Vulnerabilities > Openssl

DATE CVE VULNERABILITY TITLE RISK
2021-03-25 CVE-2021-3450 Improper Certificate Validation vulnerability in multiple products
The X509_V_FLAG_X509_STRICT flag enables additional security checks of the certificates present in a certificate chain.
5.8
2021-03-25 CVE-2021-3449 Null Pointer Dereference vulnerability in multiple products
An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client.
4.3
2021-02-16 CVE-2021-23841 Integer Overflow OR Wraparound vulnerability in multiple products
The OpenSSL public API function X509_issuer_and_serial_hash() attempts to create a unique hash value based on the issuer and serial number data contained within an X509 certificate.
4.3
2021-02-16 CVE-2021-23840 Integer Overflow OR Wraparound vulnerability in multiple products
Calls to EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate may overflow the output length argument in some cases where the input length is close to the maximum permissable length for an integer on the platform.
network
low complexity
openssl debian tenable oracle CWE-190
5.0
2021-02-16 CVE-2021-23839 Inadequate Encryption Strength vulnerability in multiple products
OpenSSL 1.0.2 supports SSLv2.
4.3
2020-12-08 CVE-2020-1971 Null Pointer Dereference vulnerability in multiple products
The X.509 GeneralName type is a generic type for representing different types of names.
4.3
2020-09-09 CVE-2020-1968 Inadequate Encryption Strength vulnerability in multiple products
The Raccoon attack exploits a flaw in the TLS specification which can lead to an attacker being able to compute the pre-master secret in connections which have used a Diffie-Hellman (DH) based ciphersuite.
4.3
2020-04-21 CVE-2020-1967 Null Pointer Dereference vulnerability in multiple products
Server or client applications that call the SSL_check_chain() function during or after a TLS 1.3 handshake may crash due to a NULL pointer dereference as a result of incorrect handling of the "signature_algorithms_cert" TLS extension.
5.0
2019-12-06 CVE-2019-1551 Information Exposure vulnerability in multiple products
There is an overflow bug in the x64_64 Montgomery squaring procedure used in exponentiation with 512-bit moduli.
5.0
2019-09-10 CVE-2019-1563 Information Exposure Through Discrepancy vulnerability in Openssl
In situations where an attacker receives automated notification of the success or failure of a decryption attempt an attacker, after sending a very large number of messages to be decrypted, can recover a CMS/PKCS7 transported encryption key or decrypt any RSA encrypted message that was encrypted with the public RSA key, using a Bleichenbacher padding oracle attack.
network
openssl CWE-203
4.3