PT-2026-47842 · Openssl+4 · Openssl+4
CVSS v3.1
7.5
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
OpenSSL (affected versions not specified)
Description
When using the AES-OCB cipher with the one-shot
EVP Cipher() interface, the application-supplied initialisation vector (IV) is silently discarded. This causes every message encrypted with the same key to use the same effective nonce, leading to (key, nonce) reuse and a loss of confidentiality. If the same path is used to compute the authentication tag, the tag depends only on the (key, IV) pair rather than the plaintext or ciphertext, which allows for universal forgery of arbitrary ciphertext from a single captured message. This occurs because the one-shot handler fails to flush the IV into the OCB context, unlike the streaming handler. If EVP EncryptFinal ex() is later used to obtain the authentication tag, the deferred IV setup clears the running checksum that should have been accumulated over the plaintext.Recommendations
Avoid using the
EVP Cipher() one-shot API with the AES-OCB cipher and instead use the documented streaming AEAD API consisting of EVP CipherUpdate() and EVP CipherFinal ex().Exploit
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Freebsd
Linuxmint
Openssl
Rocky Linux
Ubuntu