- openssl-3.0.1-43.el9_0 ()
- 3.0.7-27.el9
- 2024-05-21 13:30:06
- CVE CVE-2022-4203, CVSSv2 Score: 4.9
- Description:
read buffer overflow in X.509 certificate verification
- Patch: openssl/3.0.1/CVE-2022-4203-nc-match.patch
- CVE CVE-2022-4304, CVSSv2 Score: 5.9
- Description:
timing attack in RSA Decryption implementation
- Patch: openssl/3.0.1/CVE-2022-4304-RSA-time-oracle.patch
- CVE CVE-2022-4450, CVSSv2 Score: 7.5
- Description:
double free after calling PEM_read_bio_ex
- Patch: openssl/3.0.1/CVE-2022-4450-pem-read-bio.patch
- CVE CVE-2023-0215, CVSSv2 Score: 7.5
- Description:
use-after-free following BIO_new_NDEF
- Patch: openssl/3.0.1/CVE-2023-0215-UAF-bio.patch
- CVE CVE-2023-0216, CVSSv2 Score: 7.5
- Description:
invalid pointer dereference in d2i_PKCS7 functions
- Patch: openssl/3.0.1/CVE-2023-0216-pkcs7-deref.patch
- CVE CVE-2023-0217, CVSSv2 Score: 7.5
- Description:
NULL dereference validating DSA public key
- Patch: openssl/3.0.1/CVE-2023-0217-dsa.patch
- CVE CVE-2023-0217, CVSSv2 Score:
- Description:
- Patch: openssl/3.0.2/CVE-2023-0217-3-adapt2.patch
- CVE CVE-2023-0286, CVSSv2 Score: 7.4
- Description:
X.400 address type confusion in X.509 GeneralName
- Patch: openssl/3.0.1/CVE-2023-0286-X400.patch
- CVE CVE-2023-0401, CVSSv2 Score: 7.5
- Description:
NULL dereference during PKCS7 data verification
- Patch: openssl/3.0.1/CVE-2023-0401-pkcs7-md.patch
- CVE CVE-2023-2650, CVSSv2 Score: 6.5
- Description:
Possible denial of service while translating ASN.1 object identifiers
- Patch: openssl/3.0.7/CVE-2023-2650.patch
- CVE CVE-2023-0464, CVSSv2 Score: 5.9
- Description:
Denial of service by excessive resource usage in verifying X509 policy constraints
- Patch: openssl/3.0.7/CVE-2023-0464.patch
- CVE CVE-2023-0464, CVSSv2 Score: 5.9
- Description:
Denial of service by excessive resource usage in verifying X509 policy constraints
- Patch: openssl/3.0.2/CVE-2023-0464-1-adapt.patch
- CVE CVE-2023-0465, CVSSv2 Score: 5.3
- Description:
Invalid certificate policies in leaf certificates are silently ignored
- Patch: openssl/3.0.7/CVE-2023-0465.patch
- CVE CVE-2023-2975, CVSSv2 Score: 5.3
- Description:
AES-SIV implementation ignores empty associated data entries
- Patch: openssl/3.0.7/CVE-2023-2975.patch
- CVE CVE-2023-3446, CVSSv2 Score: 5.3
- Description:
Excessive time spent checking DH keys and parameters
- Patch: openssl/3.0.7/CVE-2023-3446.patch
- CVE CVE-2023-3817, CVSSv2 Score: 5.3
- Description:
Excessive time spent checking DH q parameter value
- Patch: openssl/3.0.7/CVE-2023-3817.patch
- CVE CVE-2023-3817, CVSSv2 Score: 5.3
- Description:
Excessive time spent checking DH q parameter value
- Patch: openssl/3.0.7/CVE-2023-3817-adapt.patch
- CVE CVE-2023-5363, CVSSv2 Score: 7.5
- Description:
Fix incorrect cipher key and IV length processing
- Patch: openssl/3.0.7/CVE-2023-5363.patch
- CVE CVE-2023-5678, CVSSv2 Score: 5.3
- Description:
Excessive time spent in DH check / generation with large Q parameter value
- Patch: openssl/3.0.7/CVE-2023-5678.patch
- CVE CVE-2023-5678, CVSSv2 Score: 5.3
- Description:
OpenSSL flaw in long X9.42 DH keys processing may cause slowdowns, risking denial of service
- Patch: openssl/3.0.2/CVE-2023-5678-adapt.patch
- CVE CVE-2023-6129, CVSSv2 Score: 6.5
- Description:
POLY1305 MAC implementation corrupts vector registers on PowerPC
- Patch: openssl/3.0.7/CVE-2023-6129.patch
- CVE CVE-2023-6237, CVSSv2 Score: 5.9
- Description:
Excessive time spent checking invalid RSA public keys
- Patch: openssl/3.0.7/CVE-2023-6237-preadapt.patch
- CVE CVE-2023-6237, CVSSv2 Score: 5.9
- Description:
Excessive time spent checking invalid RSA public keys
- Patch: openssl/3.0.7/CVE-2023-6237.patch
- CVE CVE-2023-6237, CVSSv2 Score: 5.9
- Description:
Excessive time spent checking invalid RSA public keys
- Patch: openssl/3.0.7/CVE-2023-6237-postadapt.patch
- CVE CVE-2024-0727, CVSSv2 Score: 5.5
- Description:
PKCS12 Decoding crashes
- Patch: openssl/3.0.7/CVE-2024-0727.patch