfo. Missing check for the optional parameters field in KeyEncryptionAlgorithmIdentifier leads to a NULL pointer dereference and crash.

Vulnerability in OpenSSL when processing a delta CRL with a Delta CRL Indicator extension. Missing check for the CRL Number extension leads to a NULL pointer dereference, potentially causing an application crash.

In an uncommon client configuration using DANE TLSA-based server authentication, combined with unusual server TLSA records, a use-after-free and/or double-free may occur on the client side. The vulnerability only affects clients that support TLSA records with both PKIX-TA(0)/PKIX-EE(1) and DANE-TA(2) certificate usages. SMTP clients compliant with RFC7672 are not vulnerable.

Out-of-bounds read in OpenSSL when using AES-CFB128 on systems with AVX-512 and VAES. May cause application crash (DoS) under specific conditions.

An out-of-bounds read vulnerability in the OpenSSL HTTP client occurs when the 'no_proxy' environment variable is set and the host in the URL is an IPv6 address. This can cause a crash leading to Denial of Service (DoS).

A timing side-channel vulnerability in the SM2 algorithm implementation on 64-bit ARM platforms could allow remote recovery of the private key. This issue does not affect standard TLS configurations in OpenSSL but may be exploited in custom setups using SM2 certificates.

A vulnerability in OpenSSL when decrypting CMS messages using password-based encryption (PWRI) can cause an out-of-bounds read and write. This flaw exists in the CMS implementation, which rarely uses password-based encryption.

A flaw was found in OpenSSL's handling of the properties argument in certain functions. This vulnerability can allow use-after-free exploitation, which may result in undefined behavior or incorrect property parsing, leading to OpenSSL treating the input as an empty string.