PT-2011-1150 · Openssl+2 · Openssl+2

Kaspar Brand · Published 2011-09-06 · Updated 2024-06-15 · CVE-2011-3207

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions OpenSSL versions prior to 1.0.0e Gentoo Linux (affected versions not specified)

Description The issue concerns multiple vulnerabilities in the OpenSSL package that can be exploited remotely, potentially leading to breaches in confidentiality, integrity, and availability of protected information. Specifically, in OpenSSL 1.0.x before version 1.0.0e, certain structure members in crypto/x509/x509 vfy.c are not initialized, making it easier for remote attackers to bypass CRL validation by using a nextUpdate value corresponding to a time in the past.

Recommendations For OpenSSL versions prior to 1.0.0e, update to version 1.0.0e or later to resolve the issue. For Gentoo Linux, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-399

CWE-264

Related Identifiers

BDU:2015-09418

CVE-2011-3207

OPENSUSE-SU-2024:10271-1

OPENSUSE-SU-2024:10529-1

OPENSUSE-SU-2024:11127-1

RHSA-2011:1409

RHSA-2011_1409

SUSE-FU-2022:0445-1

Affected Products

Gentoo Linux

Openssl

Red Hat

References · 165

• https://linux.oracle.com/errata/ELSA-2011-1409.html · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2011-3207 · Vendor Advisory
• http://cvs.openssl.org/chngview?cn=21349 · Patch
• http://openssl.org/news/secadv_20110906.txt · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2011-September/065712.html · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2011-September/065744.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2011-3207 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2011-3207 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:11127-1 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2011:137 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2011-3207 · Security Note
• https://bdu.fstec.ru/vul/2015-09418 · Security Note
• http://redhat.com/support/errata/RHSA-2011-1409.html · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2012-November/092905.html · Vendor Advisory
• http://marc.info/?l=bugtraq&m=133226187115472&w=2 · Vendor Advisory