rpm package
suse/openssl-3&distro=SUSE Linux Micro 6.1
pkg:rpm/suse/openssl-3&distro=SUSE%20Linux%20Micro%206.1
Vulnerabilities (28)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2025-69418 | Med | 4.0 | < 3.1.4-slfo.1.1_8.1 | 3.1.4-slfo.1.1_8.1 | Jan 27, 2026 | Issue summary: When using the low-level OCB API directly with AES-NI orother hardware-accelerated code paths, inputs whose length is not a multipleof 16 bytes can leave the final partial block unencrypted and unauthenticated.Impact summary: The trailing 1-15 bytes | |
| CVE-2025-68160 | Med | 4.7 | < 3.1.4-slfo.1.1_8.1 | 3.1.4-slfo.1.1_8.1 | Jan 27, 2026 | Issue summary: Writing large, newline-free data into a BIO chain using the line-buffering filter where the next BIO performs short writes can trigger a heap-based out-of-bounds write. Impact summary: This out-of-bounds write can cause memory corruption which typically results in | |
| CVE-2025-15467 | Hig | 8.8 | < 3.1.4-slfo.1.1_8.1 | 3.1.4-slfo.1.1_8.1 | Jan 27, 2026 | Issue summary: Parsing CMS AuthEnvelopedData or EnvelopedData message with maliciously crafted AEAD parameters can trigger a stack buffer overflow. Impact summary: A stack buffer overflow may lead to a crash, causing Denial of Service, or potentially remote code execution. When | |
| CVE-2025-9230 | Hig | 7.5 | < 3.1.4-slfo.1.1_7.1 | 3.1.4-slfo.1.1_7.1 | Sep 30, 2025 | Issue summary: An application trying to decrypt CMS messages encrypted using password based encryption can trigger an out-of-bounds read and write. Impact summary: This out-of-bounds read may trigger a crash which leads to Denial of Service for an application. The out-of-bounds | |
| CVE-2025-27587 | Med | 5.3 | < 3.1.4-slfo.1.1_5.1 | 3.1.4-slfo.1.1_5.1 | Jun 16, 2025 | OpenSSL 3.0.0 through 3.3.2 on the PowerPC architecture is vulnerable to a Minerva attack, exploitable by measuring the time of signing of random messages using the EVP_DigestSign API, and then using the private key to extract the K value (nonce) from the signatures. Next, based | |
| CVE-2024-13176 | Med | 4.1 | < 3.1.4-slfo.1.1_4.1 | 3.1.4-slfo.1.1_4.1 | Jan 20, 2025 | Issue summary: A timing side-channel which could potentially allow recovering the private key exists in the ECDSA signature computation. Impact summary: A timing side-channel in ECDSA signature computations could allow recovering the private key by an attacker. However, measurin | |
| CVE-2024-41996 | Hig | 7.5 | < 3.1.4-slfo.1.1_10.1 | 3.1.4-slfo.1.1_10.1 | Aug 26, 2024 | Validating the order of the public keys in the Diffie-Hellman Key Agreement Protocol, when an approved safe prime is used, allows remote attackers (from the client side) to trigger unnecessarily expensive server-side DHE modular-exponentiation calculations. The client may cause a | |
| CVE-2023-50782 | — | < 3.1.4-slfo.1.1_6.1 | 3.1.4-slfo.1.1_6.1 | Feb 5, 2024 | A flaw was found in the python-cryptography package. This issue may allow a remote attacker to decrypt captured messages in TLS servers that use RSA key exchanges, which may lead to exposure of confidential or sensitive data. |
- affected < 3.1.4-slfo.1.1_8.1fixed 3.1.4-slfo.1.1_8.1
Issue summary: When using the low-level OCB API directly with AES-NI orother hardware-accelerated code paths, inputs whose length is not a multipleof 16 bytes can leave the final partial block unencrypted and unauthenticated.Impact summary: The trailing 1-15 bytes
- affected < 3.1.4-slfo.1.1_8.1fixed 3.1.4-slfo.1.1_8.1
Issue summary: Writing large, newline-free data into a BIO chain using the line-buffering filter where the next BIO performs short writes can trigger a heap-based out-of-bounds write. Impact summary: This out-of-bounds write can cause memory corruption which typically results in
- affected < 3.1.4-slfo.1.1_8.1fixed 3.1.4-slfo.1.1_8.1
Issue summary: Parsing CMS AuthEnvelopedData or EnvelopedData message with maliciously crafted AEAD parameters can trigger a stack buffer overflow. Impact summary: A stack buffer overflow may lead to a crash, causing Denial of Service, or potentially remote code execution. When
- affected < 3.1.4-slfo.1.1_7.1fixed 3.1.4-slfo.1.1_7.1
Issue summary: An application trying to decrypt CMS messages encrypted using password based encryption can trigger an out-of-bounds read and write. Impact summary: This out-of-bounds read may trigger a crash which leads to Denial of Service for an application. The out-of-bounds
- affected < 3.1.4-slfo.1.1_5.1fixed 3.1.4-slfo.1.1_5.1
OpenSSL 3.0.0 through 3.3.2 on the PowerPC architecture is vulnerable to a Minerva attack, exploitable by measuring the time of signing of random messages using the EVP_DigestSign API, and then using the private key to extract the K value (nonce) from the signatures. Next, based
- affected < 3.1.4-slfo.1.1_4.1fixed 3.1.4-slfo.1.1_4.1
Issue summary: A timing side-channel which could potentially allow recovering the private key exists in the ECDSA signature computation. Impact summary: A timing side-channel in ECDSA signature computations could allow recovering the private key by an attacker. However, measurin
- affected < 3.1.4-slfo.1.1_10.1fixed 3.1.4-slfo.1.1_10.1
Validating the order of the public keys in the Diffie-Hellman Key Agreement Protocol, when an approved safe prime is used, allows remote attackers (from the client side) to trigger unnecessarily expensive server-side DHE modular-exponentiation calculations. The client may cause a
- CVE-2023-50782Feb 5, 2024affected < 3.1.4-slfo.1.1_6.1fixed 3.1.4-slfo.1.1_6.1
A flaw was found in the python-cryptography package. This issue may allow a remote attacker to decrypt captured messages in TLS servers that use RSA key exchanges, which may lead to exposure of confidential or sensitive data.
Page 2 of 2