PT-2026-47843 · Openssl+4 · Openssl+4
CVSS v3.1
4.8
Medium
| Vector | AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
OpenSSL versions 3.0 through 3.3
Description
The implementations of AES-SIV and AES-GCM-SIV mishandle the authentication of Additional Authenticated Data (AAD) when the ciphertext is empty, which allows for the forgery of such messages. In the provider implementation of these ciphers, the expected tag is only computed when the decryption function is invoked with non-empty data. If a caller provides AAD and then calls the
EVP DecryptFinal ex() function without updating the ciphertext (which occurs when the received ciphertext length is zero), the tag is not recalculated and retains an all-zeros value. Consequently, for AES-GCM-SIV, an attacker can pass authentication using arbitrary AAD, an empty ciphertext, and an all-zeros tag without knowing the key. For AES-SIV, the attack requires the application to reuse the decryption context without resetting the key.Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Freebsd
Linuxmint
Openssl
Rocky Linux
Ubuntu