-
Notifications
You must be signed in to change notification settings - Fork 39
/
alpine-3.9.2.json
1805 lines (1805 loc) · 123 KB
/
alpine-3.9.2.json
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
{
"SchemaVersion": 2,
"ArtifactName": "alpine:3.9.2",
"ArtifactType": "container_image",
"Metadata": {
"OS": {
"Family": "alpine",
"Name": "3.9.2",
"EOSL": true
},
"ImageID": "sha256:5cb3aa00f89934411ffba5c063a9bc98ace875d8f92e77d0029543d9f2ef4ad0",
"DiffIDs": [
"sha256:bcf2f368fe234217249e00ad9d762d8f1a3156d60c442ed92079fa5b120634a1"
],
"RepoTags": ["alpine:3.9.2"],
"RepoDigests": [
"alpine@sha256:644fcb1a676b5165371437feaa922943aaf7afcfa8bfee4472f6860aad1ef2a0"
],
"ImageConfig": {
"architecture": "amd64",
"container": "277610461b47d66cbee3947628daa460aa62836414a2762aee57da387724e33e",
"created": "2019-03-07T22:19:40.247110971Z",
"docker_version": "18.06.1-ce",
"history": [
{
"created": "2019-03-07T22:19:40.113750514Z",
"created_by": "/bin/sh -c #(nop) ADD file:88875982b0512a9d0ba001bfea19497ae9a9442c257b19c61bffc56e7201b0c3 in / "
},
{
"created": "2019-03-07T22:19:40.247110971Z",
"created_by": "/bin/sh -c #(nop) CMD [\"/bin/sh\"]",
"empty_layer": true
}
],
"os": "linux",
"rootfs": {
"type": "layers",
"diff_ids": [
"sha256:bcf2f368fe234217249e00ad9d762d8f1a3156d60c442ed92079fa5b120634a1"
]
},
"config": {
"Cmd": ["/bin/sh"],
"Env": [
"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
],
"Image": "sha256:0b7fc56164419dfc0ce9fd320acfc2032a72c3b7f276c5f04cb733f9a4f45c7f",
"ArgsEscaped": true
}
}
},
"Results": [
{
"Target": "alpine:3.9.2 (alpine 3.9.2)",
"Class": "os-pkgs",
"Type": "alpine",
"Vulnerabilities": [
{
"VulnerabilityID": "CVE-2019-1543",
"PkgName": "libcrypto1.1",
"InstalledVersion": "1.1.1a-r1",
"FixedVersion": "1.1.1b-r1",
"Layer": {
"Digest": "sha256:8e402f1a9c577ded051c1ef10e9fe4492890459522089959988a4852dee8ab2c",
"DiffID": "sha256:bcf2f368fe234217249e00ad9d762d8f1a3156d60c442ed92079fa5b120634a1"
},
"SeveritySource": "nvd",
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-1543",
"DataSource": {
"ID": "alpine",
"Name": "Alpine Secdb",
"URL": "https://secdb.alpinelinux.org/"
},
"Title": "openssl: ChaCha20-Poly1305 with long nonces",
"Description": "ChaCha20-Poly1305 is an AEAD cipher, and requires a unique nonce input for every encryption operation. RFC 7539 specifies that the nonce value (IV) should be 96 bits (12 bytes). OpenSSL allows a variable nonce length and front pads the nonce with 0 bytes if it is less than 12 bytes. However it also incorrectly allows a nonce to be set of up to 16 bytes. In this case only the last 12 bytes are significant and any additional leading bytes are ignored. It is a requirement of using this cipher that nonce values are unique. Messages encrypted using a reused nonce value are susceptible to serious confidentiality and integrity attacks. If an application changes the default nonce length to be longer than 12 bytes and then makes a change to the leading bytes of the nonce expecting the new value to be a new unique nonce then such an application could inadvertently encrypt messages with a reused nonce. Additionally the ignored bytes in a long nonce are not covered by the integrity guarantee of this cipher. Any application that relies on the integrity of these ignored leading bytes of a long nonce may be further affected. Any OpenSSL internal use of this cipher, including in SSL/TLS, is safe because no such use sets such a long nonce value. However user applications that use this cipher directly and set a non-default nonce length to be longer than 12 bytes may be vulnerable. OpenSSL versions 1.1.1 and 1.1.0 are affected by this issue. Due to the limited scope of affected deployments this has been assessed as low severity and therefore we are not creating new releases at this time. Fixed in OpenSSL 1.1.1c (Affected 1.1.1-1.1.1b). Fixed in OpenSSL 1.1.0k (Affected 1.1.0-1.1.0j).",
"Severity": "HIGH",
"CweIDs": ["CWE-327", "CWE-330"],
"CVSS": {
"nvd": {
"V2Vector": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
"V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"V2Score": 5.8,
"V3Score": 7.4
},
"redhat": {
"V3Vector": "CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
"V3Score": 2.9
}
},
"References": [
"http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00056.html",
"https://access.redhat.com/errata/RHSA-2019:3700",
"https://access.redhat.com/security/cve/CVE-2019-1543",
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1543",
"https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=ee22257b1418438ebaf54df98af4e24f494d1809",
"https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=f426625b6ae9a7831010750490a5f0ad689c5ba3",
"https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10365",
"https://linux.oracle.com/cve/CVE-2019-1543.html",
"https://linux.oracle.com/errata/ELSA-2019-3700.html",
"https://lists.fedoraproject.org/archives/list/[email protected]/message/Y3IVFGSERAZLNJCK35TEM2R4726XIH3Z/",
"https://lists.fedoraproject.org/archives/list/[email protected]/message/ZBEV5QGDRFUZDMNECFXUSN5FMYOZDE4V/",
"https://seclists.org/bugtraq/2019/Jul/3",
"https://www.debian.org/security/2019/dsa-4475",
"https://www.openssl.org/news/secadv/20190306.txt",
"https://www.oracle.com/security-alerts/cpuapr2020.html",
"https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html",
"https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"
],
"PublishedDate": "2019-03-06T21:29:00Z",
"LastModifiedDate": "2021-07-31T08:15:00Z"
},
{
"VulnerabilityID": "CVE-2020-1967",
"PkgName": "libcrypto1.1",
"InstalledVersion": "1.1.1a-r1",
"FixedVersion": "1.1.1g-r0",
"Layer": {
"Digest": "sha256:8e402f1a9c577ded051c1ef10e9fe4492890459522089959988a4852dee8ab2c",
"DiffID": "sha256:bcf2f368fe234217249e00ad9d762d8f1a3156d60c442ed92079fa5b120634a1"
},
"SeveritySource": "nvd",
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2020-1967",
"DataSource": {
"ID": "alpine",
"Name": "Alpine Secdb",
"URL": "https://secdb.alpinelinux.org/"
},
"Title": "openssl: Segmentation fault in SSL_check_chain causes denial of service",
"Description": "Server or client applications that call the SSL_check_chain() function during or after a TLS 1.3 handshake may crash due to a NULL pointer dereference as a result of incorrect handling of the \"signature_algorithms_cert\" TLS extension. The crash occurs if an invalid or unrecognised signature algorithm is received from the peer. This could be exploited by a malicious peer in a Denial of Service attack. OpenSSL version 1.1.1d, 1.1.1e, and 1.1.1f are affected by this issue. This issue did not affect OpenSSL versions prior to 1.1.1d. Fixed in OpenSSL 1.1.1g (Affected 1.1.1d-1.1.1f).",
"Severity": "HIGH",
"CweIDs": ["CWE-476"],
"CVSS": {
"nvd": {
"V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"V2Score": 5,
"V3Score": 7.5
},
"redhat": {
"V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"V3Score": 7.5
}
},
"References": [
"http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00004.html",
"http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00011.html",
"http://packetstormsecurity.com/files/157527/OpenSSL-signature_algorithms_cert-Denial-Of-Service.html",
"http://seclists.org/fulldisclosure/2020/May/5",
"http://www.openwall.com/lists/oss-security/2020/04/22/2",
"https://access.redhat.com/security/cve/CVE-2020-1967",
"https://crates.io/crates/openssl-src",
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1967",
"https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=eb563247aef3e83dda7679c43f9649270462e5b1",
"https://github.com/irsl/CVE-2020-1967",
"https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44440",
"https://lists.apache.org/thread.html/r66ea9c436da150683432db5fbc8beb8ae01886c6459ac30c2cea7345@%3Cdev.tomcat.apache.org%3E",
"https://lists.apache.org/thread.html/r94d6ac3f010a38fccf4f432b12180a13fa1cf303559bd805648c9064@%3Cdev.tomcat.apache.org%3E",
"https://lists.apache.org/thread.html/r9a41e304992ce6aec6585a87842b4f2e692604f5c892c37e3b0587ee@%3Cdev.tomcat.apache.org%3E",
"https://lists.fedoraproject.org/archives/list/[email protected]/message/DDHOAATPWJCXRNFMJ2SASDBBNU5RJONY/",
"https://lists.fedoraproject.org/archives/list/[email protected]/message/EXDDAOWSAIEFQNBHWYE6PPYFV4QXGMCD/",
"https://lists.fedoraproject.org/archives/list/[email protected]/message/XVEP3LAK4JSPRXFO4QF4GG2IVXADV3SO/",
"https://nvd.nist.gov/vuln/detail/CVE-2020-1967",
"https://rustsec.org/advisories/RUSTSEC-2020-0015.html",
"https://security.FreeBSD.org/advisories/FreeBSD-SA-20:11.openssl.asc",
"https://security.gentoo.org/glsa/202004-10",
"https://security.netapp.com/advisory/ntap-20200424-0003/",
"https://security.netapp.com/advisory/ntap-20200717-0004/",
"https://www.debian.org/security/2020/dsa-4661",
"https://www.openssl.org/news/secadv/20200421.txt",
"https://www.oracle.com//security-alerts/cpujul2021.html",
"https://www.oracle.com/security-alerts/cpuApr2021.html",
"https://www.oracle.com/security-alerts/cpujan2021.html",
"https://www.oracle.com/security-alerts/cpujul2020.html",
"https://www.oracle.com/security-alerts/cpuoct2020.html",
"https://www.oracle.com/security-alerts/cpuoct2021.html",
"https://www.synology.com/security/advisory/Synology_SA_20_05",
"https://www.synology.com/security/advisory/Synology_SA_20_05_OpenSSL",
"https://www.tenable.com/security/tns-2020-03",
"https://www.tenable.com/security/tns-2020-04",
"https://www.tenable.com/security/tns-2020-11",
"https://www.tenable.com/security/tns-2021-10"
],
"PublishedDate": "2020-04-21T14:15:00Z",
"LastModifiedDate": "2021-12-10T17:11:00Z"
},
{
"VulnerabilityID": "CVE-2021-23840",
"PkgName": "libcrypto1.1",
"InstalledVersion": "1.1.1a-r1",
"FixedVersion": "1.1.1j-r0",
"Layer": {
"Digest": "sha256:8e402f1a9c577ded051c1ef10e9fe4492890459522089959988a4852dee8ab2c",
"DiffID": "sha256:bcf2f368fe234217249e00ad9d762d8f1a3156d60c442ed92079fa5b120634a1"
},
"SeveritySource": "nvd",
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2021-23840",
"DataSource": {
"ID": "alpine",
"Name": "Alpine Secdb",
"URL": "https://secdb.alpinelinux.org/"
},
"Title": "openssl: integer overflow in CipherUpdate",
"Description": "Calls to EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate may overflow the output length argument in some cases where the input length is close to the maximum permissable length for an integer on the platform. In such cases the return value from the function call will be 1 (indicating success), but the output length value will be negative. This could cause applications to behave incorrectly or crash. OpenSSL versions 1.1.1i and below are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1j. OpenSSL versions 1.0.2x and below are affected by this issue. However OpenSSL 1.0.2 is out of support and no longer receiving public updates. Premium support customers of OpenSSL 1.0.2 should upgrade to 1.0.2y. Other users should upgrade to 1.1.1j. Fixed in OpenSSL 1.1.1j (Affected 1.1.1-1.1.1i). Fixed in OpenSSL 1.0.2y (Affected 1.0.2-1.0.2x).",
"Severity": "HIGH",
"CweIDs": ["CWE-190"],
"CVSS": {
"nvd": {
"V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"V2Score": 5,
"V3Score": 7.5
},
"redhat": {
"V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"V3Score": 7.5
}
},
"References": [
"https://access.redhat.com/security/cve/CVE-2021-23840",
"https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf",
"https://crates.io/crates/openssl-src",
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23840",
"https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=6a51b9e1d0cf0bf8515f7201b68fb0a3482b3dc1",
"https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=9b1129239f3ebb1d1c98ce9ed41d5c9476c47cb2",
"https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44846",
"https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10366",
"https://linux.oracle.com/cve/CVE-2021-23840.html",
"https://linux.oracle.com/errata/ELSA-2021-9561.html",
"https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b@%3Cissues.bookkeeper.apache.org%3E",
"https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4@%3Cissues.bookkeeper.apache.org%3E",
"https://nvd.nist.gov/vuln/detail/CVE-2021-23840",
"https://rustsec.org/advisories/RUSTSEC-2021-0057.html",
"https://security.gentoo.org/glsa/202103-03",
"https://security.netapp.com/advisory/ntap-20210219-0009/",
"https://ubuntu.com/security/notices/USN-4738-1",
"https://ubuntu.com/security/notices/USN-5088-1",
"https://www.debian.org/security/2021/dsa-4855",
"https://www.openssl.org/news/secadv/20210216.txt",
"https://www.oracle.com//security-alerts/cpujul2021.html",
"https://www.oracle.com/security-alerts/cpuApr2021.html",
"https://www.oracle.com/security-alerts/cpuapr2022.html",
"https://www.oracle.com/security-alerts/cpujan2022.html",
"https://www.oracle.com/security-alerts/cpuoct2021.html",
"https://www.tenable.com/security/tns-2021-03",
"https://www.tenable.com/security/tns-2021-09",
"https://www.tenable.com/security/tns-2021-10"
],
"PublishedDate": "2021-02-16T17:15:00Z",
"LastModifiedDate": "2022-08-29T20:27:00Z"
},
{
"VulnerabilityID": "CVE-2021-3450",
"PkgName": "libcrypto1.1",
"InstalledVersion": "1.1.1a-r1",
"FixedVersion": "1.1.1k-r0",
"Layer": {
"Digest": "sha256:8e402f1a9c577ded051c1ef10e9fe4492890459522089959988a4852dee8ab2c",
"DiffID": "sha256:bcf2f368fe234217249e00ad9d762d8f1a3156d60c442ed92079fa5b120634a1"
},
"SeveritySource": "nvd",
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2021-3450",
"DataSource": {
"ID": "alpine",
"Name": "Alpine Secdb",
"URL": "https://secdb.alpinelinux.org/"
},
"Title": "openssl: CA certificate check bypass with X509_V_FLAG_X509_STRICT",
"Description": "The X509_V_FLAG_X509_STRICT flag enables additional security checks of the certificates present in a certificate chain. It is not set by default. Starting from OpenSSL version 1.1.1h a check to disallow certificates in the chain that have explicitly encoded elliptic curve parameters was added as an additional strict check. An error in the implementation of this check meant that the result of a previous check to confirm that certificates in the chain are valid CA certificates was overwritten. This effectively bypasses the check that non-CA certificates must not be able to issue other certificates. If a \"purpose\" has been configured then there is a subsequent opportunity for checks that the certificate is a valid CA. All of the named \"purpose\" values implemented in libcrypto perform this check. Therefore, where a purpose is set the certificate chain will still be rejected even when the strict flag has been used. A purpose is set by default in libssl client and server certificate verification routines, but it can be overridden or removed by an application. In order to be affected, an application must explicitly set the X509_V_FLAG_X509_STRICT verification flag and either not set a purpose for the certificate verification or, in the case of TLS client or server applications, override the default purpose. OpenSSL versions 1.1.1h and newer are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1k. OpenSSL 1.0.2 is not impacted by this issue. Fixed in OpenSSL 1.1.1k (Affected 1.1.1h-1.1.1j).",
"Severity": "HIGH",
"CweIDs": ["CWE-295"],
"CVSS": {
"nvd": {
"V2Vector": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
"V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"V2Score": 5.8,
"V3Score": 7.4
},
"redhat": {
"V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"V3Score": 7.4
}
},
"References": [
"http://www.openwall.com/lists/oss-security/2021/03/27/1",
"http://www.openwall.com/lists/oss-security/2021/03/27/2",
"http://www.openwall.com/lists/oss-security/2021/03/28/3",
"http://www.openwall.com/lists/oss-security/2021/03/28/4",
"https://access.redhat.com/security/cve/CVE-2021-3450",
"https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf",
"https://crates.io/crates/openssl-src",
"https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=2a40b7bc7b94dd7de897a74571e7024f0cf0d63b",
"https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44845",
"https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10356",
"https://linux.oracle.com/cve/CVE-2021-3450.html",
"https://linux.oracle.com/errata/ELSA-2021-9151.html",
"https://lists.fedoraproject.org/archives/list/[email protected]/message/CCBFLLVQVILIVGZMBJL3IXZGKWQISYNP/",
"https://mta.openssl.org/pipermail/openssl-announce/2021-March/000198.html",
"https://nvd.nist.gov/vuln/detail/CVE-2021-3450",
"https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0013",
"https://rustsec.org/advisories/RUSTSEC-2021-0056.html",
"https://security.FreeBSD.org/advisories/FreeBSD-SA-21:07.openssl.asc",
"https://security.gentoo.org/glsa/202103-03",
"https://security.netapp.com/advisory/ntap-20210326-0006/",
"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-openssl-2021-GHY28dJd",
"https://www.openssl.org/news/secadv/20210325.txt",
"https://www.oracle.com//security-alerts/cpujul2021.html",
"https://www.oracle.com/security-alerts/cpuApr2021.html",
"https://www.oracle.com/security-alerts/cpuapr2022.html",
"https://www.oracle.com/security-alerts/cpujul2022.html",
"https://www.oracle.com/security-alerts/cpuoct2021.html",
"https://www.tenable.com/security/tns-2021-05",
"https://www.tenable.com/security/tns-2021-08",
"https://www.tenable.com/security/tns-2021-09"
],
"PublishedDate": "2021-03-25T15:15:00Z",
"LastModifiedDate": "2022-07-25T18:16:00Z"
},
{
"VulnerabilityID": "CVE-2019-1547",
"PkgName": "libcrypto1.1",
"InstalledVersion": "1.1.1a-r1",
"FixedVersion": "1.1.1d-r0",
"Layer": {
"Digest": "sha256:8e402f1a9c577ded051c1ef10e9fe4492890459522089959988a4852dee8ab2c",
"DiffID": "sha256:bcf2f368fe234217249e00ad9d762d8f1a3156d60c442ed92079fa5b120634a1"
},
"SeveritySource": "nvd",
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-1547",
"DataSource": {
"ID": "alpine",
"Name": "Alpine Secdb",
"URL": "https://secdb.alpinelinux.org/"
},
"Title": "openssl: side-channel weak encryption vulnerability",
"Description": "Normally in OpenSSL EC groups always have a co-factor present and this is used in side channel resistant code paths. However, in some cases, it is possible to construct a group using explicit parameters (instead of using a named curve). In those cases it is possible that such a group does not have the cofactor present. This can occur even where all the parameters match a known named curve. If such a curve is used then OpenSSL falls back to non-side channel resistant code paths which may result in full key recovery during an ECDSA signature operation. In order to be vulnerable an attacker would have to have the ability to time the creation of a large number of signatures where explicit parameters with no co-factor present are in use by an application using libcrypto. For the avoidance of doubt libssl is not vulnerable because explicit parameters are never used. Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c). Fixed in OpenSSL 1.1.0l (Affected 1.1.0-1.1.0k). Fixed in OpenSSL 1.0.2t (Affected 1.0.2-1.0.2s).",
"Severity": "MEDIUM",
"CVSS": {
"nvd": {
"V2Vector": "AV:L/AC:M/Au:N/C:P/I:N/A:N",
"V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
"V2Score": 1.9,
"V3Score": 4.7
},
"redhat": {
"V3Vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"V3Score": 5.5
}
},
"References": [
"http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00054.html",
"http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00072.html",
"http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00012.html",
"http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00016.html",
"http://packetstormsecurity.com/files/154467/Slackware-Security-Advisory-openssl-Updates.html",
"https://access.redhat.com/security/cve/CVE-2019-1547",
"https://arxiv.org/abs/1909.01785",
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1547",
"https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=21c856b75d81eff61aa63b4f036bb64a85bf6d46",
"https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=30c22fa8b1d840036b8e203585738df62a03cec8",
"https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=7c1709c2da5414f5b6133d00a03fc8c5bf996c7a",
"https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10365",
"https://linux.oracle.com/cve/CVE-2019-1547.html",
"https://linux.oracle.com/errata/ELSA-2020-1840.html",
"https://lists.debian.org/debian-lts-announce/2019/09/msg00026.html",
"https://lists.fedoraproject.org/archives/list/[email protected]/message/GY6SNRJP2S7Y42GIIDO3HXPNMDYN2U3A/",
"https://lists.fedoraproject.org/archives/list/[email protected]/message/ZN4VVQJ3JDCHGIHV4Y2YTXBYQZ6PWQ7E/",
"https://seclists.org/bugtraq/2019/Oct/0",
"https://seclists.org/bugtraq/2019/Oct/1",
"https://seclists.org/bugtraq/2019/Sep/25",
"https://security.gentoo.org/glsa/201911-04",
"https://security.netapp.com/advisory/ntap-20190919-0002/",
"https://security.netapp.com/advisory/ntap-20200122-0002/",
"https://security.netapp.com/advisory/ntap-20200416-0003/",
"https://support.f5.com/csp/article/K73422160?utm_source=f5support\u0026amp;utm_medium=RSS",
"https://ubuntu.com/security/notices/USN-4376-1",
"https://ubuntu.com/security/notices/USN-4376-2",
"https://ubuntu.com/security/notices/USN-4504-1",
"https://usn.ubuntu.com/4376-1/",
"https://usn.ubuntu.com/4376-2/",
"https://usn.ubuntu.com/4504-1/",
"https://www.debian.org/security/2019/dsa-4539",
"https://www.debian.org/security/2019/dsa-4540",
"https://www.openssl.org/news/secadv/20190910.txt",
"https://www.oracle.com/security-alerts/cpuapr2020.html",
"https://www.oracle.com/security-alerts/cpujan2020.html",
"https://www.oracle.com/security-alerts/cpujul2020.html",
"https://www.oracle.com/security-alerts/cpuoct2020.html",
"https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html",
"https://www.tenable.com/security/tns-2019-08",
"https://www.tenable.com/security/tns-2019-09"
],
"PublishedDate": "2019-09-10T17:15:00Z",
"LastModifiedDate": "2021-07-31T08:15:00Z"
},
{
"VulnerabilityID": "CVE-2019-1549",
"PkgName": "libcrypto1.1",
"InstalledVersion": "1.1.1a-r1",
"FixedVersion": "1.1.1d-r0",
"Layer": {
"Digest": "sha256:8e402f1a9c577ded051c1ef10e9fe4492890459522089959988a4852dee8ab2c",
"DiffID": "sha256:bcf2f368fe234217249e00ad9d762d8f1a3156d60c442ed92079fa5b120634a1"
},
"SeveritySource": "nvd",
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-1549",
"DataSource": {
"ID": "alpine",
"Name": "Alpine Secdb",
"URL": "https://secdb.alpinelinux.org/"
},
"Title": "openssl: information disclosure in fork()",
"Description": "OpenSSL 1.1.1 introduced a rewritten random number generator (RNG). This was intended to include protection in the event of a fork() system call in order to ensure that the parent and child processes did not share the same RNG state. However this protection was not being used in the default case. A partial mitigation for this issue is that the output from a high precision timer is mixed into the RNG state so the likelihood of a parent and child process sharing state is significantly reduced. If an application already calls OPENSSL_init_crypto() explicitly using OPENSSL_INIT_ATFORK then this problem does not occur at all. Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c).",
"Severity": "MEDIUM",
"CweIDs": ["CWE-330"],
"CVSS": {
"nvd": {
"V2Vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"V2Score": 5,
"V3Score": 5.3
},
"redhat": {
"V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
"V3Score": 4.8
}
},
"References": [
"https://access.redhat.com/security/cve/CVE-2019-1549",
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1549",
"https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=1b0fe00e2704b5e20334a16d3c9099d1ba2ef1be",
"https://linux.oracle.com/cve/CVE-2019-1549.html",
"https://linux.oracle.com/errata/ELSA-2020-1840.html",
"https://lists.fedoraproject.org/archives/list/[email protected]/message/GY6SNRJP2S7Y42GIIDO3HXPNMDYN2U3A/",
"https://lists.fedoraproject.org/archives/list/[email protected]/message/ZN4VVQJ3JDCHGIHV4Y2YTXBYQZ6PWQ7E/",
"https://seclists.org/bugtraq/2019/Oct/1",
"https://security.netapp.com/advisory/ntap-20190919-0002/",
"https://support.f5.com/csp/article/K44070243",
"https://support.f5.com/csp/article/K44070243?utm_source=f5support\u0026amp;utm_medium=RSS",
"https://ubuntu.com/security/notices/USN-4376-1",
"https://usn.ubuntu.com/4376-1/",
"https://www.debian.org/security/2019/dsa-4539",
"https://www.openssl.org/news/secadv/20190910.txt",
"https://www.oracle.com/security-alerts/cpuapr2020.html",
"https://www.oracle.com/security-alerts/cpujan2020.html",
"https://www.oracle.com/security-alerts/cpujul2020.html",
"https://www.oracle.com/security-alerts/cpuoct2020.html",
"https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"
],
"PublishedDate": "2019-09-10T17:15:00Z",
"LastModifiedDate": "2020-10-20T22:15:00Z"
},
{
"VulnerabilityID": "CVE-2019-1551",
"PkgName": "libcrypto1.1",
"InstalledVersion": "1.1.1a-r1",
"FixedVersion": "1.1.1d-r2",
"Layer": {
"Digest": "sha256:8e402f1a9c577ded051c1ef10e9fe4492890459522089959988a4852dee8ab2c",
"DiffID": "sha256:bcf2f368fe234217249e00ad9d762d8f1a3156d60c442ed92079fa5b120634a1"
},
"SeveritySource": "nvd",
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-1551",
"DataSource": {
"ID": "alpine",
"Name": "Alpine Secdb",
"URL": "https://secdb.alpinelinux.org/"
},
"Title": "openssl: Integer overflow in RSAZ modular exponentiation on x86_64",
"Description": "There is an overflow bug in the x64_64 Montgomery squaring procedure used in exponentiation with 512-bit moduli. No EC algorithms are affected. Analysis suggests that attacks against 2-prime RSA1024, 3-prime RSA1536, and DSA1024 as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH512 are considered just feasible. However, for an attack the target would have to re-use the DH512 private key, which is not recommended anyway. Also applications directly using the low level API BN_mod_exp may be affected if they use BN_FLG_CONSTTIME. Fixed in OpenSSL 1.1.1e (Affected 1.1.1-1.1.1d). Fixed in OpenSSL 1.0.2u (Affected 1.0.2-1.0.2t).",
"Severity": "MEDIUM",
"CweIDs": ["CWE-190"],
"CVSS": {
"nvd": {
"V2Vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"V2Score": 5,
"V3Score": 5.3
},
"redhat": {
"V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
"V3Score": 4.8
}
},
"References": [
"http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00030.html",
"http://packetstormsecurity.com/files/155754/Slackware-Security-Advisory-openssl-Updates.html",
"https://access.redhat.com/security/cve/CVE-2019-1551",
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1551",
"https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=419102400a2811582a7a3d4a4e317d72e5ce0a8f",
"https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=f1c5eea8a817075d31e43f5876993c6710238c98",
"https://github.com/openssl/openssl/pull/10575",
"https://linux.oracle.com/cve/CVE-2019-1551.html",
"https://linux.oracle.com/errata/ELSA-2020-4514.html",
"https://lists.debian.org/debian-lts-announce/2022/03/msg00023.html",
"https://lists.fedoraproject.org/archives/list/[email protected]/message/DDHOAATPWJCXRNFMJ2SASDBBNU5RJONY/",
"https://lists.fedoraproject.org/archives/list/[email protected]/message/EXDDAOWSAIEFQNBHWYE6PPYFV4QXGMCD/",
"https://lists.fedoraproject.org/archives/list/[email protected]/message/XVEP3LAK4JSPRXFO4QF4GG2IVXADV3SO/",
"https://seclists.org/bugtraq/2019/Dec/39",
"https://seclists.org/bugtraq/2019/Dec/46",
"https://security.gentoo.org/glsa/202004-10",
"https://security.netapp.com/advisory/ntap-20191210-0001/",
"https://ubuntu.com/security/notices/USN-4376-1",
"https://ubuntu.com/security/notices/USN-4504-1",
"https://usn.ubuntu.com/4376-1/",
"https://usn.ubuntu.com/4504-1/",
"https://www.debian.org/security/2019/dsa-4594",
"https://www.debian.org/security/2021/dsa-4855",
"https://www.openssl.org/news/secadv/20191206.txt",
"https://www.oracle.com/security-alerts/cpuApr2021.html",
"https://www.oracle.com/security-alerts/cpujan2021.html",
"https://www.oracle.com/security-alerts/cpujul2020.html",
"https://www.tenable.com/security/tns-2019-09",
"https://www.tenable.com/security/tns-2020-03",
"https://www.tenable.com/security/tns-2020-11",
"https://www.tenable.com/security/tns-2021-10"
],
"PublishedDate": "2019-12-06T18:15:00Z",
"LastModifiedDate": "2022-04-19T15:36:00Z"
},
{
"VulnerabilityID": "CVE-2020-1971",
"PkgName": "libcrypto1.1",
"InstalledVersion": "1.1.1a-r1",
"FixedVersion": "1.1.1i-r0",
"Layer": {
"Digest": "sha256:8e402f1a9c577ded051c1ef10e9fe4492890459522089959988a4852dee8ab2c",
"DiffID": "sha256:bcf2f368fe234217249e00ad9d762d8f1a3156d60c442ed92079fa5b120634a1"
},
"SeveritySource": "nvd",
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2020-1971",
"DataSource": {
"ID": "alpine",
"Name": "Alpine Secdb",
"URL": "https://secdb.alpinelinux.org/"
},
"Title": "openssl: EDIPARTYNAME NULL pointer de-reference",
"Description": "The X.509 GeneralName type is a generic type for representing different types of names. One of those name types is known as EDIPartyName. OpenSSL provides a function GENERAL_NAME_cmp which compares different instances of a GENERAL_NAME to see if they are equal or not. This function behaves incorrectly when both GENERAL_NAMEs contain an EDIPARTYNAME. A NULL pointer dereference and a crash may occur leading to a possible denial of service attack. OpenSSL itself uses the GENERAL_NAME_cmp function for two purposes: 1) Comparing CRL distribution point names between an available CRL and a CRL distribution point embedded in an X509 certificate 2) When verifying that a timestamp response token signer matches the timestamp authority name (exposed via the API functions TS_RESP_verify_response and TS_RESP_verify_token) If an attacker can control both items being compared then that attacker could trigger a crash. For example if the attacker can trick a client or server into checking a malicious certificate against a malicious CRL then this may occur. Note that some applications automatically download CRLs based on a URL embedded in a certificate. This checking happens prior to the signatures on the certificate and CRL being verified. OpenSSL's s_server, s_client and verify tools have support for the \"-crl_download\" option which implements automatic CRL downloading and this attack has been demonstrated to work against those tools. Note that an unrelated bug means that affected versions of OpenSSL cannot parse or construct correct encodings of EDIPARTYNAME. However it is possible to construct a malformed EDIPARTYNAME that OpenSSL's parser will accept and hence trigger this attack. All OpenSSL 1.1.1 and 1.0.2 versions are affected by this issue. Other OpenSSL releases are out of support and have not been checked. Fixed in OpenSSL 1.1.1i (Affected 1.1.1-1.1.1h). Fixed in OpenSSL 1.0.2x (Affected 1.0.2-1.0.2w).",
"Severity": "MEDIUM",
"CweIDs": ["CWE-476"],
"CVSS": {
"nvd": {
"V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
"V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"V2Score": 4.3,
"V3Score": 5.9
},
"redhat": {
"V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"V3Score": 5.9
}
},
"References": [
"http://www.openwall.com/lists/oss-security/2021/09/14/2",
"https://access.redhat.com/security/cve/CVE-2020-1971",
"https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf",
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1971",
"https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=2154ab83e14ede338d2ede9bbe5cdfce5d5a6c9e",
"https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=f960d81215ebf3f65e03d4d5d857fb9b666d6920",
"https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44676",
"https://linux.oracle.com/cve/CVE-2020-1971.html",
"https://linux.oracle.com/errata/ELSA-2021-9150.html",
"https://lists.apache.org/thread.html/r63c6f2dd363d9b514d0a4bcf624580616a679898cc14c109a49b750c@%3Cdev.tomcat.apache.org%3E",
"https://lists.apache.org/thread.html/rbb769f771711fb274e0a4acb1b5911c8aab544a6ac5e8c12d40c5143@%3Ccommits.pulsar.apache.org%3E",
"https://lists.debian.org/debian-lts-announce/2020/12/msg00020.html",
"https://lists.debian.org/debian-lts-announce/2020/12/msg00021.html",
"https://lists.fedoraproject.org/archives/list/[email protected]/message/DGSI34Y5LQ5RYXN4M2I5ZQT65LFVDOUU/",
"https://lists.fedoraproject.org/archives/list/[email protected]/message/PWPSSZNZOBJU2YR6Z4TGHXKYW3YP5QG7/",
"https://nvd.nist.gov/vuln/detail/CVE-2020-1971",
"https://security.FreeBSD.org/advisories/FreeBSD-SA-20:33.openssl.asc",
"https://security.gentoo.org/glsa/202012-13",
"https://security.netapp.com/advisory/ntap-20201218-0005/",
"https://security.netapp.com/advisory/ntap-20210513-0002/",
"https://ubuntu.com/security/notices/USN-4662-1",
"https://ubuntu.com/security/notices/USN-4745-1",
"https://www.debian.org/security/2020/dsa-4807",
"https://www.openssl.org/news/secadv/20201208.txt",
"https://www.oracle.com//security-alerts/cpujul2021.html",
"https://www.oracle.com/security-alerts/cpuApr2021.html",
"https://www.oracle.com/security-alerts/cpuapr2022.html",
"https://www.oracle.com/security-alerts/cpujan2021.html",
"https://www.oracle.com/security-alerts/cpuoct2021.html",
"https://www.tenable.com/security/tns-2020-11",
"https://www.tenable.com/security/tns-2021-09",
"https://www.tenable.com/security/tns-2021-10"
],
"PublishedDate": "2020-12-08T16:15:00Z",
"LastModifiedDate": "2022-08-29T20:27:00Z"
},
{
"VulnerabilityID": "CVE-2021-23841",
"PkgName": "libcrypto1.1",
"InstalledVersion": "1.1.1a-r1",
"FixedVersion": "1.1.1j-r0",
"Layer": {
"Digest": "sha256:8e402f1a9c577ded051c1ef10e9fe4492890459522089959988a4852dee8ab2c",
"DiffID": "sha256:bcf2f368fe234217249e00ad9d762d8f1a3156d60c442ed92079fa5b120634a1"
},
"SeveritySource": "nvd",
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2021-23841",
"DataSource": {
"ID": "alpine",
"Name": "Alpine Secdb",
"URL": "https://secdb.alpinelinux.org/"
},
"Title": "openssl: NULL pointer dereference in X509_issuer_and_serial_hash()",
"Description": "The OpenSSL public API function X509_issuer_and_serial_hash() attempts to create a unique hash value based on the issuer and serial number data contained within an X509 certificate. However it fails to correctly handle any errors that may occur while parsing the issuer field (which might occur if the issuer field is maliciously constructed). This may subsequently result in a NULL pointer deref and a crash leading to a potential denial of service attack. The function X509_issuer_and_serial_hash() is never directly called by OpenSSL itself so applications are only vulnerable if they use this function directly and they use it on certificates that may have been obtained from untrusted sources. OpenSSL versions 1.1.1i and below are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1j. OpenSSL versions 1.0.2x and below are affected by this issue. However OpenSSL 1.0.2 is out of support and no longer receiving public updates. Premium support customers of OpenSSL 1.0.2 should upgrade to 1.0.2y. Other users should upgrade to 1.1.1j. Fixed in OpenSSL 1.1.1j (Affected 1.1.1-1.1.1i). Fixed in OpenSSL 1.0.2y (Affected 1.0.2-1.0.2x).",
"Severity": "MEDIUM",
"CVSS": {
"nvd": {
"V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
"V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"V2Score": 4.3,
"V3Score": 5.9
},
"redhat": {
"V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"V3Score": 5.9
}
},
"References": [
"http://seclists.org/fulldisclosure/2021/May/67",
"http://seclists.org/fulldisclosure/2021/May/68",
"http://seclists.org/fulldisclosure/2021/May/70",
"https://access.redhat.com/security/cve/CVE-2021-23841",
"https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf",
"https://crates.io/crates/openssl-src",
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23841",
"https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=122a19ab48091c657f7cb1fb3af9fc07bd557bbf",
"https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=8252ee4d90f3f2004d3d0aeeed003ad49c9a7807",
"https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44846",
"https://linux.oracle.com/cve/CVE-2021-23841.html",
"https://linux.oracle.com/errata/ELSA-2021-9561.html",
"https://nvd.nist.gov/vuln/detail/CVE-2021-23841",
"https://rustsec.org/advisories/RUSTSEC-2021-0058.html",
"https://security.gentoo.org/glsa/202103-03",
"https://security.netapp.com/advisory/ntap-20210219-0009/",
"https://security.netapp.com/advisory/ntap-20210513-0002/",
"https://support.apple.com/kb/HT212528",
"https://support.apple.com/kb/HT212529",
"https://support.apple.com/kb/HT212534",
"https://ubuntu.com/security/notices/USN-4738-1",
"https://ubuntu.com/security/notices/USN-4745-1",
"https://www.debian.org/security/2021/dsa-4855",
"https://www.openssl.org/news/secadv/20210216.txt",
"https://www.oracle.com//security-alerts/cpujul2021.html",
"https://www.oracle.com/security-alerts/cpuApr2021.html",
"https://www.oracle.com/security-alerts/cpuapr2022.html",
"https://www.oracle.com/security-alerts/cpuoct2021.html",
"https://www.tenable.com/security/tns-2021-03",
"https://www.tenable.com/security/tns-2021-09"
],
"PublishedDate": "2021-02-16T17:15:00Z",
"LastModifiedDate": "2022-09-13T12:15:00Z"
},
{
"VulnerabilityID": "CVE-2021-3449",
"PkgName": "libcrypto1.1",
"InstalledVersion": "1.1.1a-r1",
"FixedVersion": "1.1.1k-r0",
"Layer": {
"Digest": "sha256:8e402f1a9c577ded051c1ef10e9fe4492890459522089959988a4852dee8ab2c",
"DiffID": "sha256:bcf2f368fe234217249e00ad9d762d8f1a3156d60c442ed92079fa5b120634a1"
},
"SeveritySource": "nvd",
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2021-3449",
"DataSource": {
"ID": "alpine",
"Name": "Alpine Secdb",
"URL": "https://secdb.alpinelinux.org/"
},
"Title": "openssl: NULL pointer dereference in signature_algorithms processing",
"Description": "An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. If a TLSv1.2 renegotiation ClientHello omits the signature_algorithms extension (where it was present in the initial ClientHello), but includes a signature_algorithms_cert extension then a NULL pointer dereference will result, leading to a crash and a denial of service attack. A server is only vulnerable if it has TLSv1.2 and renegotiation enabled (which is the default configuration). OpenSSL TLS clients are not impacted by this issue. All OpenSSL 1.1.1 versions are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1k. OpenSSL 1.0.2 is not impacted by this issue. Fixed in OpenSSL 1.1.1k (Affected 1.1.1-1.1.1j).",
"Severity": "MEDIUM",
"CweIDs": ["CWE-476"],
"CVSS": {
"nvd": {
"V2Vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
"V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"V2Score": 4.3,
"V3Score": 5.9
},
"redhat": {
"V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"V3Score": 5.9
}
},
"References": [
"http://www.openwall.com/lists/oss-security/2021/03/27/1",
"http://www.openwall.com/lists/oss-security/2021/03/27/2",
"http://www.openwall.com/lists/oss-security/2021/03/28/3",
"http://www.openwall.com/lists/oss-security/2021/03/28/4",
"https://access.redhat.com/security/cve/CVE-2021-3449",
"https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf",
"https://cert-portal.siemens.com/productcert/pdf/ssa-772220.pdf",
"https://crates.io/crates/openssl-src",
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3449",
"https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=fb9fa6b51defd48157eeb207f52181f735d96148",
"https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44845",
"https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10356",
"https://linux.oracle.com/cve/CVE-2021-3449.html",
"https://linux.oracle.com/errata/ELSA-2021-9151.html",
"https://lists.debian.org/debian-lts-announce/2021/08/msg00029.html",
"https://lists.fedoraproject.org/archives/list/[email protected]/message/CCBFLLVQVILIVGZMBJL3IXZGKWQISYNP/",
"https://nvd.nist.gov/vuln/detail/CVE-2021-3449",
"https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0013",
"https://rustsec.org/advisories/RUSTSEC-2021-0055.html",
"https://security.FreeBSD.org/advisories/FreeBSD-SA-21:07.openssl.asc",
"https://security.gentoo.org/glsa/202103-03",
"https://security.netapp.com/advisory/ntap-20210326-0006/",
"https://security.netapp.com/advisory/ntap-20210513-0002/",
"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-openssl-2021-GHY28dJd",
"https://ubuntu.com/security/notices/USN-4891-1",
"https://ubuntu.com/security/notices/USN-5038-1",
"https://www.debian.org/security/2021/dsa-4875",
"https://www.openssl.org/news/secadv/20210325.txt",
"https://www.oracle.com//security-alerts/cpujul2021.html",
"https://www.oracle.com/security-alerts/cpuApr2021.html",
"https://www.oracle.com/security-alerts/cpuapr2022.html",
"https://www.oracle.com/security-alerts/cpujul2022.html",
"https://www.oracle.com/security-alerts/cpuoct2021.html",
"https://www.tenable.com/security/tns-2021-05",
"https://www.tenable.com/security/tns-2021-06",
"https://www.tenable.com/security/tns-2021-09",
"https://www.tenable.com/security/tns-2021-10"
],
"PublishedDate": "2021-03-25T15:15:00Z",
"LastModifiedDate": "2022-08-29T20:27:00Z"
},
{
"VulnerabilityID": "CVE-2019-1563",
"PkgName": "libcrypto1.1",
"InstalledVersion": "1.1.1a-r1",
"FixedVersion": "1.1.1d-r0",
"Layer": {
"Digest": "sha256:8e402f1a9c577ded051c1ef10e9fe4492890459522089959988a4852dee8ab2c",
"DiffID": "sha256:bcf2f368fe234217249e00ad9d762d8f1a3156d60c442ed92079fa5b120634a1"
},
"SeveritySource": "nvd",
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-1563",
"DataSource": {
"ID": "alpine",
"Name": "Alpine Secdb",
"URL": "https://secdb.alpinelinux.org/"
},
"Title": "openssl: information disclosure in PKCS7_dataDecode and CMS_decrypt_set1_pkey",
"Description": "In situations where an attacker receives automated notification of the success or failure of a decryption attempt an attacker, after sending a very large number of messages to be decrypted, can recover a CMS/PKCS7 transported encryption key or decrypt any RSA encrypted message that was encrypted with the public RSA key, using a Bleichenbacher padding oracle attack. Applications are not affected if they use a certificate together with the private RSA key to the CMS_decrypt or PKCS7_decrypt functions to select the correct recipient info to decrypt. Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c). Fixed in OpenSSL 1.1.0l (Affected 1.1.0-1.1.0k). Fixed in OpenSSL 1.0.2t (Affected 1.0.2-1.0.2s).",
"Severity": "LOW",
"CweIDs": ["CWE-327", "CWE-203"],
"CVSS": {
"nvd": {
"V2Vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
"V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
"V2Score": 4.3,
"V3Score": 3.7
},
"redhat": {
"V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
"V3Score": 3.7
}
},
"References": [
"http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00054.html",
"http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00072.html",
"http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00012.html",
"http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00016.html",
"http://packetstormsecurity.com/files/154467/Slackware-Security-Advisory-openssl-Updates.html",
"https://access.redhat.com/security/cve/CVE-2019-1563",
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1563",
"https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=08229ad838c50f644d7e928e2eef147b4308ad64",
"https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=631f94db0065c78181ca9ba5546ebc8bb3884b97",
"https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=e21f8cf78a125cd3c8c0d1a1a6c8bb0b901f893f",
"https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10365",
"https://linux.oracle.com/cve/CVE-2019-1563.html",
"https://linux.oracle.com/errata/ELSA-2020-1840.html",
"https://lists.debian.org/debian-lts-announce/2019/09/msg00026.html",
"https://lists.fedoraproject.org/archives/list/[email protected]/message/GY6SNRJP2S7Y42GIIDO3HXPNMDYN2U3A/",
"https://lists.fedoraproject.org/archives/list/[email protected]/message/ZN4VVQJ3JDCHGIHV4Y2YTXBYQZ6PWQ7E/",
"https://seclists.org/bugtraq/2019/Oct/0",
"https://seclists.org/bugtraq/2019/Oct/1",
"https://seclists.org/bugtraq/2019/Sep/25",
"https://security.gentoo.org/glsa/201911-04",
"https://security.netapp.com/advisory/ntap-20190919-0002/",
"https://support.f5.com/csp/article/K97324400?utm_source=f5support\u0026amp;utm_medium=RSS",
"https://ubuntu.com/security/notices/USN-4376-1",
"https://ubuntu.com/security/notices/USN-4376-2",
"https://ubuntu.com/security/notices/USN-4504-1",
"https://usn.ubuntu.com/4376-1/",
"https://usn.ubuntu.com/4376-2/",
"https://usn.ubuntu.com/4504-1/",
"https://www.debian.org/security/2019/dsa-4539",
"https://www.debian.org/security/2019/dsa-4540",
"https://www.openssl.org/news/secadv/20190910.txt",
"https://www.oracle.com/security-alerts/cpuapr2020.html",
"https://www.oracle.com/security-alerts/cpujan2020.html",
"https://www.oracle.com/security-alerts/cpujul2020.html",
"https://www.oracle.com/security-alerts/cpuoct2020.html",
"https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html",
"https://www.tenable.com/security/tns-2019-09"
],
"PublishedDate": "2019-09-10T17:15:00Z",
"LastModifiedDate": "2021-07-31T08:15:00Z"
},
{
"VulnerabilityID": "CVE-2021-23839",
"PkgName": "libcrypto1.1",
"InstalledVersion": "1.1.1a-r1",
"FixedVersion": "1.1.1j-r0",
"Layer": {
"Digest": "sha256:8e402f1a9c577ded051c1ef10e9fe4492890459522089959988a4852dee8ab2c",
"DiffID": "sha256:bcf2f368fe234217249e00ad9d762d8f1a3156d60c442ed92079fa5b120634a1"
},
"SeveritySource": "nvd",
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2021-23839",
"DataSource": {
"ID": "alpine",
"Name": "Alpine Secdb",
"URL": "https://secdb.alpinelinux.org/"
},
"Title": "openssl: incorrect SSLv2 rollback protection",
"Description": "OpenSSL 1.0.2 supports SSLv2. If a client attempts to negotiate SSLv2 with a server that is configured to support both SSLv2 and more recent SSL and TLS versions then a check is made for a version rollback attack when unpadding an RSA signature. Clients that support SSL or TLS versions greater than SSLv2 are supposed to use a special form of padding. A server that supports greater than SSLv2 is supposed to reject connection attempts from a client where this special form of padding is present, because this indicates that a version rollback has occurred (i.e. both client and server support greater than SSLv2, and yet this is the version that is being requested). The implementation of this padding check inverted the logic so that the connection attempt is accepted if the padding is present, and rejected if it is absent. This means that such as server will accept a connection if a version rollback attack has occurred. Further the server will erroneously reject a connection if a normal SSLv2 connection attempt is made. Only OpenSSL 1.0.2 servers from version 1.0.2s to 1.0.2x are affected by this issue. In order to be vulnerable a 1.0.2 server must: 1) have configured SSLv2 support at compile time (this is off by default), 2) have configured SSLv2 support at runtime (this is off by default), 3) have configured SSLv2 ciphersuites (these are not in the default ciphersuite list) OpenSSL 1.1.1 does not have SSLv2 support and therefore is not vulnerable to this issue. The underlying error is in the implementation of the RSA_padding_check_SSLv23() function. This also affects the RSA_SSLV23_PADDING padding mode used by various other functions. Although 1.1.1 does not support SSLv2 the RSA_padding_check_SSLv23() function still exists, as does the RSA_SSLV23_PADDING padding mode. Applications that directly call that function or use that padding mode will encounter this issue. However since there is no support for the SSLv2 protocol in 1.1.1 this is considered a bug and not a security issue in that version. OpenSSL 1.0.2 is out of support and no longer receiving public updates. Premium support customers of OpenSSL 1.0.2 should upgrade to 1.0.2y. Other users should upgrade to 1.1.1j. Fixed in OpenSSL 1.0.2y (Affected 1.0.2s-1.0.2x).",
"Severity": "LOW",
"CweIDs": ["CWE-326"],
"CVSS": {
"nvd": {
"V2Vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
"V2Score": 4.3,
"V3Score": 3.7
},
"redhat": {
"V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
"V3Score": 3.7
}
},
"References": [
"https://access.redhat.com/security/cve/CVE-2021-23839",
"https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf",
"https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=30919ab80a478f2d81f2e9acdcca3fa4740cd547",
"https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44846",
"https://nvd.nist.gov/vuln/detail/CVE-2021-23839",
"https://security.netapp.com/advisory/ntap-20210219-0009/",
"https://www.openssl.org/news/secadv/20210216.txt",
"https://www.oracle.com//security-alerts/cpujul2021.html",
"https://www.oracle.com/security-alerts/cpuApr2021.html",
"https://www.oracle.com/security-alerts/cpuapr2022.html",
"https://www.oracle.com/security-alerts/cpuoct2021.html"
],
"PublishedDate": "2021-02-16T17:15:00Z",
"LastModifiedDate": "2022-09-13T12:15:00Z"
},
{
"VulnerabilityID": "CVE-2019-1543",
"PkgName": "libssl1.1",
"InstalledVersion": "1.1.1a-r1",
"FixedVersion": "1.1.1b-r1",
"Layer": {
"Digest": "sha256:8e402f1a9c577ded051c1ef10e9fe4492890459522089959988a4852dee8ab2c",
"DiffID": "sha256:bcf2f368fe234217249e00ad9d762d8f1a3156d60c442ed92079fa5b120634a1"
},
"SeveritySource": "nvd",
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-1543",
"DataSource": {
"ID": "alpine",
"Name": "Alpine Secdb",
"URL": "https://secdb.alpinelinux.org/"
},
"Title": "openssl: ChaCha20-Poly1305 with long nonces",
"Description": "ChaCha20-Poly1305 is an AEAD cipher, and requires a unique nonce input for every encryption operation. RFC 7539 specifies that the nonce value (IV) should be 96 bits (12 bytes). OpenSSL allows a variable nonce length and front pads the nonce with 0 bytes if it is less than 12 bytes. However it also incorrectly allows a nonce to be set of up to 16 bytes. In this case only the last 12 bytes are significant and any additional leading bytes are ignored. It is a requirement of using this cipher that nonce values are unique. Messages encrypted using a reused nonce value are susceptible to serious confidentiality and integrity attacks. If an application changes the default nonce length to be longer than 12 bytes and then makes a change to the leading bytes of the nonce expecting the new value to be a new unique nonce then such an application could inadvertently encrypt messages with a reused nonce. Additionally the ignored bytes in a long nonce are not covered by the integrity guarantee of this cipher. Any application that relies on the integrity of these ignored leading bytes of a long nonce may be further affected. Any OpenSSL internal use of this cipher, including in SSL/TLS, is safe because no such use sets such a long nonce value. However user applications that use this cipher directly and set a non-default nonce length to be longer than 12 bytes may be vulnerable. OpenSSL versions 1.1.1 and 1.1.0 are affected by this issue. Due to the limited scope of affected deployments this has been assessed as low severity and therefore we are not creating new releases at this time. Fixed in OpenSSL 1.1.1c (Affected 1.1.1-1.1.1b). Fixed in OpenSSL 1.1.0k (Affected 1.1.0-1.1.0j).",
"Severity": "HIGH",
"CweIDs": ["CWE-327", "CWE-330"],
"CVSS": {
"nvd": {
"V2Vector": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
"V3Vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"V2Score": 5.8,
"V3Score": 7.4
},
"redhat": {
"V3Vector": "CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
"V3Score": 2.9
}
},
"References": [
"http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00056.html",
"https://access.redhat.com/errata/RHSA-2019:3700",
"https://access.redhat.com/security/cve/CVE-2019-1543",
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1543",
"https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=ee22257b1418438ebaf54df98af4e24f494d1809",
"https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=f426625b6ae9a7831010750490a5f0ad689c5ba3",
"https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10365",
"https://linux.oracle.com/cve/CVE-2019-1543.html",
"https://linux.oracle.com/errata/ELSA-2019-3700.html",
"https://lists.fedoraproject.org/archives/list/[email protected]/message/Y3IVFGSERAZLNJCK35TEM2R4726XIH3Z/",
"https://lists.fedoraproject.org/archives/list/[email protected]/message/ZBEV5QGDRFUZDMNECFXUSN5FMYOZDE4V/",
"https://seclists.org/bugtraq/2019/Jul/3",
"https://www.debian.org/security/2019/dsa-4475",
"https://www.openssl.org/news/secadv/20190306.txt",
"https://www.oracle.com/security-alerts/cpuapr2020.html",
"https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html",
"https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"
],
"PublishedDate": "2019-03-06T21:29:00Z",
"LastModifiedDate": "2021-07-31T08:15:00Z"
},
{
"VulnerabilityID": "CVE-2020-1967",
"PkgName": "libssl1.1",
"InstalledVersion": "1.1.1a-r1",
"FixedVersion": "1.1.1g-r0",
"Layer": {
"Digest": "sha256:8e402f1a9c577ded051c1ef10e9fe4492890459522089959988a4852dee8ab2c",
"DiffID": "sha256:bcf2f368fe234217249e00ad9d762d8f1a3156d60c442ed92079fa5b120634a1"
},
"SeveritySource": "nvd",
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2020-1967",
"DataSource": {
"ID": "alpine",
"Name": "Alpine Secdb",
"URL": "https://secdb.alpinelinux.org/"
},
"Title": "openssl: Segmentation fault in SSL_check_chain causes denial of service",
"Description": "Server or client applications that call the SSL_check_chain() function during or after a TLS 1.3 handshake may crash due to a NULL pointer dereference as a result of incorrect handling of the \"signature_algorithms_cert\" TLS extension. The crash occurs if an invalid or unrecognised signature algorithm is received from the peer. This could be exploited by a malicious peer in a Denial of Service attack. OpenSSL version 1.1.1d, 1.1.1e, and 1.1.1f are affected by this issue. This issue did not affect OpenSSL versions prior to 1.1.1d. Fixed in OpenSSL 1.1.1g (Affected 1.1.1d-1.1.1f).",
"Severity": "HIGH",
"CweIDs": ["CWE-476"],
"CVSS": {
"nvd": {
"V2Vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"V2Score": 5,
"V3Score": 7.5
},
"redhat": {
"V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"V3Score": 7.5
}
},
"References": [
"http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00004.html",
"http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00011.html",
"http://packetstormsecurity.com/files/157527/OpenSSL-signature_algorithms_cert-Denial-Of-Service.html",
"http://seclists.org/fulldisclosure/2020/May/5",
"http://www.openwall.com/lists/oss-security/2020/04/22/2",
"https://access.redhat.com/security/cve/CVE-2020-1967",
"https://crates.io/crates/openssl-src",
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1967",
"https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=eb563247aef3e83dda7679c43f9649270462e5b1",
"https://github.com/irsl/CVE-2020-1967",
"https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44440",
"https://lists.apache.org/thread.html/r66ea9c436da150683432db5fbc8beb8ae01886c6459ac30c2cea7345@%3Cdev.tomcat.apache.org%3E",
"https://lists.apache.org/thread.html/r94d6ac3f010a38fccf4f432b12180a13fa1cf303559bd805648c9064@%3Cdev.tomcat.apache.org%3E",
"https://lists.apache.org/thread.html/r9a41e304992ce6aec6585a87842b4f2e692604f5c892c37e3b0587ee@%3Cdev.tomcat.apache.org%3E",
"https://lists.fedoraproject.org/archives/list/[email protected]/message/DDHOAATPWJCXRNFMJ2SASDBBNU5RJONY/",
"https://lists.fedoraproject.org/archives/list/[email protected]/message/EXDDAOWSAIEFQNBHWYE6PPYFV4QXGMCD/",
"https://lists.fedoraproject.org/archives/list/[email protected]/message/XVEP3LAK4JSPRXFO4QF4GG2IVXADV3SO/",
"https://nvd.nist.gov/vuln/detail/CVE-2020-1967",
"https://rustsec.org/advisories/RUSTSEC-2020-0015.html",
"https://security.FreeBSD.org/advisories/FreeBSD-SA-20:11.openssl.asc",
"https://security.gentoo.org/glsa/202004-10",
"https://security.netapp.com/advisory/ntap-20200424-0003/",
"https://security.netapp.com/advisory/ntap-20200717-0004/",
"https://www.debian.org/security/2020/dsa-4661",
"https://www.openssl.org/news/secadv/20200421.txt",
"https://www.oracle.com//security-alerts/cpujul2021.html",
"https://www.oracle.com/security-alerts/cpuApr2021.html",
"https://www.oracle.com/security-alerts/cpujan2021.html",
"https://www.oracle.com/security-alerts/cpujul2020.html",
"https://www.oracle.com/security-alerts/cpuoct2020.html",
"https://www.oracle.com/security-alerts/cpuoct2021.html",
"https://www.synology.com/security/advisory/Synology_SA_20_05",
"https://www.synology.com/security/advisory/Synology_SA_20_05_OpenSSL",
"https://www.tenable.com/security/tns-2020-03",
"https://www.tenable.com/security/tns-2020-04",
"https://www.tenable.com/security/tns-2020-11",
"https://www.tenable.com/security/tns-2021-10"
],
"PublishedDate": "2020-04-21T14:15:00Z",
"LastModifiedDate": "2021-12-10T17:11:00Z"
},
{
"VulnerabilityID": "CVE-2021-23840",
"PkgName": "libssl1.1",
"InstalledVersion": "1.1.1a-r1",
"FixedVersion": "1.1.1j-r0",
"Layer": {
"Digest": "sha256:8e402f1a9c577ded051c1ef10e9fe4492890459522089959988a4852dee8ab2c",
"DiffID": "sha256:bcf2f368fe234217249e00ad9d762d8f1a3156d60c442ed92079fa5b120634a1"
},
"SeveritySource": "nvd",
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2021-23840",
"DataSource": {
"ID": "alpine",
"Name": "Alpine Secdb",
"URL": "https://secdb.alpinelinux.org/"
},
"Title": "openssl: integer overflow in CipherUpdate",
"Description": "Calls to EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate may overflow the output length argument in some cases where the input length is close to the maximum permissable length for an integer on the platform. In such cases the return value from the function call will be 1 (indicating success), but the output length value will be negative. This could cause applications to behave incorrectly or crash. OpenSSL versions 1.1.1i and below are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1j. OpenSSL versions 1.0.2x and below are affected by this issue. However OpenSSL 1.0.2 is out of support and no longer receiving public updates. Premium support customers of OpenSSL 1.0.2 should upgrade to 1.0.2y. Other users should upgrade to 1.1.1j. Fixed in OpenSSL 1.1.1j (Affected 1.1.1-1.1.1i). Fixed in OpenSSL 1.0.2y (Affected 1.0.2-1.0.2x).",
"Severity": "HIGH",
"CweIDs": ["CWE-190"],
"CVSS": {
"nvd": {