{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "OpenSSL versions 3.0.x ant\u00e9rieures \u00e0 3.0.15",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "OpenSSL",
          "scada": false
        }
      }
    },
    {
      "description": "OpenSSL versions 3.3.x ant\u00e9rieures \u00e0 3.3.2",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "OpenSSL",
          "scada": false
        }
      }
    },
    {
      "description": "OpenSSL versions 1.1.1.x ant\u00e9rieures \u00e0 1.1.1za",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "OpenSSL",
          "scada": false
        }
      }
    },
    {
      "description": "OpenSSL versions 3.1.x ant\u00e9rieures \u00e0 3.1.7",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "OpenSSL",
          "scada": false
        }
      }
    },
    {
      "description": "OpenSSL versions 1.0.2.x ant\u00e9rieures \u00e0 1.0.2zk",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "OpenSSL",
          "scada": false
        }
      }
    },
    {
      "description": "OpenSSL versions 3.2.x ant\u00e9rieures \u00e0 3.2.3",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "OpenSSL",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "L\u0027\u00e9diteur indique que les modules FIPS des versions 3.3, 3.2, 3.1 et 3.0 ne sont pas affect\u00e9s par cette vuln\u00e9rabilit\u00e9.",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2024-5535",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-5535"
    }
  ],
  "links": [],
  "reference": "CERTFR-2024-AVI-0522",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2024-06-27T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans OpenSSL. Elle permet \u00e0 un attaquant de provoquer une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es et un d\u00e9ni de service.",
  "title": "Vuln\u00e9rabilit\u00e9 dans OpenSSL",
  "vendor_advisories": [
    {
      "published_at": "2024-06-27",
      "title": "Bulletin de s\u00e9curit\u00e9 OpenSSL 20240627",
      "url": "https://www.openssl.org/news/secadv/20240627.txt"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "versions inf\u00e9rieures \u00e0 1.0.0c (CVE-2010-4252) ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "OpenSSL",
          "scada": false
        }
      }
    },
    {
      "description": "versions inf\u00e9rieures \u00e0 0.9.8q et 1.0.x avant 1.0.0c (CVE-2010-4180) ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "OpenSSL",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Description\n\nLa premi\u00e8re vuln\u00e9rabilit\u00e9 corrig\u00e9e (CVE-2010-4180) permet \u00e0 un\nutilisateur malveillant de forcer les connexions futures \u00e0 utiliser un\nalgorithme de chiffrement faible.\n\nLa seconde (CVE-2010-4252) permet \u00e0 un utilisateur malveillant de\ns\u0027authentifier sans conna\u00eetre le secret partag\u00e9 lorsque le protocole\nJ-PAKE est utilis\u00e9.\n\n## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2010-4252",
      "url": "https://www.cve.org/CVERecord?id=CVE-2010-4252"
    },
    {
      "name": "CVE-2010-4180",
      "url": "https://www.cve.org/CVERecord?id=CVE-2010-4180"
    }
  ],
  "links": [
    {
      "title": "Bulletin de s\u00e9curit\u00e9 HP HPSBUS02638 SSRT100339 du 03 mars    2011 :",
      "url": "http://www.itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02737002"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 Oracle Solaris du 29 avril 2011 :",
      "url": "http://blogs.sun.com/security/entry/cve_2010_4180_affects_openssl"
    }
  ],
  "reference": "CERTA-2010-AVI-590",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2010-12-14T00:00:00.000000"
    },
    {
      "description": "Ajout de la r\u00e9f\u00e9rence au bulletin de s\u00e9curit\u00e9 HP-UX.",
      "revision_date": "2011-03-04T00:00:00.000000"
    },
    {
      "description": "Ajout de la r\u00e9f\u00e9rence au bulletin de s\u00e9curit\u00e9 Oracle Solaris.",
      "revision_date": "2011-05-04T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    }
  ],
  "summary": "Deux vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 corrig\u00e9es dans OpenSSL. Elles permettent \u00e0\nun utilisateur de contourner la politique de s\u00e9curit\u00e9.\n",
  "title": "Vuln\u00e9rabilit\u00e9s dans OpenSSL",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 OpenSSL du 02 d\u00e9cembre 2010",
      "url": "http://www.openssl.org/news/secadv_20101202.txt"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Sun Solaris 10 pour architecture SPARC ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "OpenSSL",
          "scada": false
        }
      }
    },
    {
      "description": "Sun Solaris 10 pour architecture x86.",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "OpenSSL",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Description\n\nUne erreur est pr\u00e9sente dans le moteur de traitement des fichiers au\nformat PKCS#11 de OpenSSL pour Sun Solaris 10. Cette vuln\u00e9rabilit\u00e9 peut\nengendrer des corruptions de m\u00e9moire cache interne dans OpenSSL.\n\nAinsi, un utilisateur distant malintentionn\u00e9 peut provoquer un d\u00e9ni de\nservice de OpenSSL ou d\u0027une application s\u0027appuyant sur ce dernier par le\nbiais d\u0027un fichier au format PKCS#11 construit de fa\u00e7on particuli\u00e8re.\n\n## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [],
  "links": [
    {
      "title": "Bulletin de s\u00e9curit\u00e9 Sun Solaris #246846 du 03 d\u00e9cembre    2008 :",
      "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-66-246846-1"
    }
  ],
  "reference": "CERTA-2008-AVI-600",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2008-12-11T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 dans la version de OpenSSL pour Sun Solaris 10 permet\n\u00e0 un utilisateur distant malintentionn\u00e9 de provoquer un d\u00e9ni de service.\n",
  "title": "Vuln\u00e9rabilit\u00e9 dans OpenSSL de Sun Solaris",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Sun #246846",
      "url": null
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Nortel VPN Router Contivity 2500, 4500, 4600 ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "OpenSSL",
          "scada": false
        }
      }
    },
    {
      "description": "Nortel Self-Service Media Processing Svr 500 ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "OpenSSL",
          "scada": false
        }
      }
    },
    {
      "description": "Nortel ENSM IP Adress Manager ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "OpenSSL",
          "scada": false
        }
      }
    },
    {
      "description": "Nortel VPN Router 600, 1010, 1050, 1100, 1700, 1740, 1750, 2700, 5000 ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "OpenSSL",
          "scada": false
        }
      }
    },
    {
      "description": "Nortel Wlan Wireless Gateway 7250",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "OpenSSL",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Description\n\nPlusieurs vuln\u00e9rabilit\u00e9s pr\u00e9sentes dans OpenSSL peuvent \u00eatre utilis\u00e9es\npar un utilisateur mal intentionn\u00e9 pour compromettre les produits CISCO.\n\nPour plus de d\u00e9tail sur les vuln\u00e9rabilit\u00e9s d\u0027OpenSSL, se r\u00e9f\u00e9rer au\nbulletin de s\u00e9curit\u00e9 CERTA-2006-AVI-421 du CERTA (cf. section\nDocumentation).\n\n## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2006-2738",
      "url": "https://www.cve.org/CVERecord?id=CVE-2006-2738"
    }
  ],
  "links": [
    {
      "title": "Bulletin de s\u00e9curit\u00e9 CERTA-2006-AVI-421 du 03 octobre 2006    :",
      "url": "http://www.certa.ssi.gouv.fr/site/CERTA-2006-AVI-421/index.html"
    }
  ],
  "reference": "CERTA-2006-AVI-471",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2006-11-06T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    }
  ],
  "summary": null,
  "title": "Vuln\u00e9rabilit\u00e9 OpenSSL sur les produits Nortel",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Nortel",
      "url": "http://www130.nortelnetworks.com/cgi-bin/go/main.jsp?cscat=BLTNDETAIL\u0026DocumentOID=498093\u0026RenditionID=\u0026poid=8881"
    }
  ]
}