csaf_opensuse - opensuse-su-2024:14219-1

Vulnerability from csaf_opensuse

Published

2024-07-26 00:00

Modified

2024-07-26 00:00

Summary

libopenssl-1_1-devel-1.1.1w-11.1 on GA media

Notes

Title of the patch

libopenssl-1_1-devel-1.1.1w-11.1 on GA media

Description of the patch

These are all security issues fixed in the libopenssl-1_1-devel-1.1.1w-11.1 package on the GA media of openSUSE Tumbleweed.

Patchnames

openSUSE-Tumbleweed-2024-14219

CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).

JSON

To clipboard

{
   document: {
      aggregate_severity: {
         namespace: "https://www.suse.com/support/security/rating/",
         text: "moderate",
      },
      category: "csaf_security_advisory",
      csaf_version: "2.0",
      distribution: {
         text: "Copyright 2024 SUSE LLC. All rights reserved.",
         tlp: {
            label: "WHITE",
            url: "https://www.first.org/tlp/",
         },
      },
      lang: "en",
      notes: [
         {
            category: "summary",
            text: "libopenssl-1_1-devel-1.1.1w-11.1 on GA media",
            title: "Title of the patch",
         },
         {
            category: "description",
            text: "These are all security issues fixed in the libopenssl-1_1-devel-1.1.1w-11.1 package on the GA media of openSUSE Tumbleweed.",
            title: "Description of the patch",
         },
         {
            category: "details",
            text: "openSUSE-Tumbleweed-2024-14219",
            title: "Patchnames",
         },
         {
            category: "legal_disclaimer",
            text: "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
            title: "Terms of use",
         },
      ],
      publisher: {
         category: "vendor",
         contact_details: "https://www.suse.com/support/security/contact/",
         name: "SUSE Product Security Team",
         namespace: "https://www.suse.com/",
      },
      references: [
         {
            category: "external",
            summary: "SUSE ratings",
            url: "https://www.suse.com/support/security/rating/",
         },
         {
            category: "self",
            summary: "URL of this CSAF notice",
            url: "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2024_14219-1.json",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2024-4741 page",
            url: "https://www.suse.com/security/cve/CVE-2024-4741/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2024-5535 page",
            url: "https://www.suse.com/security/cve/CVE-2024-5535/",
         },
      ],
      title: "libopenssl-1_1-devel-1.1.1w-11.1 on GA media",
      tracking: {
         current_release_date: "2024-07-26T00:00:00Z",
         generator: {
            date: "2024-07-26T00:00:00Z",
            engine: {
               name: "cve-database.git:bin/generate-csaf.pl",
               version: "1",
            },
         },
         id: "openSUSE-SU-2024:14219-1",
         initial_release_date: "2024-07-26T00:00:00Z",
         revision_history: [
            {
               date: "2024-07-26T00:00:00Z",
               number: "1",
               summary: "Current version",
            },
         ],
         status: "final",
         version: "1",
      },
   },
   product_tree: {
      branches: [
         {
            branches: [
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "libopenssl-1_1-devel-1.1.1w-11.1.aarch64",
                        product: {
                           name: "libopenssl-1_1-devel-1.1.1w-11.1.aarch64",
                           product_id: "libopenssl-1_1-devel-1.1.1w-11.1.aarch64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "libopenssl-1_1-devel-32bit-1.1.1w-11.1.aarch64",
                        product: {
                           name: "libopenssl-1_1-devel-32bit-1.1.1w-11.1.aarch64",
                           product_id: "libopenssl-1_1-devel-32bit-1.1.1w-11.1.aarch64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "libopenssl1_1-1.1.1w-11.1.aarch64",
                        product: {
                           name: "libopenssl1_1-1.1.1w-11.1.aarch64",
                           product_id: "libopenssl1_1-1.1.1w-11.1.aarch64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "libopenssl1_1-32bit-1.1.1w-11.1.aarch64",
                        product: {
                           name: "libopenssl1_1-32bit-1.1.1w-11.1.aarch64",
                           product_id: "libopenssl1_1-32bit-1.1.1w-11.1.aarch64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "openssl-1_1-1.1.1w-11.1.aarch64",
                        product: {
                           name: "openssl-1_1-1.1.1w-11.1.aarch64",
                           product_id: "openssl-1_1-1.1.1w-11.1.aarch64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "openssl-1_1-doc-1.1.1w-11.1.aarch64",
                        product: {
                           name: "openssl-1_1-doc-1.1.1w-11.1.aarch64",
                           product_id: "openssl-1_1-doc-1.1.1w-11.1.aarch64",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "aarch64",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "libopenssl-1_1-devel-1.1.1w-11.1.ppc64le",
                        product: {
                           name: "libopenssl-1_1-devel-1.1.1w-11.1.ppc64le",
                           product_id: "libopenssl-1_1-devel-1.1.1w-11.1.ppc64le",
                        },
                     },
                     {
                        category: "product_version",
                        name: "libopenssl-1_1-devel-32bit-1.1.1w-11.1.ppc64le",
                        product: {
                           name: "libopenssl-1_1-devel-32bit-1.1.1w-11.1.ppc64le",
                           product_id: "libopenssl-1_1-devel-32bit-1.1.1w-11.1.ppc64le",
                        },
                     },
                     {
                        category: "product_version",
                        name: "libopenssl1_1-1.1.1w-11.1.ppc64le",
                        product: {
                           name: "libopenssl1_1-1.1.1w-11.1.ppc64le",
                           product_id: "libopenssl1_1-1.1.1w-11.1.ppc64le",
                        },
                     },
                     {
                        category: "product_version",
                        name: "libopenssl1_1-32bit-1.1.1w-11.1.ppc64le",
                        product: {
                           name: "libopenssl1_1-32bit-1.1.1w-11.1.ppc64le",
                           product_id: "libopenssl1_1-32bit-1.1.1w-11.1.ppc64le",
                        },
                     },
                     {
                        category: "product_version",
                        name: "openssl-1_1-1.1.1w-11.1.ppc64le",
                        product: {
                           name: "openssl-1_1-1.1.1w-11.1.ppc64le",
                           product_id: "openssl-1_1-1.1.1w-11.1.ppc64le",
                        },
                     },
                     {
                        category: "product_version",
                        name: "openssl-1_1-doc-1.1.1w-11.1.ppc64le",
                        product: {
                           name: "openssl-1_1-doc-1.1.1w-11.1.ppc64le",
                           product_id: "openssl-1_1-doc-1.1.1w-11.1.ppc64le",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "ppc64le",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "libopenssl-1_1-devel-1.1.1w-11.1.s390x",
                        product: {
                           name: "libopenssl-1_1-devel-1.1.1w-11.1.s390x",
                           product_id: "libopenssl-1_1-devel-1.1.1w-11.1.s390x",
                        },
                     },
                     {
                        category: "product_version",
                        name: "libopenssl-1_1-devel-32bit-1.1.1w-11.1.s390x",
                        product: {
                           name: "libopenssl-1_1-devel-32bit-1.1.1w-11.1.s390x",
                           product_id: "libopenssl-1_1-devel-32bit-1.1.1w-11.1.s390x",
                        },
                     },
                     {
                        category: "product_version",
                        name: "libopenssl1_1-1.1.1w-11.1.s390x",
                        product: {
                           name: "libopenssl1_1-1.1.1w-11.1.s390x",
                           product_id: "libopenssl1_1-1.1.1w-11.1.s390x",
                        },
                     },
                     {
                        category: "product_version",
                        name: "libopenssl1_1-32bit-1.1.1w-11.1.s390x",
                        product: {
                           name: "libopenssl1_1-32bit-1.1.1w-11.1.s390x",
                           product_id: "libopenssl1_1-32bit-1.1.1w-11.1.s390x",
                        },
                     },
                     {
                        category: "product_version",
                        name: "openssl-1_1-1.1.1w-11.1.s390x",
                        product: {
                           name: "openssl-1_1-1.1.1w-11.1.s390x",
                           product_id: "openssl-1_1-1.1.1w-11.1.s390x",
                        },
                     },
                     {
                        category: "product_version",
                        name: "openssl-1_1-doc-1.1.1w-11.1.s390x",
                        product: {
                           name: "openssl-1_1-doc-1.1.1w-11.1.s390x",
                           product_id: "openssl-1_1-doc-1.1.1w-11.1.s390x",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "s390x",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "libopenssl-1_1-devel-1.1.1w-11.1.x86_64",
                        product: {
                           name: "libopenssl-1_1-devel-1.1.1w-11.1.x86_64",
                           product_id: "libopenssl-1_1-devel-1.1.1w-11.1.x86_64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "libopenssl-1_1-devel-32bit-1.1.1w-11.1.x86_64",
                        product: {
                           name: "libopenssl-1_1-devel-32bit-1.1.1w-11.1.x86_64",
                           product_id: "libopenssl-1_1-devel-32bit-1.1.1w-11.1.x86_64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "libopenssl1_1-1.1.1w-11.1.x86_64",
                        product: {
                           name: "libopenssl1_1-1.1.1w-11.1.x86_64",
                           product_id: "libopenssl1_1-1.1.1w-11.1.x86_64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "libopenssl1_1-32bit-1.1.1w-11.1.x86_64",
                        product: {
                           name: "libopenssl1_1-32bit-1.1.1w-11.1.x86_64",
                           product_id: "libopenssl1_1-32bit-1.1.1w-11.1.x86_64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "openssl-1_1-1.1.1w-11.1.x86_64",
                        product: {
                           name: "openssl-1_1-1.1.1w-11.1.x86_64",
                           product_id: "openssl-1_1-1.1.1w-11.1.x86_64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "openssl-1_1-doc-1.1.1w-11.1.x86_64",
                        product: {
                           name: "openssl-1_1-doc-1.1.1w-11.1.x86_64",
                           product_id: "openssl-1_1-doc-1.1.1w-11.1.x86_64",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "x86_64",
               },
               {
                  branches: [
                     {
                        category: "product_name",
                        name: "openSUSE Tumbleweed",
                        product: {
                           name: "openSUSE Tumbleweed",
                           product_id: "openSUSE Tumbleweed",
                           product_identification_helper: {
                              cpe: "cpe:/o:opensuse:tumbleweed",
                           },
                        },
                     },
                  ],
                  category: "product_family",
                  name: "SUSE Linux Enterprise",
               },
            ],
            category: "vendor",
            name: "SUSE",
         },
      ],
      relationships: [
         {
            category: "default_component_of",
            full_product_name: {
               name: "libopenssl-1_1-devel-1.1.1w-11.1.aarch64 as component of openSUSE Tumbleweed",
               product_id: "openSUSE Tumbleweed:libopenssl-1_1-devel-1.1.1w-11.1.aarch64",
            },
            product_reference: "libopenssl-1_1-devel-1.1.1w-11.1.aarch64",
            relates_to_product_reference: "openSUSE Tumbleweed",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "libopenssl-1_1-devel-1.1.1w-11.1.ppc64le as component of openSUSE Tumbleweed",
               product_id: "openSUSE Tumbleweed:libopenssl-1_1-devel-1.1.1w-11.1.ppc64le",
            },
            product_reference: "libopenssl-1_1-devel-1.1.1w-11.1.ppc64le",
            relates_to_product_reference: "openSUSE Tumbleweed",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "libopenssl-1_1-devel-1.1.1w-11.1.s390x as component of openSUSE Tumbleweed",
               product_id: "openSUSE Tumbleweed:libopenssl-1_1-devel-1.1.1w-11.1.s390x",
            },
            product_reference: "libopenssl-1_1-devel-1.1.1w-11.1.s390x",
            relates_to_product_reference: "openSUSE Tumbleweed",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "libopenssl-1_1-devel-1.1.1w-11.1.x86_64 as component of openSUSE Tumbleweed",
               product_id: "openSUSE Tumbleweed:libopenssl-1_1-devel-1.1.1w-11.1.x86_64",
            },
            product_reference: "libopenssl-1_1-devel-1.1.1w-11.1.x86_64",
            relates_to_product_reference: "openSUSE Tumbleweed",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "libopenssl-1_1-devel-32bit-1.1.1w-11.1.aarch64 as component of openSUSE Tumbleweed",
               product_id: "openSUSE Tumbleweed:libopenssl-1_1-devel-32bit-1.1.1w-11.1.aarch64",
            },
            product_reference: "libopenssl-1_1-devel-32bit-1.1.1w-11.1.aarch64",
            relates_to_product_reference: "openSUSE Tumbleweed",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "libopenssl-1_1-devel-32bit-1.1.1w-11.1.ppc64le as component of openSUSE Tumbleweed",
               product_id: "openSUSE Tumbleweed:libopenssl-1_1-devel-32bit-1.1.1w-11.1.ppc64le",
            },
            product_reference: "libopenssl-1_1-devel-32bit-1.1.1w-11.1.ppc64le",
            relates_to_product_reference: "openSUSE Tumbleweed",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "libopenssl-1_1-devel-32bit-1.1.1w-11.1.s390x as component of openSUSE Tumbleweed",
               product_id: "openSUSE Tumbleweed:libopenssl-1_1-devel-32bit-1.1.1w-11.1.s390x",
            },
            product_reference: "libopenssl-1_1-devel-32bit-1.1.1w-11.1.s390x",
            relates_to_product_reference: "openSUSE Tumbleweed",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "libopenssl-1_1-devel-32bit-1.1.1w-11.1.x86_64 as component of openSUSE Tumbleweed",
               product_id: "openSUSE Tumbleweed:libopenssl-1_1-devel-32bit-1.1.1w-11.1.x86_64",
            },
            product_reference: "libopenssl-1_1-devel-32bit-1.1.1w-11.1.x86_64",
            relates_to_product_reference: "openSUSE Tumbleweed",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "libopenssl1_1-1.1.1w-11.1.aarch64 as component of openSUSE Tumbleweed",
               product_id: "openSUSE Tumbleweed:libopenssl1_1-1.1.1w-11.1.aarch64",
            },
            product_reference: "libopenssl1_1-1.1.1w-11.1.aarch64",
            relates_to_product_reference: "openSUSE Tumbleweed",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "libopenssl1_1-1.1.1w-11.1.ppc64le as component of openSUSE Tumbleweed",
               product_id: "openSUSE Tumbleweed:libopenssl1_1-1.1.1w-11.1.ppc64le",
            },
            product_reference: "libopenssl1_1-1.1.1w-11.1.ppc64le",
            relates_to_product_reference: "openSUSE Tumbleweed",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "libopenssl1_1-1.1.1w-11.1.s390x as component of openSUSE Tumbleweed",
               product_id: "openSUSE Tumbleweed:libopenssl1_1-1.1.1w-11.1.s390x",
            },
            product_reference: "libopenssl1_1-1.1.1w-11.1.s390x",
            relates_to_product_reference: "openSUSE Tumbleweed",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "libopenssl1_1-1.1.1w-11.1.x86_64 as component of openSUSE Tumbleweed",
               product_id: "openSUSE Tumbleweed:libopenssl1_1-1.1.1w-11.1.x86_64",
            },
            product_reference: "libopenssl1_1-1.1.1w-11.1.x86_64",
            relates_to_product_reference: "openSUSE Tumbleweed",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "libopenssl1_1-32bit-1.1.1w-11.1.aarch64 as component of openSUSE Tumbleweed",
               product_id: "openSUSE Tumbleweed:libopenssl1_1-32bit-1.1.1w-11.1.aarch64",
            },
            product_reference: "libopenssl1_1-32bit-1.1.1w-11.1.aarch64",
            relates_to_product_reference: "openSUSE Tumbleweed",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "libopenssl1_1-32bit-1.1.1w-11.1.ppc64le as component of openSUSE Tumbleweed",
               product_id: "openSUSE Tumbleweed:libopenssl1_1-32bit-1.1.1w-11.1.ppc64le",
            },
            product_reference: "libopenssl1_1-32bit-1.1.1w-11.1.ppc64le",
            relates_to_product_reference: "openSUSE Tumbleweed",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "libopenssl1_1-32bit-1.1.1w-11.1.s390x as component of openSUSE Tumbleweed",
               product_id: "openSUSE Tumbleweed:libopenssl1_1-32bit-1.1.1w-11.1.s390x",
            },
            product_reference: "libopenssl1_1-32bit-1.1.1w-11.1.s390x",
            relates_to_product_reference: "openSUSE Tumbleweed",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "libopenssl1_1-32bit-1.1.1w-11.1.x86_64 as component of openSUSE Tumbleweed",
               product_id: "openSUSE Tumbleweed:libopenssl1_1-32bit-1.1.1w-11.1.x86_64",
            },
            product_reference: "libopenssl1_1-32bit-1.1.1w-11.1.x86_64",
            relates_to_product_reference: "openSUSE Tumbleweed",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "openssl-1_1-1.1.1w-11.1.aarch64 as component of openSUSE Tumbleweed",
               product_id: "openSUSE Tumbleweed:openssl-1_1-1.1.1w-11.1.aarch64",
            },
            product_reference: "openssl-1_1-1.1.1w-11.1.aarch64",
            relates_to_product_reference: "openSUSE Tumbleweed",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "openssl-1_1-1.1.1w-11.1.ppc64le as component of openSUSE Tumbleweed",
               product_id: "openSUSE Tumbleweed:openssl-1_1-1.1.1w-11.1.ppc64le",
            },
            product_reference: "openssl-1_1-1.1.1w-11.1.ppc64le",
            relates_to_product_reference: "openSUSE Tumbleweed",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "openssl-1_1-1.1.1w-11.1.s390x as component of openSUSE Tumbleweed",
               product_id: "openSUSE Tumbleweed:openssl-1_1-1.1.1w-11.1.s390x",
            },
            product_reference: "openssl-1_1-1.1.1w-11.1.s390x",
            relates_to_product_reference: "openSUSE Tumbleweed",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "openssl-1_1-1.1.1w-11.1.x86_64 as component of openSUSE Tumbleweed",
               product_id: "openSUSE Tumbleweed:openssl-1_1-1.1.1w-11.1.x86_64",
            },
            product_reference: "openssl-1_1-1.1.1w-11.1.x86_64",
            relates_to_product_reference: "openSUSE Tumbleweed",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "openssl-1_1-doc-1.1.1w-11.1.aarch64 as component of openSUSE Tumbleweed",
               product_id: "openSUSE Tumbleweed:openssl-1_1-doc-1.1.1w-11.1.aarch64",
            },
            product_reference: "openssl-1_1-doc-1.1.1w-11.1.aarch64",
            relates_to_product_reference: "openSUSE Tumbleweed",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "openssl-1_1-doc-1.1.1w-11.1.ppc64le as component of openSUSE Tumbleweed",
               product_id: "openSUSE Tumbleweed:openssl-1_1-doc-1.1.1w-11.1.ppc64le",
            },
            product_reference: "openssl-1_1-doc-1.1.1w-11.1.ppc64le",
            relates_to_product_reference: "openSUSE Tumbleweed",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "openssl-1_1-doc-1.1.1w-11.1.s390x as component of openSUSE Tumbleweed",
               product_id: "openSUSE Tumbleweed:openssl-1_1-doc-1.1.1w-11.1.s390x",
            },
            product_reference: "openssl-1_1-doc-1.1.1w-11.1.s390x",
            relates_to_product_reference: "openSUSE Tumbleweed",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "openssl-1_1-doc-1.1.1w-11.1.x86_64 as component of openSUSE Tumbleweed",
               product_id: "openSUSE Tumbleweed:openssl-1_1-doc-1.1.1w-11.1.x86_64",
            },
            product_reference: "openssl-1_1-doc-1.1.1w-11.1.x86_64",
            relates_to_product_reference: "openSUSE Tumbleweed",
         },
      ],
   },
   vulnerabilities: [
      {
         cve: "CVE-2024-4741",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2024-4741",
            },
         ],
         notes: [
            {
               category: "general",
               text: "Issue summary: Calling the OpenSSL API function SSL_free_buffers may cause\nmemory to be accessed that was previously freed in some situations\n\nImpact summary: A use after free can have a range of potential consequences such\nas the corruption of valid data, crashes or execution of arbitrary code.\nHowever, only applications that directly call the SSL_free_buffers function are\naffected by this issue. Applications that do not call this function are not\nvulnerable. Our investigations indicate that this function is rarely used by\napplications.\n\nThe SSL_free_buffers function is used to free the internal OpenSSL buffer used\nwhen processing an incoming record from the network. The call is only expected\nto succeed if the buffer is not currently in use. However, two scenarios have\nbeen identified where the buffer is freed even when still in use.\n\nThe first scenario occurs where a record header has been received from the\nnetwork and processed by OpenSSL, but the full record body has not yet arrived.\nIn this case calling SSL_free_buffers will succeed even though a record has only\nbeen partially processed and the buffer is still in use.\n\nThe second scenario occurs where a full record containing application data has\nbeen received and processed by OpenSSL but the application has only read part of\nthis data. Again a call to SSL_free_buffers will succeed even though the buffer\nis still in use.\n\nWhile these scenarios could occur accidentally during normal operation a\nmalicious attacker could attempt to engineer a stituation where this occurs.\nWe are not aware of this issue being actively exploited.\n\nThe FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Tumbleweed:libopenssl-1_1-devel-1.1.1w-11.1.aarch64",
               "openSUSE Tumbleweed:libopenssl-1_1-devel-1.1.1w-11.1.ppc64le",
               "openSUSE Tumbleweed:libopenssl-1_1-devel-1.1.1w-11.1.s390x",
               "openSUSE Tumbleweed:libopenssl-1_1-devel-1.1.1w-11.1.x86_64",
               "openSUSE Tumbleweed:libopenssl-1_1-devel-32bit-1.1.1w-11.1.aarch64",
               "openSUSE Tumbleweed:libopenssl-1_1-devel-32bit-1.1.1w-11.1.ppc64le",
               "openSUSE Tumbleweed:libopenssl-1_1-devel-32bit-1.1.1w-11.1.s390x",
               "openSUSE Tumbleweed:libopenssl-1_1-devel-32bit-1.1.1w-11.1.x86_64",
               "openSUSE Tumbleweed:libopenssl1_1-1.1.1w-11.1.aarch64",
               "openSUSE Tumbleweed:libopenssl1_1-1.1.1w-11.1.ppc64le",
               "openSUSE Tumbleweed:libopenssl1_1-1.1.1w-11.1.s390x",
               "openSUSE Tumbleweed:libopenssl1_1-1.1.1w-11.1.x86_64",
               "openSUSE Tumbleweed:libopenssl1_1-32bit-1.1.1w-11.1.aarch64",
               "openSUSE Tumbleweed:libopenssl1_1-32bit-1.1.1w-11.1.ppc64le",
               "openSUSE Tumbleweed:libopenssl1_1-32bit-1.1.1w-11.1.s390x",
               "openSUSE Tumbleweed:libopenssl1_1-32bit-1.1.1w-11.1.x86_64",
               "openSUSE Tumbleweed:openssl-1_1-1.1.1w-11.1.aarch64",
               "openSUSE Tumbleweed:openssl-1_1-1.1.1w-11.1.ppc64le",
               "openSUSE Tumbleweed:openssl-1_1-1.1.1w-11.1.s390x",
               "openSUSE Tumbleweed:openssl-1_1-1.1.1w-11.1.x86_64",
               "openSUSE Tumbleweed:openssl-1_1-doc-1.1.1w-11.1.aarch64",
               "openSUSE Tumbleweed:openssl-1_1-doc-1.1.1w-11.1.ppc64le",
               "openSUSE Tumbleweed:openssl-1_1-doc-1.1.1w-11.1.s390x",
               "openSUSE Tumbleweed:openssl-1_1-doc-1.1.1w-11.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2024-4741",
               url: "https://www.suse.com/security/cve/CVE-2024-4741",
            },
            {
               category: "external",
               summary: "SUSE Bug 1225551 for CVE-2024-4741",
               url: "https://bugzilla.suse.com/1225551",
            },
            {
               category: "external",
               summary: "SUSE Bug 1225552 for CVE-2024-4741",
               url: "https://bugzilla.suse.com/1225552",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Tumbleweed:libopenssl-1_1-devel-1.1.1w-11.1.aarch64",
                  "openSUSE Tumbleweed:libopenssl-1_1-devel-1.1.1w-11.1.ppc64le",
                  "openSUSE Tumbleweed:libopenssl-1_1-devel-1.1.1w-11.1.s390x",
                  "openSUSE Tumbleweed:libopenssl-1_1-devel-1.1.1w-11.1.x86_64",
                  "openSUSE Tumbleweed:libopenssl-1_1-devel-32bit-1.1.1w-11.1.aarch64",
                  "openSUSE Tumbleweed:libopenssl-1_1-devel-32bit-1.1.1w-11.1.ppc64le",
                  "openSUSE Tumbleweed:libopenssl-1_1-devel-32bit-1.1.1w-11.1.s390x",
                  "openSUSE Tumbleweed:libopenssl-1_1-devel-32bit-1.1.1w-11.1.x86_64",
                  "openSUSE Tumbleweed:libopenssl1_1-1.1.1w-11.1.aarch64",
                  "openSUSE Tumbleweed:libopenssl1_1-1.1.1w-11.1.ppc64le",
                  "openSUSE Tumbleweed:libopenssl1_1-1.1.1w-11.1.s390x",
                  "openSUSE Tumbleweed:libopenssl1_1-1.1.1w-11.1.x86_64",
                  "openSUSE Tumbleweed:libopenssl1_1-32bit-1.1.1w-11.1.aarch64",
                  "openSUSE Tumbleweed:libopenssl1_1-32bit-1.1.1w-11.1.ppc64le",
                  "openSUSE Tumbleweed:libopenssl1_1-32bit-1.1.1w-11.1.s390x",
                  "openSUSE Tumbleweed:libopenssl1_1-32bit-1.1.1w-11.1.x86_64",
                  "openSUSE Tumbleweed:openssl-1_1-1.1.1w-11.1.aarch64",
                  "openSUSE Tumbleweed:openssl-1_1-1.1.1w-11.1.ppc64le",
                  "openSUSE Tumbleweed:openssl-1_1-1.1.1w-11.1.s390x",
                  "openSUSE Tumbleweed:openssl-1_1-1.1.1w-11.1.x86_64",
                  "openSUSE Tumbleweed:openssl-1_1-doc-1.1.1w-11.1.aarch64",
                  "openSUSE Tumbleweed:openssl-1_1-doc-1.1.1w-11.1.ppc64le",
                  "openSUSE Tumbleweed:openssl-1_1-doc-1.1.1w-11.1.s390x",
                  "openSUSE Tumbleweed:openssl-1_1-doc-1.1.1w-11.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 8.1,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  version: "3.1",
               },
               products: [
                  "openSUSE Tumbleweed:libopenssl-1_1-devel-1.1.1w-11.1.aarch64",
                  "openSUSE Tumbleweed:libopenssl-1_1-devel-1.1.1w-11.1.ppc64le",
                  "openSUSE Tumbleweed:libopenssl-1_1-devel-1.1.1w-11.1.s390x",
                  "openSUSE Tumbleweed:libopenssl-1_1-devel-1.1.1w-11.1.x86_64",
                  "openSUSE Tumbleweed:libopenssl-1_1-devel-32bit-1.1.1w-11.1.aarch64",
                  "openSUSE Tumbleweed:libopenssl-1_1-devel-32bit-1.1.1w-11.1.ppc64le",
                  "openSUSE Tumbleweed:libopenssl-1_1-devel-32bit-1.1.1w-11.1.s390x",
                  "openSUSE Tumbleweed:libopenssl-1_1-devel-32bit-1.1.1w-11.1.x86_64",
                  "openSUSE Tumbleweed:libopenssl1_1-1.1.1w-11.1.aarch64",
                  "openSUSE Tumbleweed:libopenssl1_1-1.1.1w-11.1.ppc64le",
                  "openSUSE Tumbleweed:libopenssl1_1-1.1.1w-11.1.s390x",
                  "openSUSE Tumbleweed:libopenssl1_1-1.1.1w-11.1.x86_64",
                  "openSUSE Tumbleweed:libopenssl1_1-32bit-1.1.1w-11.1.aarch64",
                  "openSUSE Tumbleweed:libopenssl1_1-32bit-1.1.1w-11.1.ppc64le",
                  "openSUSE Tumbleweed:libopenssl1_1-32bit-1.1.1w-11.1.s390x",
                  "openSUSE Tumbleweed:libopenssl1_1-32bit-1.1.1w-11.1.x86_64",
                  "openSUSE Tumbleweed:openssl-1_1-1.1.1w-11.1.aarch64",
                  "openSUSE Tumbleweed:openssl-1_1-1.1.1w-11.1.ppc64le",
                  "openSUSE Tumbleweed:openssl-1_1-1.1.1w-11.1.s390x",
                  "openSUSE Tumbleweed:openssl-1_1-1.1.1w-11.1.x86_64",
                  "openSUSE Tumbleweed:openssl-1_1-doc-1.1.1w-11.1.aarch64",
                  "openSUSE Tumbleweed:openssl-1_1-doc-1.1.1w-11.1.ppc64le",
                  "openSUSE Tumbleweed:openssl-1_1-doc-1.1.1w-11.1.s390x",
                  "openSUSE Tumbleweed:openssl-1_1-doc-1.1.1w-11.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2024-07-26T00:00:00Z",
               details: "important",
            },
         ],
         title: "CVE-2024-4741",
      },
      {
         cve: "CVE-2024-5535",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2024-5535",
            },
         ],
         notes: [
            {
               category: "general",
               text: "Issue summary: Calling the OpenSSL API function SSL_select_next_proto with an\nempty supported client protocols buffer may cause a crash or memory contents to\nbe sent to the peer.\n\nImpact summary: A buffer overread can have a range of potential consequences\nsuch as unexpected application beahviour or a crash. In particular this issue\ncould result in up to 255 bytes of arbitrary private data from memory being sent\nto the peer leading to a loss of confidentiality. However, only applications\nthat directly call the SSL_select_next_proto function with a 0 length list of\nsupported client protocols are affected by this issue. This would normally never\nbe a valid scenario and is typically not under attacker control but may occur by\naccident in the case of a configuration or programming error in the calling\napplication.\n\nThe OpenSSL API function SSL_select_next_proto is typically used by TLS\napplications that support ALPN (Application Layer Protocol Negotiation) or NPN\n(Next Protocol Negotiation). NPN is older, was never standardised and\nis deprecated in favour of ALPN. We believe that ALPN is significantly more\nwidely deployed than NPN. The SSL_select_next_proto function accepts a list of\nprotocols from the server and a list of protocols from the client and returns\nthe first protocol that appears in the server list that also appears in the\nclient list. In the case of no overlap between the two lists it returns the\nfirst item in the client list. In either case it will signal whether an overlap\nbetween the two lists was found. In the case where SSL_select_next_proto is\ncalled with a zero length client list it fails to notice this condition and\nreturns the memory immediately following the client list pointer (and reports\nthat there was no overlap in the lists).\n\nThis function is typically called from a server side application callback for\nALPN or a client side application callback for NPN. In the case of ALPN the list\nof protocols supplied by the client is guaranteed by libssl to never be zero in\nlength. The list of server protocols comes from the application and should never\nnormally be expected to be of zero length. In this case if the\nSSL_select_next_proto function has been called as expected (with the list\nsupplied by the client passed in the client/client_len parameters), then the\napplication will not be vulnerable to this issue. If the application has\naccidentally been configured with a zero length server list, and has\naccidentally passed that zero length server list in the client/client_len\nparameters, and has additionally failed to correctly handle a \"no overlap\"\nresponse (which would normally result in a handshake failure in ALPN) then it\nwill be vulnerable to this problem.\n\nIn the case of NPN, the protocol permits the client to opportunistically select\na protocol when there is no overlap. OpenSSL returns the first client protocol\nin the no overlap case in support of this. The list of client protocols comes\nfrom the application and should never normally be expected to be of zero length.\nHowever if the SSL_select_next_proto function is accidentally called with a\nclient_len of 0 then an invalid memory pointer will be returned instead. If the\napplication uses this output as the opportunistic protocol then the loss of\nconfidentiality will occur.\n\nThis issue has been assessed as Low severity because applications are most\nlikely to be vulnerable if they are using NPN instead of ALPN - but NPN is not\nwidely used. It also requires an application configuration or programming error.\nFinally, this issue would not typically be under attacker control making active\nexploitation unlikely.\n\nThe FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue.\n\nDue to the low severity of this issue we are not issuing new releases of\nOpenSSL at this time. The fix will be included in the next releases when they\nbecome available.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Tumbleweed:libopenssl-1_1-devel-1.1.1w-11.1.aarch64",
               "openSUSE Tumbleweed:libopenssl-1_1-devel-1.1.1w-11.1.ppc64le",
               "openSUSE Tumbleweed:libopenssl-1_1-devel-1.1.1w-11.1.s390x",
               "openSUSE Tumbleweed:libopenssl-1_1-devel-1.1.1w-11.1.x86_64",
               "openSUSE Tumbleweed:libopenssl-1_1-devel-32bit-1.1.1w-11.1.aarch64",
               "openSUSE Tumbleweed:libopenssl-1_1-devel-32bit-1.1.1w-11.1.ppc64le",
               "openSUSE Tumbleweed:libopenssl-1_1-devel-32bit-1.1.1w-11.1.s390x",
               "openSUSE Tumbleweed:libopenssl-1_1-devel-32bit-1.1.1w-11.1.x86_64",
               "openSUSE Tumbleweed:libopenssl1_1-1.1.1w-11.1.aarch64",
               "openSUSE Tumbleweed:libopenssl1_1-1.1.1w-11.1.ppc64le",
               "openSUSE Tumbleweed:libopenssl1_1-1.1.1w-11.1.s390x",
               "openSUSE Tumbleweed:libopenssl1_1-1.1.1w-11.1.x86_64",
               "openSUSE Tumbleweed:libopenssl1_1-32bit-1.1.1w-11.1.aarch64",
               "openSUSE Tumbleweed:libopenssl1_1-32bit-1.1.1w-11.1.ppc64le",
               "openSUSE Tumbleweed:libopenssl1_1-32bit-1.1.1w-11.1.s390x",
               "openSUSE Tumbleweed:libopenssl1_1-32bit-1.1.1w-11.1.x86_64",
               "openSUSE Tumbleweed:openssl-1_1-1.1.1w-11.1.aarch64",
               "openSUSE Tumbleweed:openssl-1_1-1.1.1w-11.1.ppc64le",
               "openSUSE Tumbleweed:openssl-1_1-1.1.1w-11.1.s390x",
               "openSUSE Tumbleweed:openssl-1_1-1.1.1w-11.1.x86_64",
               "openSUSE Tumbleweed:openssl-1_1-doc-1.1.1w-11.1.aarch64",
               "openSUSE Tumbleweed:openssl-1_1-doc-1.1.1w-11.1.ppc64le",
               "openSUSE Tumbleweed:openssl-1_1-doc-1.1.1w-11.1.s390x",
               "openSUSE Tumbleweed:openssl-1_1-doc-1.1.1w-11.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2024-5535",
               url: "https://www.suse.com/security/cve/CVE-2024-5535",
            },
            {
               category: "external",
               summary: "SUSE Bug 1227138 for CVE-2024-5535",
               url: "https://bugzilla.suse.com/1227138",
            },
            {
               category: "external",
               summary: "SUSE Bug 1227147 for CVE-2024-5535",
               url: "https://bugzilla.suse.com/1227147",
            },
            {
               category: "external",
               summary: "SUSE Bug 1227233 for CVE-2024-5535",
               url: "https://bugzilla.suse.com/1227233",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Tumbleweed:libopenssl-1_1-devel-1.1.1w-11.1.aarch64",
                  "openSUSE Tumbleweed:libopenssl-1_1-devel-1.1.1w-11.1.ppc64le",
                  "openSUSE Tumbleweed:libopenssl-1_1-devel-1.1.1w-11.1.s390x",
                  "openSUSE Tumbleweed:libopenssl-1_1-devel-1.1.1w-11.1.x86_64",
                  "openSUSE Tumbleweed:libopenssl-1_1-devel-32bit-1.1.1w-11.1.aarch64",
                  "openSUSE Tumbleweed:libopenssl-1_1-devel-32bit-1.1.1w-11.1.ppc64le",
                  "openSUSE Tumbleweed:libopenssl-1_1-devel-32bit-1.1.1w-11.1.s390x",
                  "openSUSE Tumbleweed:libopenssl-1_1-devel-32bit-1.1.1w-11.1.x86_64",
                  "openSUSE Tumbleweed:libopenssl1_1-1.1.1w-11.1.aarch64",
                  "openSUSE Tumbleweed:libopenssl1_1-1.1.1w-11.1.ppc64le",
                  "openSUSE Tumbleweed:libopenssl1_1-1.1.1w-11.1.s390x",
                  "openSUSE Tumbleweed:libopenssl1_1-1.1.1w-11.1.x86_64",
                  "openSUSE Tumbleweed:libopenssl1_1-32bit-1.1.1w-11.1.aarch64",
                  "openSUSE Tumbleweed:libopenssl1_1-32bit-1.1.1w-11.1.ppc64le",
                  "openSUSE Tumbleweed:libopenssl1_1-32bit-1.1.1w-11.1.s390x",
                  "openSUSE Tumbleweed:libopenssl1_1-32bit-1.1.1w-11.1.x86_64",
                  "openSUSE Tumbleweed:openssl-1_1-1.1.1w-11.1.aarch64",
                  "openSUSE Tumbleweed:openssl-1_1-1.1.1w-11.1.ppc64le",
                  "openSUSE Tumbleweed:openssl-1_1-1.1.1w-11.1.s390x",
                  "openSUSE Tumbleweed:openssl-1_1-1.1.1w-11.1.x86_64",
                  "openSUSE Tumbleweed:openssl-1_1-doc-1.1.1w-11.1.aarch64",
                  "openSUSE Tumbleweed:openssl-1_1-doc-1.1.1w-11.1.ppc64le",
                  "openSUSE Tumbleweed:openssl-1_1-doc-1.1.1w-11.1.s390x",
                  "openSUSE Tumbleweed:openssl-1_1-doc-1.1.1w-11.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 5.9,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  version: "3.1",
               },
               products: [
                  "openSUSE Tumbleweed:libopenssl-1_1-devel-1.1.1w-11.1.aarch64",
                  "openSUSE Tumbleweed:libopenssl-1_1-devel-1.1.1w-11.1.ppc64le",
                  "openSUSE Tumbleweed:libopenssl-1_1-devel-1.1.1w-11.1.s390x",
                  "openSUSE Tumbleweed:libopenssl-1_1-devel-1.1.1w-11.1.x86_64",
                  "openSUSE Tumbleweed:libopenssl-1_1-devel-32bit-1.1.1w-11.1.aarch64",
                  "openSUSE Tumbleweed:libopenssl-1_1-devel-32bit-1.1.1w-11.1.ppc64le",
                  "openSUSE Tumbleweed:libopenssl-1_1-devel-32bit-1.1.1w-11.1.s390x",
                  "openSUSE Tumbleweed:libopenssl-1_1-devel-32bit-1.1.1w-11.1.x86_64",
                  "openSUSE Tumbleweed:libopenssl1_1-1.1.1w-11.1.aarch64",
                  "openSUSE Tumbleweed:libopenssl1_1-1.1.1w-11.1.ppc64le",
                  "openSUSE Tumbleweed:libopenssl1_1-1.1.1w-11.1.s390x",
                  "openSUSE Tumbleweed:libopenssl1_1-1.1.1w-11.1.x86_64",
                  "openSUSE Tumbleweed:libopenssl1_1-32bit-1.1.1w-11.1.aarch64",
                  "openSUSE Tumbleweed:libopenssl1_1-32bit-1.1.1w-11.1.ppc64le",
                  "openSUSE Tumbleweed:libopenssl1_1-32bit-1.1.1w-11.1.s390x",
                  "openSUSE Tumbleweed:libopenssl1_1-32bit-1.1.1w-11.1.x86_64",
                  "openSUSE Tumbleweed:openssl-1_1-1.1.1w-11.1.aarch64",
                  "openSUSE Tumbleweed:openssl-1_1-1.1.1w-11.1.ppc64le",
                  "openSUSE Tumbleweed:openssl-1_1-1.1.1w-11.1.s390x",
                  "openSUSE Tumbleweed:openssl-1_1-1.1.1w-11.1.x86_64",
                  "openSUSE Tumbleweed:openssl-1_1-doc-1.1.1w-11.1.aarch64",
                  "openSUSE Tumbleweed:openssl-1_1-doc-1.1.1w-11.1.ppc64le",
                  "openSUSE Tumbleweed:openssl-1_1-doc-1.1.1w-11.1.s390x",
                  "openSUSE Tumbleweed:openssl-1_1-doc-1.1.1w-11.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2024-07-26T00:00:00Z",
               details: "moderate",
            },
         ],
         title: "CVE-2024-5535",
      },
   ],
}

cve-2024-5535

Vulnerability from cvelistv5

Published

2024-06-27 10:30

Modified

2025-02-13 17:54

Severity ?

Summary

Issue summary: Calling the OpenSSL API function SSL_select_next_proto with an empty supported client protocols buffer may cause a crash or memory contents to be sent to the peer. Impact summary: A buffer overread can have a range of potential consequences such as unexpected application beahviour or a crash. In particular this issue could result in up to 255 bytes of arbitrary private data from memory being sent to the peer leading to a loss of confidentiality. However, only applications that directly call the SSL_select_next_proto function with a 0 length list of supported client protocols are affected by this issue. This would normally never be a valid scenario and is typically not under attacker control but may occur by accident in the case of a configuration or programming error in the calling application. The OpenSSL API function SSL_select_next_proto is typically used by TLS applications that support ALPN (Application Layer Protocol Negotiation) or NPN (Next Protocol Negotiation). NPN is older, was never standardised and is deprecated in favour of ALPN. We believe that ALPN is significantly more widely deployed than NPN. The SSL_select_next_proto function accepts a list of protocols from the server and a list of protocols from the client and returns the first protocol that appears in the server list that also appears in the client list. In the case of no overlap between the two lists it returns the first item in the client list. In either case it will signal whether an overlap between the two lists was found. In the case where SSL_select_next_proto is called with a zero length client list it fails to notice this condition and returns the memory immediately following the client list pointer (and reports that there was no overlap in the lists). This function is typically called from a server side application callback for ALPN or a client side application callback for NPN. In the case of ALPN the list of protocols supplied by the client is guaranteed by libssl to never be zero in length. The list of server protocols comes from the application and should never normally be expected to be of zero length. In this case if the SSL_select_next_proto function has been called as expected (with the list supplied by the client passed in the client/client_len parameters), then the application will not be vulnerable to this issue. If the application has accidentally been configured with a zero length server list, and has accidentally passed that zero length server list in the client/client_len parameters, and has additionally failed to correctly handle a "no overlap" response (which would normally result in a handshake failure in ALPN) then it will be vulnerable to this problem. In the case of NPN, the protocol permits the client to opportunistically select a protocol when there is no overlap. OpenSSL returns the first client protocol in the no overlap case in support of this. The list of client protocols comes from the application and should never normally be expected to be of zero length. However if the SSL_select_next_proto function is accidentally called with a client_len of 0 then an invalid memory pointer will be returned instead. If the application uses this output as the opportunistic protocol then the loss of confidentiality will occur. This issue has been assessed as Low severity because applications are most likely to be vulnerable if they are using NPN instead of ALPN - but NPN is not widely used. It also requires an application configuration or programming error. Finally, this issue would not typically be under attacker control making active exploitation unlikely. The FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue. Due to the low severity of this issue we are not issuing new releases of OpenSSL at this time. The fix will be included in the next releases when they become available.

References

▼	URL	Tags
	https://www.openssl.org/news/secadv/20240627.txt	vendor-advisory
	https://github.com/openssl/openssl/commit/e86ac436f0bd54d4517745483e2315650fae7b2c	patch
	https://github.com/openssl/openssl/commit/99fb785a5f85315b95288921a321a935ea29a51e	patch
	https://github.com/openssl/openssl/commit/4ada436a1946cbb24db5ab4ca082b69c1bc10f37	patch
	https://github.com/openssl/openssl/commit/cf6f91f6121f4db167405db2f0de410a456f260c	patch
	https://github.openssl.org/openssl/extended-releases/commit/b78ec0824da857223486660177d3b1f255c65d87	patch
	https://github.openssl.org/openssl/extended-releases/commit/9947251413065a05189a63c9b7a6c1d4e224c21c	patch
	http://www.openwall.com/lists/oss-security/2024/06/27/1
	http://www.openwall.com/lists/oss-security/2024/06/28/4
	https://security.netapp.com/advisory/ntap-20240712-0005/

Impacted products

	Vendor	Product	Version
	OpenSSL	OpenSSL	Version: 3.3.0 ≤ Version: 3.2.0 ≤ Version: 3.1.0 ≤ Version: 3.0.0 ≤ Version: 1.1.1 < 1.1.1za Version: 1.0.2 < 1.0.2zk

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            affected: [
               {
                  cpes: [
                     "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*",
                  ],
                  defaultStatus: "unknown",
                  product: "openssl",
                  vendor: "openssl",
                  versions: [
                     {
                        lessThan: "3.3.2",
                        status: "affected",
                        version: "3.3.0",
                        versionType: "custom",
                     },
                     {
                        lessThan: "3.2.3",
                        status: "affected",
                        version: "3.2.0",
                        versionType: "custom",
                     },
                     {
                        lessThan: "3.1.7",
                        status: "affected",
                        version: "3.1.0",
                        versionType: "custom",
                     },
                     {
                        lessThan: "3.0.15",
                        status: "affected",
                        version: "3.0.0",
                        versionType: "custom",
                     },
                     {
                        lessThan: "1.1.1za",
                        status: "affected",
                        version: "1.1.1",
                        versionType: "custom",
                     },
                     {
                        lessThan: "1.0.2zk",
                        status: "affected",
                        version: "1.0.2",
                        versionType: "custom",
                     },
                  ],
               },
            ],
            metrics: [
               {
                  cvssV3_1: {
                     attackComplexity: "LOW",
                     attackVector: "NETWORK",
                     availabilityImpact: "HIGH",
                     baseScore: 9.1,
                     baseSeverity: "CRITICAL",
                     confidentialityImpact: "HIGH",
                     integrityImpact: "NONE",
                     privilegesRequired: "NONE",
                     scope: "UNCHANGED",
                     userInteraction: "NONE",
                     vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
                     version: "3.1",
                  },
               },
               {
                  other: {
                     content: {
                        id: "CVE-2024-5535",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "yes",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-11-08T00:00:00+00:00",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-11-14T04:55:17.007Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
         {
            providerMetadata: {
               dateUpdated: "2024-08-15T12:04:53.153Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  name: "OpenSSL Advisory",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://www.openssl.org/news/secadv/20240627.txt",
               },
               {
                  name: "3.3.2 git commit",
                  tags: [
                     "patch",
                     "x_transferred",
                  ],
                  url: "https://github.com/openssl/openssl/commit/e86ac436f0bd54d4517745483e2315650fae7b2c",
               },
               {
                  name: "3.2.3 git commit",
                  tags: [
                     "patch",
                     "x_transferred",
                  ],
                  url: "https://github.com/openssl/openssl/commit/99fb785a5f85315b95288921a321a935ea29a51e",
               },
               {
                  name: "3.1.7 git commit",
                  tags: [
                     "patch",
                     "x_transferred",
                  ],
                  url: "https://github.com/openssl/openssl/commit/4ada436a1946cbb24db5ab4ca082b69c1bc10f37",
               },
               {
                  name: "3.0.15 git commit",
                  tags: [
                     "patch",
                     "x_transferred",
                  ],
                  url: "https://github.com/openssl/openssl/commit/cf6f91f6121f4db167405db2f0de410a456f260c",
               },
               {
                  name: "1.1.1za git commit",
                  tags: [
                     "patch",
                     "x_transferred",
                  ],
                  url: "https://github.openssl.org/openssl/extended-releases/commit/b78ec0824da857223486660177d3b1f255c65d87",
               },
               {
                  name: "1.0.2zk git commit",
                  tags: [
                     "patch",
                     "x_transferred",
                  ],
                  url: "https://github.openssl.org/openssl/extended-releases/commit/9947251413065a05189a63c9b7a6c1d4e224c21c",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "http://www.openwall.com/lists/oss-security/2024/06/27/1",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "http://www.openwall.com/lists/oss-security/2024/06/28/4",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://security.netapp.com/advisory/ntap-20240712-0005/",
               },
               {
                  url: "http://www.openwall.com/lists/oss-security/2024/08/15/1",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               defaultStatus: "unaffected",
               product: "OpenSSL",
               vendor: "OpenSSL",
               versions: [
                  {
                     lessThan: "3.3.2",
                     status: "affected",
                     version: "3.3.0",
                     versionType: "semver",
                  },
                  {
                     lessThan: "3.2.3",
                     status: "affected",
                     version: "3.2.0",
                     versionType: "semver",
                  },
                  {
                     lessThan: "3.1.7",
                     status: "affected",
                     version: "3.1.0",
                     versionType: "semver",
                  },
                  {
                     lessThan: "3.0.15",
                     status: "affected",
                     version: "3.0.0",
                     versionType: "semver",
                  },
                  {
                     lessThan: "1.1.1za",
                     status: "affected",
                     version: "1.1.1",
                     versionType: "custom",
                  },
                  {
                     lessThan: "1.0.2zk",
                     status: "affected",
                     version: "1.0.2",
                     versionType: "custom",
                  },
               ],
            },
         ],
         credits: [
            {
               lang: "en",
               type: "finder",
               value: "Joseph Birr-Pixton",
            },
            {
               lang: "en",
               type: "analyst",
               value: "David Benjamin (Google)",
            },
            {
               lang: "en",
               type: "remediation developer",
               value: "Matt Caswell",
            },
         ],
         datePublic: "2024-06-26T23:00:00.000Z",
         descriptions: [
            {
               lang: "en",
               supportingMedia: [
                  {
                     base64: false,
                     type: "text/html",
                     value: "Issue summary: Calling the OpenSSL API function SSL_select_next_proto with an<br>empty supported client protocols buffer may cause a crash or memory contents to<br>be sent to the peer.<br><br>Impact summary: A buffer overread can have a range of potential consequences<br>such as unexpected application beahviour or a crash. In particular this issue<br>could result in up to 255 bytes of arbitrary private data from memory being sent<br>to the peer leading to a loss of confidentiality. However, only applications<br>that directly call the SSL_select_next_proto function with a 0 length list of<br>supported client protocols are affected by this issue. This would normally never<br>be a valid scenario and is typically not under attacker control but may occur by<br>accident in the case of a configuration or programming error in the calling<br>application.<br><br>The OpenSSL API function SSL_select_next_proto is typically used by TLS<br>applications that support ALPN (Application Layer Protocol Negotiation) or NPN<br>(Next Protocol Negotiation). NPN is older, was never standardised and<br>is deprecated in favour of ALPN. We believe that ALPN is significantly more<br>widely deployed than NPN. The SSL_select_next_proto function accepts a list of<br>protocols from the server and a list of protocols from the client and returns<br>the first protocol that appears in the server list that also appears in the<br>client list. In the case of no overlap between the two lists it returns the<br>first item in the client list. In either case it will signal whether an overlap<br>between the two lists was found. In the case where SSL_select_next_proto is<br>called with a zero length client list it fails to notice this condition and<br>returns the memory immediately following the client list pointer (and reports<br>that there was no overlap in the lists).<br><br>This function is typically called from a server side application callback for<br>ALPN or a client side application callback for NPN. In the case of ALPN the list<br>of protocols supplied by the client is guaranteed by libssl to never be zero in<br>length. The list of server protocols comes from the application and should never<br>normally be expected to be of zero length. In this case if the<br>SSL_select_next_proto function has been called as expected (with the list<br>supplied by the client passed in the client/client_len parameters), then the<br>application will not be vulnerable to this issue. If the application has<br>accidentally been configured with a zero length server list, and has<br>accidentally passed that zero length server list in the client/client_len<br>parameters, and has additionally failed to correctly handle a \"no overlap\"<br>response (which would normally result in a handshake failure in ALPN) then it<br>will be vulnerable to this problem.<br><br>In the case of NPN, the protocol permits the client to opportunistically select<br>a protocol when there is no overlap. OpenSSL returns the first client protocol<br>in the no overlap case in support of this. The list of client protocols comes<br>from the application and should never normally be expected to be of zero length.<br>However if the SSL_select_next_proto function is accidentally called with a<br>client_len of 0 then an invalid memory pointer will be returned instead. If the<br>application uses this output as the opportunistic protocol then the loss of<br>confidentiality will occur.<br><br>This issue has been assessed as Low severity because applications are most<br>likely to be vulnerable if they are using NPN instead of ALPN - but NPN is not<br>widely used. It also requires an application configuration or programming error.<br>Finally, this issue would not typically be under attacker control making active<br>exploitation unlikely.<br><br>The FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue.<br><br>\n\nDue to the low severity of this issue we are not issuing new releases of<br>OpenSSL at this time. The fix will be included in the next releases when they<br>become available.",
                  },
               ],
               value: "Issue summary: Calling the OpenSSL API function SSL_select_next_proto with an\nempty supported client protocols buffer may cause a crash or memory contents to\nbe sent to the peer.\n\nImpact summary: A buffer overread can have a range of potential consequences\nsuch as unexpected application beahviour or a crash. In particular this issue\ncould result in up to 255 bytes of arbitrary private data from memory being sent\nto the peer leading to a loss of confidentiality. However, only applications\nthat directly call the SSL_select_next_proto function with a 0 length list of\nsupported client protocols are affected by this issue. This would normally never\nbe a valid scenario and is typically not under attacker control but may occur by\naccident in the case of a configuration or programming error in the calling\napplication.\n\nThe OpenSSL API function SSL_select_next_proto is typically used by TLS\napplications that support ALPN (Application Layer Protocol Negotiation) or NPN\n(Next Protocol Negotiation). NPN is older, was never standardised and\nis deprecated in favour of ALPN. We believe that ALPN is significantly more\nwidely deployed than NPN. The SSL_select_next_proto function accepts a list of\nprotocols from the server and a list of protocols from the client and returns\nthe first protocol that appears in the server list that also appears in the\nclient list. In the case of no overlap between the two lists it returns the\nfirst item in the client list. In either case it will signal whether an overlap\nbetween the two lists was found. In the case where SSL_select_next_proto is\ncalled with a zero length client list it fails to notice this condition and\nreturns the memory immediately following the client list pointer (and reports\nthat there was no overlap in the lists).\n\nThis function is typically called from a server side application callback for\nALPN or a client side application callback for NPN. In the case of ALPN the list\nof protocols supplied by the client is guaranteed by libssl to never be zero in\nlength. The list of server protocols comes from the application and should never\nnormally be expected to be of zero length. In this case if the\nSSL_select_next_proto function has been called as expected (with the list\nsupplied by the client passed in the client/client_len parameters), then the\napplication will not be vulnerable to this issue. If the application has\naccidentally been configured with a zero length server list, and has\naccidentally passed that zero length server list in the client/client_len\nparameters, and has additionally failed to correctly handle a \"no overlap\"\nresponse (which would normally result in a handshake failure in ALPN) then it\nwill be vulnerable to this problem.\n\nIn the case of NPN, the protocol permits the client to opportunistically select\na protocol when there is no overlap. OpenSSL returns the first client protocol\nin the no overlap case in support of this. The list of client protocols comes\nfrom the application and should never normally be expected to be of zero length.\nHowever if the SSL_select_next_proto function is accidentally called with a\nclient_len of 0 then an invalid memory pointer will be returned instead. If the\napplication uses this output as the opportunistic protocol then the loss of\nconfidentiality will occur.\n\nThis issue has been assessed as Low severity because applications are most\nlikely to be vulnerable if they are using NPN instead of ALPN - but NPN is not\nwidely used. It also requires an application configuration or programming error.\nFinally, this issue would not typically be under attacker control making active\nexploitation unlikely.\n\nThe FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue.\n\nDue to the low severity of this issue we are not issuing new releases of\nOpenSSL at this time. The fix will be included in the next releases when they\nbecome available.",
            },
         ],
         metrics: [
            {
               format: "other",
               other: {
                  content: {
                     text: "Low",
                  },
                  type: "https://www.openssl.org/policies/secpolicy.html",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-200",
                     description: "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2024-07-12T14:06:04.752Z",
            orgId: "3a12439a-ef3a-4c79-92e6-6081a721f1e5",
            shortName: "openssl",
         },
         references: [
            {
               name: "OpenSSL Advisory",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://www.openssl.org/news/secadv/20240627.txt",
            },
            {
               name: "3.3.2 git commit",
               tags: [
                  "patch",
               ],
               url: "https://github.com/openssl/openssl/commit/e86ac436f0bd54d4517745483e2315650fae7b2c",
            },
            {
               name: "3.2.3 git commit",
               tags: [
                  "patch",
               ],
               url: "https://github.com/openssl/openssl/commit/99fb785a5f85315b95288921a321a935ea29a51e",
            },
            {
               name: "3.1.7 git commit",
               tags: [
                  "patch",
               ],
               url: "https://github.com/openssl/openssl/commit/4ada436a1946cbb24db5ab4ca082b69c1bc10f37",
            },
            {
               name: "3.0.15 git commit",
               tags: [
                  "patch",
               ],
               url: "https://github.com/openssl/openssl/commit/cf6f91f6121f4db167405db2f0de410a456f260c",
            },
            {
               name: "1.1.1za git commit",
               tags: [
                  "patch",
               ],
               url: "https://github.openssl.org/openssl/extended-releases/commit/b78ec0824da857223486660177d3b1f255c65d87",
            },
            {
               name: "1.0.2zk git commit",
               tags: [
                  "patch",
               ],
               url: "https://github.openssl.org/openssl/extended-releases/commit/9947251413065a05189a63c9b7a6c1d4e224c21c",
            },
            {
               url: "http://www.openwall.com/lists/oss-security/2024/06/27/1",
            },
            {
               url: "http://www.openwall.com/lists/oss-security/2024/06/28/4",
            },
            {
               url: "https://security.netapp.com/advisory/ntap-20240712-0005/",
            },
         ],
         source: {
            discovery: "UNKNOWN",
         },
         title: "SSL_select_next_proto buffer overread",
         x_generator: {
            engine: "Vulnogram 0.2.0",
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "3a12439a-ef3a-4c79-92e6-6081a721f1e5",
      assignerShortName: "openssl",
      cveId: "CVE-2024-5535",
      datePublished: "2024-06-27T10:30:53.118Z",
      dateReserved: "2024-05-30T15:34:36.813Z",
      dateUpdated: "2025-02-13T17:54:20.802Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2024-4741

Vulnerability from cvelistv5

Published

2024-11-13 10:20

Modified

2024-11-13 14:49

Severity ?

Summary

Issue summary: Calling the OpenSSL API function SSL_free_buffers may cause memory to be accessed that was previously freed in some situations Impact summary: A use after free can have a range of potential consequences such as the corruption of valid data, crashes or execution of arbitrary code. However, only applications that directly call the SSL_free_buffers function are affected by this issue. Applications that do not call this function are not vulnerable. Our investigations indicate that this function is rarely used by applications. The SSL_free_buffers function is used to free the internal OpenSSL buffer used when processing an incoming record from the network. The call is only expected to succeed if the buffer is not currently in use. However, two scenarios have been identified where the buffer is freed even when still in use. The first scenario occurs where a record header has been received from the network and processed by OpenSSL, but the full record body has not yet arrived. In this case calling SSL_free_buffers will succeed even though a record has only been partially processed and the buffer is still in use. The second scenario occurs where a full record containing application data has been received and processed by OpenSSL but the application has only read part of this data. Again a call to SSL_free_buffers will succeed even though the buffer is still in use. While these scenarios could occur accidentally during normal operation a malicious attacker could attempt to engineer a stituation where this occurs. We are not aware of this issue being actively exploited. The FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue.

References

▼	URL	Tags
	https://www.openssl.org/news/secadv/20240528.txt	vendor-advisory
	https://github.com/openssl/openssl/commit/e5093133c35ca82874ad83697af76f4b0f7e3bd8	patch
	https://github.com/openssl/openssl/commit/c88c3de51020c37e8706bf7a682a162593053aac	patch
	https://github.com/openssl/openssl/commit/704f725b96aa373ee45ecfb23f6abfe8be8d9177	patch
	https://github.com/openssl/openssl/commit/b3f0eb0a295f58f16ba43ba99dad70d4ee5c437d	patch
	https://github.openssl.org/openssl/extended-releases/commit/f7a045f3143fc6da2ee66bf52d8df04829590dd4	patch

Impacted products

	Vendor	Product	Version
	OpenSSL	OpenSSL	Version: 3.3.0 ≤ Version: 3.2.0 ≤ Version: 3.1.0 ≤ Version: 3.0.0 ≤ Version: 1.1.1 < 1.1.1y

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            affected: [
               {
                  cpes: [
                     "cpe:2.3:a:openssl:openssl:-:*:*:*:*:*:*:*",
                  ],
                  defaultStatus: "unknown",
                  product: "openssl",
                  vendor: "openssl",
                  versions: [
                     {
                        lessThan: "1.1.1y",
                        status: "affected",
                        version: "1.1.1",
                        versionType: "semver",
                     },
                     {
                        lessThan: "3.0.14",
                        status: "affected",
                        version: "3.0.0",
                        versionType: "semver",
                     },
                     {
                        lessThan: "3.1.6",
                        status: "affected",
                        version: "3.1.0",
                        versionType: "semver",
                     },
                     {
                        lessThan: "3.2.2",
                        status: "affected",
                        version: "3.2.0",
                        versionType: "semver",
                     },
                     {
                        lessThan: "3.3.1",
                        status: "affected",
                        version: "3.3.0",
                        versionType: "semver",
                     },
                  ],
               },
            ],
            metrics: [
               {
                  cvssV3_1: {
                     attackComplexity: "LOW",
                     attackVector: "NETWORK",
                     availabilityImpact: "HIGH",
                     baseScore: 7.5,
                     baseSeverity: "HIGH",
                     confidentialityImpact: "NONE",
                     integrityImpact: "NONE",
                     privilegesRequired: "NONE",
                     scope: "UNCHANGED",
                     userInteraction: "NONE",
                     vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                     version: "3.1",
                  },
               },
               {
                  other: {
                     content: {
                        id: "CVE-2024-4741",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "yes",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-11-13T14:45:07.092438Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-11-13T14:49:05.977Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               defaultStatus: "unaffected",
               product: "OpenSSL",
               vendor: "OpenSSL",
               versions: [
                  {
                     lessThan: "3.3.1",
                     status: "affected",
                     version: "3.3.0",
                     versionType: "semver",
                  },
                  {
                     lessThan: "3.2.2",
                     status: "affected",
                     version: "3.2.0",
                     versionType: "semver",
                  },
                  {
                     lessThan: "3.1.6",
                     status: "affected",
                     version: "3.1.0",
                     versionType: "semver",
                  },
                  {
                     lessThan: "3.0.14",
                     status: "affected",
                     version: "3.0.0",
                     versionType: "semver",
                  },
                  {
                     lessThan: "1.1.1y",
                     status: "affected",
                     version: "1.1.1",
                     versionType: "custom",
                  },
               ],
            },
         ],
         credits: [
            {
               lang: "en",
               type: "finder",
               value: "William Ahern (Akamai)",
            },
            {
               lang: "en",
               type: "remediation developer",
               value: "Matt Caswell",
            },
            {
               lang: "en",
               type: "remediation developer",
               value: "Watson Ladd (Akamai)",
            },
         ],
         datePublic: "2024-05-27T23:00:00.000Z",
         descriptions: [
            {
               lang: "en",
               supportingMedia: [
                  {
                     base64: false,
                     type: "text/html",
                     value: "Issue summary: Calling the OpenSSL API function SSL_free_buffers may cause<br>memory to be accessed that was previously freed in some situations<br><br>Impact summary: A use after free can have a range of potential consequences such<br>as the corruption of valid data, crashes or execution of arbitrary code.<br>However, only applications that directly call the SSL_free_buffers function are<br>affected by this issue. Applications that do not call this function are not<br>vulnerable. Our investigations indicate that this function is rarely used by<br>applications.<br><br>The SSL_free_buffers function is used to free the internal OpenSSL buffer used<br>when processing an incoming record from the network. The call is only expected<br>to succeed if the buffer is not currently in use. However, two scenarios have<br>been identified where the buffer is freed even when still in use.<br><br>The first scenario occurs where a record header has been received from the<br>network and processed by OpenSSL, but the full record body has not yet arrived.<br>In this case calling SSL_free_buffers will succeed even though a record has only<br>been partially processed and the buffer is still in use.<br><br>The second scenario occurs where a full record containing application data has<br>been received and processed by OpenSSL but the application has only read part of<br>this data. Again a call to SSL_free_buffers will succeed even though the buffer<br>is still in use.<br><br>While these scenarios could occur accidentally during normal operation a<br>malicious attacker could attempt to engineer a stituation where this occurs.<br>We are not aware of this issue being actively exploited.<br><br>The FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue.",
                  },
               ],
               value: "Issue summary: Calling the OpenSSL API function SSL_free_buffers may cause\nmemory to be accessed that was previously freed in some situations\n\nImpact summary: A use after free can have a range of potential consequences such\nas the corruption of valid data, crashes or execution of arbitrary code.\nHowever, only applications that directly call the SSL_free_buffers function are\naffected by this issue. Applications that do not call this function are not\nvulnerable. Our investigations indicate that this function is rarely used by\napplications.\n\nThe SSL_free_buffers function is used to free the internal OpenSSL buffer used\nwhen processing an incoming record from the network. The call is only expected\nto succeed if the buffer is not currently in use. However, two scenarios have\nbeen identified where the buffer is freed even when still in use.\n\nThe first scenario occurs where a record header has been received from the\nnetwork and processed by OpenSSL, but the full record body has not yet arrived.\nIn this case calling SSL_free_buffers will succeed even though a record has only\nbeen partially processed and the buffer is still in use.\n\nThe second scenario occurs where a full record containing application data has\nbeen received and processed by OpenSSL but the application has only read part of\nthis data. Again a call to SSL_free_buffers will succeed even though the buffer\nis still in use.\n\nWhile these scenarios could occur accidentally during normal operation a\nmalicious attacker could attempt to engineer a stituation where this occurs.\nWe are not aware of this issue being actively exploited.\n\nThe FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue.",
            },
         ],
         metrics: [
            {
               format: "other",
               other: {
                  content: {
                     text: "Low",
                  },
                  type: "https://www.openssl.org/policies/secpolicy.html",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-416",
                     description: "CWE-416 Use After Free",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2024-11-13T10:20:50.711Z",
            orgId: "3a12439a-ef3a-4c79-92e6-6081a721f1e5",
            shortName: "openssl",
         },
         references: [
            {
               name: "OpenSSL Advisory",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://www.openssl.org/news/secadv/20240528.txt",
            },
            {
               name: "3.3.1 git commit",
               tags: [
                  "patch",
               ],
               url: "https://github.com/openssl/openssl/commit/e5093133c35ca82874ad83697af76f4b0f7e3bd8",
            },
            {
               name: "3.2.2 git commit",
               tags: [
                  "patch",
               ],
               url: "https://github.com/openssl/openssl/commit/c88c3de51020c37e8706bf7a682a162593053aac",
            },
            {
               name: "3.1.6 git commit",
               tags: [
                  "patch",
               ],
               url: "https://github.com/openssl/openssl/commit/704f725b96aa373ee45ecfb23f6abfe8be8d9177",
            },
            {
               name: "3.0.14 git commit",
               tags: [
                  "patch",
               ],
               url: "https://github.com/openssl/openssl/commit/b3f0eb0a295f58f16ba43ba99dad70d4ee5c437d",
            },
            {
               name: "1.1.1y git commit",
               tags: [
                  "patch",
               ],
               url: "https://github.openssl.org/openssl/extended-releases/commit/f7a045f3143fc6da2ee66bf52d8df04829590dd4",
            },
         ],
         source: {
            discovery: "UNKNOWN",
         },
         title: "Use After Free with SSL_free_buffers",
         x_generator: {
            engine: "Vulnogram 0.2.0",
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "3a12439a-ef3a-4c79-92e6-6081a721f1e5",
      assignerShortName: "openssl",
      cveId: "CVE-2024-4741",
      datePublished: "2024-11-13T10:20:50.711Z",
      dateReserved: "2024-05-10T09:56:11.310Z",
      dateUpdated: "2024-11-13T14:49:05.977Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

Vulnerability from csaf_opensuse

cve-2024-5535

Vulnerability from cvelistv5

cve-2024-4741

Vulnerability from cvelistv5

Tags

Sightings

Nomenclature