Veracode Vulnerability DatabaseVERACODE:4973Buffer Overread
0.028 Low
EPSS
Percentile
90.7%
OpenSSL is vulnerable to buffer overreads. Attackers can cause a on-byte buffer overread by using a X.509 certificate with a malformed IPAddressFamily extension, as a result the certificate would incorrectly be displayed in clear text.
References
www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html
www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html
www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
www.securityfocus.com/bid/100515
www.securitytracker.com/id/1039726
access.redhat.com/errata/RHSA-2018:3221
access.redhat.com/errata/RHSA-2018:3505
cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf
github.com/openssl/openssl/commit/068b963bb7afc57f5bdd723de0dd15e7795d5822
github.com/openssl/openssl/pull/4276
lists.debian.org/debian-lts-announce/2017/11/msg00011.html
security.FreeBSD.org/advisories/FreeBSD-SA-17:11.openssl.asc
security.gentoo.org/glsa/201712-03
security.netapp.com/advisory/ntap-20170927-0001/
security.netapp.com/advisory/ntap-20171107-0002/
support.apple.com/HT208331
usn.ubuntu.com/3611-2/
www.debian.org/security/2017/dsa-4017
www.debian.org/security/2017/dsa-4018
www.openssl.org/news/secadv/20170828.txt
www.openssl.org/news/secadv/20171102.txt
www.oracle.com//security-alerts/cpujul2021.html
www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html
www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
www.tenable.com/security/tns-2017-14
www.tenable.com/security/tns-2017-15
Related
