Debian OpenSSL vulnerabilities

CVE-2015-0287 [MEDIUM] CVE-2015-0287: openssl - The ASN1_item_ex_d2i function in crypto/asn1/tasn_dec.c in OpenSSL before 0.9.8z... The ASN1_item_ex_d2i function in crypto/asn1/tasn_dec.c in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a does not reinitialize CHOICE and ADB data structures, which might allow attackers to cause a denial of service (invalid write operation and memory corruption) by leveraging an application that relies on ASN.1 structure

CVE-2011-4108 [MEDIUM] CVE-2011-4108: openssl - The DTLS implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f performs ... The DTLS implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f performs a MAC check only if certain padding is valid, which makes it easier for remote attackers to recover plaintext via a padding oracle attack. Scope: local bookworm: resolved (fixed in 1.0.0f-1) bullseye: resolved (fixed in 1.0.0f-1) forky: resolved (fixed in 1.0.0f-1) sid: resolved (fixed i

CVE-2013-0169 [LOW] CVE-2013-0169: bouncycastle - The TLS protocol 1.1 and 1.2 and the DTLS protocol 1.0 and 1.2, as used in OpenS... The TLS protocol 1.1 and 1.2 and the DTLS protocol 1.0 and 1.2, as used in OpenSSL, OpenJDK, PolarSSL, and other products, do not properly consider timing side-channel attacks on a MAC check requirement during the processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attacks and plaintext-recovery attacks via statistical anal

CVE-2023-5678 [MEDIUM] CVE-2023-5678: openssl - Issue summary: Generating excessively long X9.42 DH keys or checking excessively... Issue summary: Generating excessively long X9.42 DH keys or checking excessively long X9.42 DH keys or parameters may be very slow. Impact summary: Applications that use the functions DH_generate_key() to generate an X9.42 DH key may experience long delays. Likewise, applications that use DH_check_pub_key(), DH_check_pub_key_ex() or EVP_PKEY_public_check() to check

CVE-2023-6237 [MEDIUM] CVE-2023-6237: openssl - Issue summary: Checking excessively long invalid RSA public keys may take a long... Issue summary: Checking excessively long invalid RSA public keys may take a long time. Impact summary: Applications that use the function EVP_PKEY_public_check() to check RSA public keys may experience long delays. Where the key that is being checked has been obtained from an untrusted source this may lead to a Denial of Service. When function EVP_PKEY_public_check(

CVE-2011-4354 [MEDIUM] CVE-2011-4354: openssl - crypto/bn/bn_nist.c in OpenSSL before 0.9.8h on 32-bit platforms, as used in stu... crypto/bn/bn_nist.c in OpenSSL before 0.9.8h on 32-bit platforms, as used in stunnel and other products, in certain circumstances involving ECDH or ECDHE cipher suites, uses an incorrect modular reduction algorithm in its implementation of the P-256 and P-384 NIST elliptic curves, which allows remote attackers to obtain the private key of a TLS server via multiple h

CVE-2014-3510 [MEDIUM] CVE-2014-3510: openssl - The ssl3_send_client_key_exchange function in s3_clnt.c in OpenSSL 0.9.8 before ... The ssl3_send_client_key_exchange function in s3_clnt.c in OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 before 1.0.0n, and 1.0.1 before 1.0.1i allows remote DTLS servers to cause a denial of service (NULL pointer dereference and client application crash) via a crafted handshake message in conjunction with a (1) anonymous DH or (2) anonymous ECDH ciphersuite. Scope: local boo

CVE-2023-3817 [MEDIUM] CVE-2023-3817: openssl - Issue summary: Checking excessively long DH keys or parameters may be very slow.... Issue summary: Checking excessively long DH keys or parameters may be very slow. Impact summary: Applications that use the functions DH_check(), DH_check_ex() or EVP_PKEY_param_check() to check a DH key or DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial

CVE-2009-0653 [HIGH] CVE-2009-0653: openssl - OpenSSL, probably 0.9.6, does not verify the Basic Constraints for an intermedia... OpenSSL, probably 0.9.6, does not verify the Basic Constraints for an intermediate CA-signed certificate, which allows remote attackers to spoof the certificates of trusted sites via a man-in-the-middle attack, a related issue to CVE-2002-0970. Scope: local bookworm: resolved (fixed in 0.9.8-1) bullseye: resolved (fixed in 0.9.8-1) forky: resolved (fixed in 0.9.8-1) s

CVE-2026-22796 [MEDIUM] CVE-2026-22796: openssl - Issue summary: A type confusion vulnerability exists in the signature verificati... Issue summary: A type confusion vulnerability exists in the signature verification of signed PKCS#7 data where an ASN1_TYPE union member is accessed without first validating the type, causing an invalid or NULL pointer dereference when processing malformed PKCS#7 data. Impact summary: An application performing signature verification of PKCS#7 data or calling direc

CVE-2025-27587 [MEDIUM] CVE-2025-27587: openssl - OpenSSL 3.0.0 through 3.3.2 on the PowerPC architecture is vulnerable to a Miner... OpenSSL 3.0.0 through 3.3.2 on the PowerPC architecture is vulnerable to a Minerva attack, exploitable by measuring the time of signing of random messages using the EVP_DigestSign API, and then using the private key to extract the K value (nonce) from the signatures. Next, based on the bit size of the extracted nonce, one can compare the signing time of full-sized

CVE-2014-3511 [MEDIUM] CVE-2014-3511: openssl - The ssl23_get_client_hello function in s23_srvr.c in OpenSSL 1.0.1 before 1.0.1i... The ssl23_get_client_hello function in s23_srvr.c in OpenSSL 1.0.1 before 1.0.1i allows man-in-the-middle attackers to force the use of TLS 1.0 by triggering ClientHello message fragmentation in communication between a client and server that both support later TLS versions, related to a "protocol downgrade" issue. Scope: local bookworm: resolved (fixed in 1.0.1i-1)

CVE-2014-3572 [MEDIUM] CVE-2014-3572: openssl - The ssl3_get_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8zd, 1.0.0... The ssl3_get_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k allows remote SSL servers to conduct ECDHE-to-ECDH downgrade attacks and trigger a loss of forward secrecy by omitting the ServerKeyExchange message. Scope: local bookworm: resolved (fixed in 1.0.1k-1) bullseye: resolved (fixed in 1.0.1k-1) forky:

CVE-2011-0014 [MEDIUM] CVE-2011-0014: openssl - ssl/t1_lib.c in OpenSSL 0.9.8h through 0.9.8q and 1.0.0 through 1.0.0c allows re... ssl/t1_lib.c in OpenSSL 0.9.8h through 0.9.8q and 1.0.0 through 1.0.0c allows remote attackers to cause a denial of service (crash), and possibly obtain sensitive information in applications that use OpenSSL, via a malformed ClientHello handshake message that triggers an out-of-bounds memory access, aka "OCSP stapling vulnerability." Scope: local bookworm: resolved

CVE-2014-5139 [MEDIUM] CVE-2014-5139: openssl - The ssl_set_client_disabled function in t1_lib.c in OpenSSL 1.0.1 before 1.0.1i ... The ssl_set_client_disabled function in t1_lib.c in OpenSSL 1.0.1 before 1.0.1i allows remote SSL servers to cause a denial of service (NULL pointer dereference and client application crash) via a ServerHello message that includes an SRP ciphersuite without the required negotiation of that ciphersuite with the client. Scope: local bookworm: resolved (fixed in 1.0.1i

CVE-2023-0465 [MEDIUM] CVE-2023-0465: openssl - Applications that use a non-default option when verifying certificates may be vu... Applications that use a non-default option when verifying certificates may be vulnerable to an attack from a malicious CA to circumvent certain checks. Invalid certificate policies in leaf certificates are silently ignored by OpenSSL and other certificate policy checks are skipped for that certificate. A malicious CA could use this to deliberately assert invalid cer

CVE-2023-0466 [MEDIUM] CVE-2023-0466: openssl - The function X509_VERIFY_PARAM_add0_policy() is documented to implicitly enable ... The function X509_VERIFY_PARAM_add0_policy() is documented to implicitly enable the certificate policy check when doing certificate verification. However the implementation of the function does not enable the check which allows certificates with invalid or incorrect policies to pass the certificate verification. As suddenly enabling the policy check could break exis

CVE-2010-4180 [MEDIUM] CVE-2010-4180: openssl - OpenSSL before 0.9.8q, and 1.0.x before 1.0.0c, when SSL_OP_NETSCAPE_REUSE_CIPHE... OpenSSL before 0.9.8q, and 1.0.x before 1.0.0c, when SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG is enabled, does not properly prevent modification of the ciphersuite in the session cache, which allows remote attackers to force the downgrade to an unintended cipher via vectors involving sniffing network traffic to discover a session identifier. Scope: local bookworm: re

CVE-2025-15469 [MEDIUM] CVE-2025-15469: openssl - Issue summary: The 'openssl dgst' command-line tool silently truncates input dat... Issue summary: The 'openssl dgst' command-line tool silently truncates input data to 16MB when using one-shot signing algorithms and reports success instead of an error. Impact summary: A user signing or verifying files larger than 16MB with one-shot algorithms (such as Ed25519, Ed448, or ML-DSA) may believe the entire file is authenticated while trailing data bey

CVE-2003-0131 [HIGH] CVE-2003-0131: openssl - The SSL and TLS components for OpenSSL 0.9.6i and earlier, 0.9.7, and 0.9.7a all... The SSL and TLS components for OpenSSL 0.9.6i and earlier, 0.9.7, and 0.9.7a allow remote attackers to perform an unauthorized RSA private key operation via a modified Bleichenbacher attack that uses a large number of SSL or TLS connections using PKCS #1 v1.5 padding that cause OpenSSL to leak information regarding the relationship between ciphertext and the associate