PT-2010-1089 · Openssl · Openssl

Peter-Michael Hager · Publicado 2010-06-03 · Atualizado 2024-06-15 · CVE-2010-1633

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions OpenSSL versions prior to 1.0.0a OpenSSL versions prior to 1.0.0e

Description The issue is related to the EVP PKEY verify recover function in OpenSSL, which returns uninitialized memory upon failure. This could allow context-dependent attackers to bypass intended key requirements or obtain sensitive information. The vulnerability might be exploited remotely, potentially leading to a violation of confidentiality, integrity, and availability of protected information.

Recommendations For versions prior to 1.0.0a, update to version 1.0.0a or later. For versions prior to 1.0.0e, update to version 1.0.0e or later. As a temporary workaround, consider restricting access to the EVP PKEY verify recover function until a patch is available.

Correção

Enumeração de Fraquezas

CWE-399

CWE-264

Identificadores relacionados

BDU:2015-09418

CVE-2010-1633

OPENSUSE-SU-2024:11127-1

Produtos afetados

Openssl

Referências · 152

• https://suse.com/security/cve/CVE-2019-1549 · Nota
• https://suse.com/security/cve/CVE-2016-7055 · Nota
• http://cvs.openssl.org/filediff?f=openssl/crypto/rsa/rsa_pmeth.c&v1=1.34&v2=1.34.2.1 · Nota
• https://suse.com/security/cve/CVE-2018-0735 · Nota
• https://suse.com/security/cve/CVE-2021-3712 · Nota
• https://suse.com/security/cve/CVE-2014-3513 · Nota
• https://suse.com/security/cve/CVE-2007-3108 · Nota
• https://suse.com/security/cve/CVE-2021-23841 · Nota
• https://suse.com/security/cve/CVE-2018-0739 · Nota
• https://suse.com/security/cve/CVE-2016-6303 · Nota
• https://suse.com/security/cve/CVE-2012-2686 · Nota
• https://suse.com/security/cve/CVE-2017-3732 · Nota
• https://suse.com/security/cve/CVE-2012-4929 · Nota
• https://suse.com/security/cve/CVE-2011-4619 · Nota
• https://suse.com/security/cve/CVE-2014-3510 · Nota