Multiple vulnerabilities have been found in OpenSSL, the worst of which could result in denial of service.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-libs/openssl | * | < 3.0.10 | >= 3.0.10 |
OpenSSL is an Open Source toolkit implementing the Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1) as well as a general purpose cryptography library.
Multiple vulnerabilities have been discovered in OpenSSL. Please review the CVE identifiers referenced below for details.
Please review the referenced CVE identifiers for details.
There is no known workaround at this time.
All OpenSSL users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-libs/openssl-3.0.10"
Multiple vulnerabilities have been discovered in OpenSSL, the worst of which could result in remote code execution.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-libs/openssl | * | < 3.0.7:0/3 | >= 3.0.7:0/3 |
OpenSSL is an Open Source toolkit implementing the Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1) as well as a general purpose cryptography library.
Multiple buffer overflows exist in OpenSSL's handling of TLS certificates for client authentication.
It is believed that, while unlikely, code execution is possible in certain system configurations.
Users operating TLS servers may consider disabling TLS client authentication, if it is being used, until fixes are applied.
All OpenSSL 3 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-libs/openssl-3.0.7"
Multiple vulnerabilities have been discovered in OpenSSL, the worst of which could result in denial of service.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-libs/openssl | * | < 1.1.1q | >= 1.1.1q |
OpenSSL is an Open Source toolkit implementing the Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1) as well as a general purpose cryptography library.
Multiple vulnerabilities have been discovered in OpenSSL. Please review the CVE identifiers referenced below for details.
Please review the referenced CVE identifiers for details.
There is no known workaround at this time.
All OpenSSL users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-libs/openssl-1.1.1q"
Multiple vulnerabilities have been found in OpenSSL, the worst of which could allow remote attackers to cause a Denial of Service condition.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-libs/openssl | * | < 1.1.1k | >= 1.1.1k |
OpenSSL is an Open Source toolkit implementing the Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1/v1.1/v1.2/v1.3) as well as a general purpose cryptography library.
Multiple vulnerabilities have been discovered in OpenSSL. Please review the CVE identifiers referenced below for details.
Please review the referenced CVE identifiers for details.
There is no known workaround at this time.
All OpenSSL users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-libs/openssl-1.1.1k"
A vulnerability in OpenSSL might allow remote attackers to cause a Denial of Service condition.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-libs/openssl | * | < 1.1.1i | >= 1.1.1i |
OpenSSL is an Open Source toolkit implementing the Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1/v1.1/v1.2/v1.3) as well as a general purpose cryptography library.
A null pointer dereference flaw was found in OpenSSL.
A remote attacker, able to control the arguments of the GENERAL_NAME_cmp function in an application linked against OpenSSL, could possibly cause a Denial of Service condition.
There is no known workaround at this time.
All OpenSSL users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-libs/openssl-1.1.1i"
Multiple vulnerabilities were found in OpenSSL, the worst of which could allow remote attackers to cause a Denial of Service condition.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-libs/openssl | * | < 1.1.1g | >= 1.1.1g |
OpenSSL is an Open Source toolkit implementing the Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1/v1.1/v1.2/v1.3) as well as a general purpose cryptography library.
Multiple vulnerabilities have been discovered in OpenSSL. Please review the CVE identifiers referenced below for details.
A remote attacker could perform a malicious crafted TLS 1.3 handshake against an application using OpenSSL, possibly resulting in a Denial of Service condition.
In addition, it’s feasible that an attacker might attack DH512.
There is no known workaround at this time.
All OpenSSL users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-libs/openssl-1.1.1g"
Multiple information disclosure vulnerabilities in OpenSSL allow attackers to obtain sensitive information.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-libs/openssl | * | < 1.0.2t | >= 1.0.2t |
OpenSSL is an Open Source toolkit implementing the Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1) as well as a general purpose cryptography library.
Multiple vulnerabilities have been discovered in OpenSSL. Please review the CVE identifiers referenced below for details.
Please review the referenced CVE identifiers for details.
There is no known workaround at this time.
All OpenSSL users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-libs/openssl-1.0.2t"
Multiple Information Disclosure vulnerabilities in OpenSSL allow attackers to obtain sensitive information.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-libs/openssl | * | < 1.0.2r | >= 1.0.2r |
OpenSSL is an Open Source toolkit implementing the Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1) as well as a general purpose cryptography library.
Multiple vulnerabilities have been discovered in OpenSSL. Please review the CVE identifiers referenced below for details.
A remote attacker to obtain sensitive information, caused by the failure to immediately close the TCP connection after the hosts encounter a zero-length record with valid padding.
A local attacker could run a malicious process next to legitimate processes using the architecture’s parallel thread running capabilities to leak encrypted data from the CPU’s internal processes.
There is no known workaround at this time.
All OpenSSL users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-libs/openssl-1.0.2r"
Multiple vulnerabilities have been found in OpenSSL, the worst of which may lead to a Denial of Service condition.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-libs/openssl | * | < 1.0.2o | >= 1.0.2o |
OpenSSL is a robust, commercial-grade, and full-featured toolkit for the Transport Layer Security (TLS) and Secure Sockets Layer (SSL) protocols.
Multiple vulnerabilities have been discovered in OpenSSL. Please review the referenced CVE identifiers for details.
A remote attacker could cause a Denial of Service condition, obtain private keying material, or gain access to sensitive information.
There is no known workaround at this time.
All OpenSSL users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-libs/openssl-1.0.2o"
A vulnerability in OpenSSL might allow remote attackers to cause a Denial of Service condition.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-libs/openssl | * | < 1.0.2o-r6 | >= 1.0.2o-r6 |
OpenSSL is an Open Source toolkit implementing the Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1) as well as a general purpose cryptography library.
It was discovered that OpenSSL allow malicious servers to send very large primes to a client during DH(E) based TLS handshakes.
A remote attacker, by sending large prime to client during DH(E) TLS handshake, could possibly cause a Denial of Service condition.
There is no known workaround at this time.
All OpenSSL users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-libs/openssl-1.0.2o-r6"
Multiple vulnerabilities have been found in OpenSSL, the worst of which may lead to a Denial of Service condition.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-libs/openssl | * | < 1.0.2n | >= 1.0.2n |
OpenSSL is a robust, commercial-grade, and full-featured toolkit for the Transport Layer Security (TLS) and Secure Sockets Layer (SSL) protocols.
Multiple vulnerabilities have been discovered in OpenSSL. Please review the referenced CVE identifiers for details.
A remote attacker could cause a Denial of Service condition, recover a private key in unlikely circumstances, circumvent security restrictions to perform unauthorized actions, or gain access to sensitive information.
There are no known workarounds at this time.
All OpenSSL users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-libs/openssl-1.0.2n"
Multiple vulnerabilities have been found in OpenSSL, the worst of which might allow attackers to access sensitive information.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-libs/openssl | * | < 1.0.2k | >= 1.0.2k |
OpenSSL is an Open Source toolkit implementing the Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1) as well as a general purpose cryptography library.
Multiple vulnerabilities have been discovered in OpenSSL. Please review the CVE identifiers referenced below for details.
A remote attacker is able to crash applications linked against OpenSSL or could obtain sensitive private-key information via an attack against the Diffie-Hellman (DH) ciphersuite.
There is no known workaround at this time.
All OpenSSL users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-libs/openssl-1.0.2k"
Multiple vulnerabilities have been found in OpenSSL, the worst of which allows attackers to conduct a time based side-channel attack.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-libs/openssl | * | < 1.0.2j | >= 1.0.2j |
OpenSSL is an Open Source toolkit implementing the Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1) as well as a general purpose cryptography library.
Multiple vulnerabilities have been discovered in OpenSSL. Please review the CVE identifiers and the International Association for Cryptologic Research’s (IACR) paper, “Make Sure DSA Signing Exponentiations Really are Constant-Time” for further details.
Remote attackers could cause a Denial of Service condition or have other unspecified impacts. Additionally, a time based side-channel attack may allow a local attacker to recover a private DSA key.
There is no known workaround at this time.
All OpenSSL users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-libs/openssl-1.0.2j"
Multiple vulnerabilities have been found in OpenSSL, the worst allowing remote attackers to decrypt TLS sessions.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-libs/openssl | * | < 1.0.2g-r2 | >= 1.0.2g-r2 |
OpenSSL is an Open Source toolkit implementing the Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1) as well as a general purpose cryptography library.
Multiple vulnerabilities have been discovered in OpenSSL, the worst being a cross-protocol attack called DROWN that could lead to the decryption of TLS sessions. Please review the CVE identifiers referenced below for details.
A remote attacker could decrypt TLS sessions by using a server supporting SSLv2 and EXPORT cipher suites as a Bleichenbacher RSA padding oracle, cause a Denial of Service condition, obtain sensitive information from memory and (in rare circumstances) recover RSA keys.
A workaround for DROWN is disabling the SSLv2 protocol on all SSL/TLS servers.
All OpenSSL users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-libs/openssl-1.0.2g-r2"
Please note that beginning with OpenSSL 1.0.2, in order to mitigate the DROWN attack, the OpenSSL project disables SSLv2 by default at build-time. As this change would cause severe issues with some Gentoo packages that depend on OpenSSL, Gentoo still ships OpenSSL with SSLv2 enabled at build-time. Note that this does not mean that you are still vulnerable to DROWN because the OpenSSL project has taken further precautions and applications would need to explicitly request SSLv2. We are working on a migration path to phase out SSLv2 that ensures that no user-facing issues occur. Please reference bug 576128 for further details on how this decision was made.
Multiple vulnerabilities have been found in OpenSSL, allowing remote attackers to disclose sensitive information and complete weak handshakes.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-libs/openssl | * | < 1.0.2f | >= 1.0.2f, >= 1.0.1r (revision), >= 1.0.1s (revision), >= 1.0.1t (revision), >= 0.9.8z_p8 (revision), >= 0.9.8z_p9 (revision), >= 0.9.8z_p10 (revision), >= 0.9.8z_p11 (revision), >= 0.9.8z_p12 (revision), >= 0.9.8z_p13 (revision), >= 0.9.8z_p14 (revision), >= 0.9.8z_p15 (revision) |
OpenSSL is an Open Source toolkit implementing the Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1) as well as a general purpose cryptography library.
Multiple vulnerabilities have been discovered in OpenSSL. Please review the upstream advisory and CVE identifiers referenced below for details. Note that the list includes CVE identifiers for an older OpenSSL Security Advisory (3 Dec 2015) for which we have not issued a GLSA before.
A remote attacker could disclose a server’s private DH exponent, or complete SSLv2 handshakes using ciphers that have been disabled on the server.
There is no known workaround at this time.
All OpenSSL users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-libs/openssl-1.0.2f"
Certain checks on untrusted certificates can be bypassed.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-libs/openssl | * | < 1.0.1p | >= 1.0.1p, >= 0.9.8z_p6 (revision), >= 0.9.8z_p7 (revision), >= 0.9.8z_p8 (revision), >= 0.9.8z_p9 (revision), >= 0.9.8z_p10 (revision), >= 0.9.8z_p11 (revision), >= 0.9.8z_p12 (revision), >= 0.9.8z_p13 (revision), >= 0.9.8z_p14 (revision), >= 0.9.8z_p15 (revision) |
OpenSSL is an Open Source toolkit implementing the Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1) as well as a general purpose cryptography library.
During certificate verification, OpenSSL attempts to find an alternative certificate chain if the first attempt to build such a chain fails.
A remote attacker could cause certain checks on untrusted certificates to be bypassed, such as the CA flag, enabling them to use a valid leaf certificate to act as a CA and “issue” an invalid certificate.
There is no known workaround at this time.
All OpenSSL users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-libs/openssl-1.0.1p"
Multiple vulnerabilities have been found in OpenSSL that can result in either Denial of Service or information disclosure.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-libs/openssl | * | < 1.0.1o | >= 1.0.1o, >= 0.9.8z_p7 (revision), >= 0.9.8z_p8 (revision), >= 0.9.8z_p9 (revision), >= 0.9.8z_p10 (revision), >= 0.9.8z_p11 (revision), >= 0.9.8z_p12 (revision), >= 0.9.8z_p13 (revision), >= 0.9.8z_p14 (revision), >= 0.9.8z_p15 (revision) |
OpenSSL is an Open Source toolkit implementing the Secure Sockets Layer and Transport Layer Security as well as a general purpose cryptography library.
Multiple vulnerabilities have been found in OpenSSL. Please review the CVE identifiers referenced below for details.
A remote attacker can cause Denial of Service and information disclosure.
There is no known workaround at this time.
All OpenSSL 1.0.1 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-libs/openssl-1.0.1o"
All OpenSSL 0.9.8 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-libs/openssl-0.9.8z_p7"
Multiple vulnerabilities have been found in OpenSSL that can result in either Denial of Service or information disclosure.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-libs/openssl | * | < 1.0.1l-r1 | >= 1.0.1l-r1, >= 0.9.8z_p5 (revision), >= 0.9.8z_p6 (revision), >= 0.9.8z_p7 (revision), >= 0.9.8z_p8 (revision), >= 0.9.8z_p9 (revision), >= 0.9.8z_p10 (revision), >= 0.9.8z_p11 (revision), >= 0.9.8z_p12 (revision), >= 0.9.8z_p13 (revision), >= 0.9.8z_p14 (revision), >= 0.9.8z_p15 (revision) |
OpenSSL is an Open Source toolkit implementing the Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1) as well as a general purpose cryptography library.
Multiple vulnerabilities have been found in OpenSSL. Please review the CVE identifiers and the upstream advisory referenced below for details:
The following issues affect OpenSSL 1.0.2 only which is not part of the supported Gentoo stable tree:
A remote attacker can utilize multiple vectors to cause Denial of Service or Information Disclosure.
There is no known workaround at this time.
All OpenSSL 1.0.1 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-libs/openssl-1.0.1l-r1"
All OpenSSL 0.9.8 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-libs/openssl-0.9.8z_p5-r1"
Packages which depend on the OpenSSL library need to be restarted for the upgrade to take effect. Some packages may need to be recompiled. Tools such as revdep-rebuild may assist in identifying some of these packages.
Multiple vulnerabilities have been found in OpenSSL, the worst of which could result in Denial of Service or Man-in-the-Middle attacks.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-libs/openssl | * | < 1.0.1j | >= 1.0.1j, >= 0.9.8z_p2 (revision), >= 0.9.8z_p3 (revision), >= 0.9.8z_p4 (revision), >= 0.9.8z_p5 (revision), >= 0.9.8z_p6 (revision), >= 0.9.8z_p7 (revision), >= 0.9.8z_p8 (revision), >= 0.9.8z_p9 (revision), >= 0.9.8z_p10 (revision), >= 0.9.8z_p11 (revision), >= 0.9.8z_p12 (revision), >= 0.9.8z_p13 (revision), >= 0.9.8z_p14 (revision), >= 0.9.8z_p15 (revision) |
OpenSSL is an Open Source toolkit implementing the Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1) as well as a general purpose cryptography library.
Multiple vulnerabilities have been discovered in OpenSSL. Please review the CVE identifiers referenced below for details.
A remote attacker may be able to cause a Denial of Service condition, perform Man-in-the-Middle attacks, obtain sensitive information, or bypass security restrictions.
There is no known workaround at this time.
All OpenSSL 1.0.1 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-libs/openssl-1.0.1j"
All OpenSSL 0.9.8 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-libs/openssl-0.9.8z_p2"
Packages which depend on this library may need to be recompiled. Tools such as revdep-rebuild may assist in identifying these packages.
Multiple vulnerabilities have been found in OpenSSL, possibly allowing remote attackers to execute arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-libs/openssl | * | < 1.0.1h-r1 | >= 1.0.1h-r1, >= 1.0.0m (revision), >= 0.9.8z_p1 (revision), >= 0.9.8z_p2 (revision), >= 0.9.8z_p3 (revision), >= 0.9.8z_p4 (revision), >= 0.9.8z_p5 (revision), >= 0.9.8z_p6 (revision), >= 0.9.8z_p7 (revision), >= 0.9.8z_p8 (revision), >= 0.9.8z_p9 (revision), >= 0.9.8z_p10 (revision), >= 0.9.8z_p11 (revision), >= 0.9.8z_p12 (revision), >= 0.9.8z_p13 (revision), >= 0.9.8z_p14 (revision), >= 0.9.8z_p15 (revision) |
OpenSSL is an Open Source toolkit implementing the Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1) as well as a general purpose cryptography library.
Multiple vulnerabilities have been discovered in OpenSSL. Please review the OpenSSL Security Advisory [05 Jun 2014] and the CVE identifiers referenced below for details.
A remote attacker could send specially crafted DTLS fragments to an OpenSSL DTLS client or server to possibly execute arbitrary code with the privileges of the process using OpenSSL.
Furthermore, an attacker could force the use of weak keying material in OpenSSL SSL/TLS clients and servers, inject data across sessions, or cause a Denial of Service via various vectors.
There is no known workaround at this time.
All OpenSSL users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-libs/openssl-1.0.1h-r1"
Multiple Information Disclosure vulnerabilities in OpenSSL allow remote attackers to obtain sensitive information via various vectors.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-libs/openssl | * | < 1.0.1g | >= 1.0.1g, >= 0.9.8y (revision), >= 0.9.8z_p1 (revision), >= 0.9.8z_p2 (revision), >= 0.9.8z_p3 (revision), >= 0.9.8z_p4 (revision), >= 0.9.8z_p5 (revision), >= 0.9.8z_p6 (revision), >= 0.9.8z_p7 (revision), >= 0.9.8z_p8 (revision), >= 0.9.8z_p9 (revision), >= 0.9.8z_p10 (revision), >= 0.9.8z_p11 (revision), >= 0.9.8z_p12 (revision), >= 0.9.8z_p13 (revision), >= 0.9.8z_p14 (revision), >= 0.9.8z_p15 (revision) |
OpenSSL is an Open Source toolkit implementing the Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1) as well as a general purpose cryptography library.
Multiple vulnerabilities have been found in OpenSSL:
A remote attacker could exploit these issues to disclose information, including private keys or other sensitive information, or perform side-channel attacks to obtain ECDSA nonces.
Disabling the tls-heartbeat USE flag (enabled by default) provides a workaround for the CVE-2014-0160 issue.
All OpenSSL users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-libs/openssl-1.0.1g"
Note: All services using OpenSSL to provide TLS connections have to be restarted for the update to take effect. Utilities like app-admin/lib_users can aid in identifying programs using OpenSSL.
As private keys may have been compromised using the Heartbleed attack, it is recommended to regenerate them.
A vulnerability in OpenSSL's handling of TLS handshakes could result in a Denial of Service condition.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-libs/openssl | * | < 1.0.1f | >= 1.0.1f, < 1.0.1 |
OpenSSL is an Open Source toolkit implementing the Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1) as well as a general purpose cryptography library.
A flaw in the ssl3_take_mac function can result in a NULL pointer dereference.
A remote attacker could send a specially crafted TLS handshake, resulting in a Denial of Service condition.
There is no known workaround at this time.
All OpenSSL 1.0.1 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-libs/openssl-1.0.1f"
Multiple vulnerabilities have been found in OpenSSL allowing remote attackers to determine private keys or cause a Denial of Service.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-libs/openssl | * | < 1.0.0j, < 0.9.8y | >= 1.0.0j, >= 0.9.8y (revision), >= 0.9.8z_p1 (revision), >= 0.9.8z_p2 (revision), >= 0.9.8z_p3 (revision), >= 0.9.8z_p4 (revision), >= 0.9.8z_p5 (revision), >= 0.9.8z_p6 (revision), >= 0.9.8z_p7 (revision), >= 0.9.8z_p8 (revision), >= 0.9.8z_p9 (revision), >= 0.9.8z_p10 (revision), >= 0.9.8z_p11 (revision), >= 0.9.8z_p12 (revision), >= 0.9.8z_p13 (revision), >= 0.9.8z_p14 (revision), >= 0.9.8z_p15 (revision) |
OpenSSL is an Open Source toolkit implementing the Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1) as well as a general purpose cryptography library.
Multiple vulnerabilities have been discovered in OpenSSL. Please review the CVE identifiers referenced below for details.
Remote attackers can determine private keys, decrypt data, cause a Denial of Service or possibly have other unspecified impact.
There is no known workaround at this time.
All OpenSSL 1.0.x users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-libs/openssl-1.0.0j"
All OpenSSL 0.9.8 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-libs/openssl-0.9.8y"
Multiple vulnerabilities have been found in OpenSSL, allowing remote attackers to cause a Denial of Service or obtain sensitive information.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-libs/openssl | * | < 1.0.0g | >= 1.0.0g, >= 0.9.8t (revision), >= 0.9.8u (revision), >= 0.9.8v (revision), >= 0.9.8w (revision), >= 0.9.8x (revision), >= 0.9.8y (revision), >= 0.9.8z_p1 (revision), >= 0.9.8z_p2 (revision), >= 0.9.8z_p3 (revision), >= 0.9.8z_p4 (revision), >= 0.9.8z_p5 (revision), >= 0.9.8z_p6 (revision), >= 0.9.8z_p7 (revision), >= 0.9.8z_p8 (revision), >= 0.9.8z_p9 (revision), >= 0.9.8z_p10 (revision), >= 0.9.8z_p11 (revision), >= 0.9.8z_p12 (revision), >= 0.9.8z_p13 (revision), >= 0.9.8z_p14 (revision), >= 0.9.8z_p15 (revision) |
OpenSSL is an Open Source toolkit implementing the Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1) as well as a general purpose cryptography library.
Multiple vulnerabilities have been found in OpenSSL:
A remote attacker may be able to cause a Denial of Service or obtain sensitive information, including plaintext passwords.
There is no known workaround at this time.
All OpenSSL users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-libs/openssl-1.0.0g"
Multiple vulnerabilities were found in OpenSSL, allowing for the execution of arbitrary code and other attacks.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-libs/openssl | * | < 1.0.0e | >= 1.0.0e, >= 0.9.8r (revision), >= 0.9.8s (revision), >= 0.9.8t (revision), >= 0.9.8u (revision), >= 0.9.8v (revision), >= 0.9.8w (revision), >= 0.9.8x (revision), >= 0.9.8y (revision), >= 0.9.8z_p1 (revision), >= 0.9.8z_p2 (revision), >= 0.9.8z_p3 (revision), >= 0.9.8z_p4 (revision), >= 0.9.8z_p5 (revision), >= 0.9.8z_p6 (revision), >= 0.9.8z_p7 (revision), >= 0.9.8z_p8 (revision), >= 0.9.8z_p9 (revision), >= 0.9.8z_p10 (revision), >= 0.9.8z_p11 (revision), >= 0.9.8z_p12 (revision), >= 0.9.8z_p13 (revision), >= 0.9.8z_p14 (revision), >= 0.9.8z_p15 (revision) |
OpenSSL is an Open Source toolkit implementing the Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1) as well as a general purpose cryptography library.
Multiple vulnerabilities have been discovered in OpenSSL. Please review the CVE identifiers referenced below for details.
A context-dependent attacker could cause a Denial of Service, possibly execute arbitrary code, bypass intended key requirements, force the downgrade to unintended ciphers, bypass the need for knowledge of shared secrets and successfully authenticate, bypass CRL validation, or obtain sensitive information in applications that use OpenSSL.
There is no known workaround at this time.
All OpenSSL users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-libs/openssl-1.0.0e"
NOTE: This is a legacy GLSA. Updates for all affected architectures are available since September 17, 2011. It is likely that your system is already no longer affected by most of these issues.
Multiple vulnerabilities in OpenSSL might allow remote attackers to conduct multiple attacks, including the injection of arbitrary data into encrypted byte streams.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-libs/openssl | * | < 0.9.8l-r2 | >= 0.9.8l-r2 |
OpenSSL is an Open Source toolkit implementing the Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1) as well as a general purpose cryptography library.
Multiple vulnerabilities have been reported in OpenSSL:
A remote unauthenticated attacker, acting as a Man in the Middle, could inject arbitrary plain text into a TLS session, possibly leading to the ability to send requests as if authenticated as the victim. A remote attacker could furthermore send specially crafted DTLS packages to a service using OpenSSL for DTLS support, possibly resulting in a Denial of Service. Also, a remote attacker might be able to create rogue certificates, facilitated by a MD2 collision. NOTE: The amount of computation needed for this attack is still very large.
There is no known workaround at this time.
All OpenSSL users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-libs/openssl-0.9.8l-r2"
An error in OpenSSL might allow for a Denial of Service when printing certificate details.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-libs/openssl | * | < 0.9.8k | >= 0.9.8k |
OpenSSL is an Open Source toolkit implementing the Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1) as well as a general purpose cryptography library.
The ASN1_STRING_print_ex() function does not properly check the provided length of a BMPString or UniversalString, leading to an invalid memory access.
A remote attacker could entice a user or automated system to print a specially crafted certificate, possibly leading to a Denial of Service.
There is no known workaround at this time.
All OpenSSL users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-libs/openssl-0.9.8k"
An error in the OpenSSL certificate chain validation might allow for spoofing attacks.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-libs/openssl | * | < 0.9.8j | >= 0.9.8j |
OpenSSL is an Open Source toolkit implementing the Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1) as well as a general purpose cryptography library.
The Google Security Team reported that several functions incorrectly check the result after calling the EVP_VerifyFinal() function, allowing a malformed signature to be treated as a good signature rather than as an error. This issue affects the signature checks on DSA and ECDSA keys used with SSL/TLS.
A remote attacker could exploit this vulnerability and spoof arbitrary names to conduct Man-In-The-Middle attacks and intercept sensitive information.
There is no known workaround at this time.
All OpenSSL users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-libs/openssl-0.9.8j"
Two vulnerabilities might allow for a Denial of Service of daemons using OpenSSL.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-libs/openssl | * | < 0.9.8g-r2 | >= 0.9.8g-r2, < 0.9.8f |
OpenSSL is an Open Source toolkit implementing the Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1) as well as a general purpose cryptography library.
Ossi Herrala and Jukka Taimisto of Codenomicon discovered two vulnerabilities:
A remote attacker could connect to a vulnerable server, or entice a daemon to connect to a malicious server, causing a Denial of Service of the daemon in both cases.
There is no known workaround at this time.
All OpenSSL users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-libs/openssl-0.9.8g-r2"
OpenSSL contains a vulnerability allowing execution of arbitrary code or a Denial of Service.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-libs/openssl | * | < 0.9.8f | >= 0.9.8f |
OpenSSL is an Open Source toolkit implementing the Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1) as well as a general purpose cryptography library.
Andy Polyakov reported a vulnerability in the OpenSSL toolkit, that is caused due to an unspecified off-by-one error within the DTLS implementation.
A remote attacker could exploit this issue to execute arbitrary code or cause a Denial of Service. Only clients and servers explicitly using DTLS are affected, systems using SSL and TLS are not.
There is no known workaround at this time.
All OpenSSL users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-libs/openssl-0.9.8f"
A buffer underflow vulnerability and an information disclosure vulnerability have been discovered in OpenSSL.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-libs/openssl | * | < 0.9.8e-r3 | >= 0.9.8e-r3 |
OpenSSL is an implementation of the Secure Socket Layer and Transport Layer Security protocols.
Moritz Jodeit reported an off-by-one error in the SSL_get_shared_ciphers() function, resulting from an incomplete fix of CVE-2006-3738. A flaw has also been reported in the BN_from_montgomery() function in crypto/bn/bn_mont.c when performing Montgomery multiplication.
A remote attacker sending a specially crafted packet to an application relying on OpenSSL could possibly execute arbitrary code with the privileges of the user running the application. A local attacker could perform a side channel attack to retrieve the RSA private keys.
There is no known workaround at this time.
All OpenSSL users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-libs/openssl-0.9.8e-r3"
OpenSSL contains multiple vulnerabilities including the possible remote execution of arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-libs/openssl | * | < 0.9.8d | >= 0.9.8d, >= 0.9.7l (revision) |
OpenSSL is a toolkit implementing the Secure Sockets Layer, Transport Layer Security protocols and a general-purpose cryptography library.
Tavis Ormandy and Will Drewry, both of the Google Security Team, discovered that the SSL_get_shared_ciphers() function contains a buffer overflow vulnerability, and that the SSLv2 client code contains a flaw leading to a crash. Additionally Dr. Stephen N. Henson found that the ASN.1 handler contains two Denial of Service vulnerabilities: while parsing an invalid ASN.1 structure and while handling certain types of public key.
An attacker could trigger the buffer overflow vulnerability by sending a malicious suite of ciphers to an application using the vulnerable function, and thus execute arbitrary code with the rights of the user running the application. An attacker could also consume CPU and/or memory by exploiting the Denial of Service vulnerabilities. Finally a malicious server could crash a SSLv2 client through the SSLv2 vulnerability.
There is no known workaround at this time.
All OpenSSL 0.9.8 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-libs/openssl-0.9.8d"
All OpenSSL 0.9.7 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-libs/openssl-0.9.7l"
OpenSSL fails to properly validate PKCS #1 v1.5 signatures.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| app-emulation/emul-linux-x86-baselibs | amd64 | < 2.5.2 | >= 2.5.2 |
| dev-libs/openssl | * | < 0.9.7k | >= 0.9.7k |
OpenSSL is a toolkit implementing the Secure Sockets Layer, Transport Layer Security protocols and a general-purpose cryptography library. The x86 emulation base libraries for AMD64 contain a vulnerable version of OpenSSL.
Daniel Bleichenbacher discovered that it might be possible to forge signatures signed by RSA keys with the exponent of 3.
Since several CAs are using an exponent of 3 it might be possible for an attacker to create a key with a false CA signature.
There is no known workaround at this time.
All OpenSSL users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-libs/openssl-0.9.7k"
All AMD64 x86 emulation base libraries users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-emulation/emul-linux-x86-baselibs-2.5.2"
When using a specific option, OpenSSL can be forced to fallback to the less secure SSL 2.0 protocol.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-libs/openssl | * | < 0.9.7h | >= 0.9.7h, >= 0.9.7g-r1 (revision), >= 0.9.7e-r2 (revision) |
OpenSSL is a toolkit implementing the Secure Sockets Layer, Transport Layer Security protocols and a general-purpose cryptography library.
Applications setting the SSL_OP_MSIE_SSLV2_RSA_PADDING option (or the SSL_OP_ALL option, that implies it) can be forced by a third-party to fallback to the less secure SSL 2.0 protocol, even if both parties support the more secure SSL 3.0 or TLS 1.0 protocols.
A man-in-the-middle attacker can weaken the encryption used to communicate between two parties, potentially revealing sensitive information.
If possible, disable the use of SSL 2.0 in all OpenSSL-enabled applications.
All OpenSSL users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose dev-libs/openssl
groffer, included in the Groff package, and the der_chop script, included in the OpenSSL package, are both vulnerable to symlink attacks, potentially allowing a local user to overwrite arbitrary files with the rights of the user running the utility.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-libs/openssl | * | < 0.9.7d-r2 | >= 0.9.7d-r2 |
| sys-apps/groff | * | < 1.19.1-r2 | >= 1.19.1-r2, >= 1.18.1.1 (revision) |
OpenSSL is a toolkit implementing the Secure Sockets Layer and Transport Layer Security protocols as well as a general-purpose cryptography library. It includes the der_chop script, which is used to convert DER-encoded certificates to PEM format. Groff (GNU Troff) is a typesetting package which reads plain text mixed with formatting commands and produces formatted output. It includes groffer, a command used to display groff files and man pages on X and tty.
groffer and the der_chop script create temporary files in world-writeable directories with predictable names.
A local attacker could create symbolic links in the temporary files directory, pointing to a valid file somewhere on the filesystem. When groffer or der_chop is executed, this would result in the file being overwritten with the rights of the user running the utility, which could be the root user.
There is no known workaround at this time.
All Groff users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose sys-apps/groff
All OpenSSL users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-libs/openssl-0.9.7d-r2"
Note: /etc/ssl/misc/der_chop is protected by Portage as a configuration file. Don't forget to use etc-update and overwrite the old version with the new one.
Three vulnerabilities have been found in OpenSSL via a commercial test suite for the TLS protocol developed by Codenomicon Ltd.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-libs/openssl | * | <= 0.9.7c | >= 0.9.7d, = 0.9.6m |
The OpenSSL Project is a collaborative effort to develop a robust, commercial-grade, full-featured, and Open Source toolkit implementing the Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1) protocols as well as a full-strength general purpose cryptography library.
Although there are no public exploits known for bug, users are recommended to upgrade to ensure the security of their infrastructure.
There is no immediate workaround; a software upgrade is required. The vulnerable function in the code has been rewritten.
All users are recommened to upgrade openssl to either 0.9.7d or 0.9.6m:
# emerge sync # emerge -pv ">=dev-libs/openssl-0.9.7d" # emerge ">=dev-libs/openssl-0.9.7d"