apk package
chainguard/openssl-config
pkg:apk/chainguard/openssl-config
Vulnerabilities (27)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2023-0216 | — | < 3.1.0-r0 | 3.1.0-r0 | Feb 8, 2023 | An invalid pointer dereference on read can be triggered when an application tries to load malformed PKCS7 data with the d2i_PKCS7(), d2i_PKCS7_bio() or d2i_PKCS7_fp() functions. The result of the dereference is an application crash which could lead to a denial of service attack. | ||
| CVE-2023-0217 | — | < 3.1.0-r0 | 3.1.0-r0 | Feb 8, 2023 | An invalid pointer dereference on read can be triggered when an application tries to check a malformed DSA public key by the EVP_PKEY_public_check() function. This will most likely lead to an application crash. This function can be called on public keys supplied from untrusted so | ||
| CVE-2023-0401 | — | < 3.1.0-r0 | 3.1.0-r0 | Feb 8, 2023 | A NULL pointer can be dereferenced when signatures are being verified on PKCS7 signed or signedAndEnveloped data. In case the hash algorithm used for the signature is known to the OpenSSL library but the implementation of the hash algorithm is not available the digest initializat | ||
| CVE-2022-3996 | — | < 3.0.7-r1 | 3.0.7-r1 | Dec 13, 2022 | If an X.509 certificate contains a malformed policy constraint and policy processing is enabled, then a write lock will be taken twice recursively. On some operating systems (most widely: Windows) this results in a denial of service when the affected process hangs. Policy proce | ||
| CVE-2022-3786 | Hig | 7.5 | < 3.0.7-r0 | 3.0.7-r0 | Nov 1, 2022 | A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after certificate chain signature verification and requires either a CA to have signed a malicious certificate or for an application to continue ce | |
| CVE-2022-3602 | Hig | 7.5 | < 3.0.7-r0 | 3.0.7-r0 | Nov 1, 2022 | A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after certificate chain signature verification and requires either a CA to have signed the malicious certificate or for the application to continue | |
| CVE-2022-3358 | — | < 3.0.7-r0 | 3.0.7-r0 | Oct 11, 2022 | OpenSSL supports creating a custom cipher via the legacy EVP_CIPHER_meth_new() function and associated function calls. This function was deprecated in OpenSSL 3.0 and application authors are instead encouraged to use the new provider mechanism in order to implement custom ciphers |
- CVE-2023-0216Feb 8, 2023affected < 3.1.0-r0fixed 3.1.0-r0
An invalid pointer dereference on read can be triggered when an application tries to load malformed PKCS7 data with the d2i_PKCS7(), d2i_PKCS7_bio() or d2i_PKCS7_fp() functions. The result of the dereference is an application crash which could lead to a denial of service attack.
- CVE-2023-0217Feb 8, 2023affected < 3.1.0-r0fixed 3.1.0-r0
An invalid pointer dereference on read can be triggered when an application tries to check a malformed DSA public key by the EVP_PKEY_public_check() function. This will most likely lead to an application crash. This function can be called on public keys supplied from untrusted so
- CVE-2023-0401Feb 8, 2023affected < 3.1.0-r0fixed 3.1.0-r0
A NULL pointer can be dereferenced when signatures are being verified on PKCS7 signed or signedAndEnveloped data. In case the hash algorithm used for the signature is known to the OpenSSL library but the implementation of the hash algorithm is not available the digest initializat
- CVE-2022-3996Dec 13, 2022affected < 3.0.7-r1fixed 3.0.7-r1
If an X.509 certificate contains a malformed policy constraint and policy processing is enabled, then a write lock will be taken twice recursively. On some operating systems (most widely: Windows) this results in a denial of service when the affected process hangs. Policy proce
- affected < 3.0.7-r0fixed 3.0.7-r0
A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after certificate chain signature verification and requires either a CA to have signed a malicious certificate or for an application to continue ce
- affected < 3.0.7-r0fixed 3.0.7-r0
A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after certificate chain signature verification and requires either a CA to have signed the malicious certificate or for the application to continue
- CVE-2022-3358Oct 11, 2022affected < 3.0.7-r0fixed 3.0.7-r0
OpenSSL supports creating a custom cipher via the legacy EVP_CIPHER_meth_new() function and associated function calls. This function was deprecated in OpenSSL 3.0 and application authors are instead encouraged to use the new provider mechanism in order to implement custom ciphers
Page 2 of 2