PT-2011-1150 · Openssl+2 · Openssl+2
Kaspar Brand
·
Publicado
2011-09-06
·
Atualizado
2024-06-15
·
CVE-2011-3207
CVSS v2.0
10
Alta
| Vetor | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
OpenSSL versions prior to 1.0.0e
Gentoo Linux (affected versions not specified)
Description
The issue concerns multiple vulnerabilities in the OpenSSL package that can be exploited remotely, potentially leading to breaches in confidentiality, integrity, and availability of protected information. Specifically, in OpenSSL 1.0.x before version 1.0.0e, certain structure members in crypto/x509/x509 vfy.c are not initialized, making it easier for remote attackers to bypass CRL validation by using a nextUpdate value corresponding to a time in the past.
Recommendations
For OpenSSL versions prior to 1.0.0e, update to version 1.0.0e or later to resolve the issue.
For Gentoo Linux, at the moment, there is no information about a newer version that contains a fix for this vulnerability.
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Gentoo Linux
Openssl
Red Hat