Ecosyste.ms: Advisories
An open API service providing security vulnerability metadata for many open source software ecosystems.
Security Advisories: GSA_kwCzR0hTQS03MzVmLXBnNzYtZnhjNM4AAtFu
openssl-src heap memory corruption with RSA private key operation
The OpenSSL 3.0.4 release introduced a serious bug in the RSA implementation for X86_64 CPUs supporting the AVX512IFMA instructions. This issue makes the RSA implementation with 2048 bit private keys incorrect on such machines and memory corruption will happen during the computation. As a consequence of the memory corruption an attacker may be able to trigger a remote code execution on the machine performing the computation. SSL/TLS servers or other servers using 2048 bit RSA private keys running on machines supporting AVX512IFMA instructions of the X86_64 architecture are affected by this issue.
Permalink: https://github.com/advisories/GHSA-735f-pg76-fxc4JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS03MzVmLXBnNzYtZnhjNM4AAtFu
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Critical
Classification: General
Published: almost 2 years ago
Updated: 10 months ago
CVSS Score: 9.8
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Identifiers: GHSA-735f-pg76-fxc4, CVE-2022-2274
References:
- https://nvd.nist.gov/vuln/detail/CVE-2022-2274
- https://github.com/openssl/openssl/issues/18625
- https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=4d8a88c134df634ba610ff8db1eb8478ac5fd345
- https://rustsec.org/advisories/RUSTSEC-2022-0033.html
- https://www.openssl.org/news/secadv/20220705.txt
- https://security.netapp.com/advisory/ntap-20220715-0010/
- https://github.com/advisories/GHSA-735f-pg76-fxc4
Blast Radius: 34.9
Affected Packages
cargo:openssl-src
Dependent packages: 9Dependent repositories: 3,600
Downloads: 18,993,906 total
Affected Version Ranges: >= 300.0.8, < 300.0.9
Fixed in: 300.0.9
All affected versions: 300.0.8
All unaffected versions: 110.0.0, 110.0.0, 110.0.1, 110.0.2, 110.0.3, 110.0.4, 110.0.5, 110.0.6, 110.0.7, 111.0.0, 111.0.1, 111.1.0, 111.1.1, 111.2.1, 111.3.0, 111.4.0, 111.5.0, 111.6.0, 111.6.1, 111.7.0, 111.8.0, 111.8.1, 111.9.0, 111.10.0, 111.10.1, 111.10.2, 111.11.0, 111.12.0, 111.13.0, 111.14.0, 111.15.0, 111.16.0, 111.17.0, 111.18.0, 111.19.0, 111.20.0, 111.21.0, 111.22.0, 111.23.0, 111.24.0, 111.25.0, 111.25.1, 111.25.2, 111.25.3, 111.26.0, 111.27.0, 111.28.0, 111.28.1, 300.0.0, 300.0.1, 300.0.2, 300.0.3, 300.0.4, 300.0.5, 300.0.6, 300.0.7, 300.0.9, 300.0.10, 300.0.11, 300.0.12, 300.0.13, 300.1.0, 300.1.1, 300.1.2, 300.1.3, 300.1.4, 300.1.5, 300.1.6, 300.2.0, 300.2.1, 300.2.2, 300.2.3