The dsa_sign_setup function in crypto/dsa/dsa_ossl.c in OpenSSL through 1.0.2h does not properly ensure the use of constant-time operations, which makes it easier for local users…

Unauthenticated and Undersized DTLS 1.2 AEAD Record Causes DoS

NULL Pointer Dereference in CMP Client Revocation Response Handling

QUIC Connection-Level Flow Control is Not Enforced for Streams

Potential CPU DoS via O(n^2) Fragment Reassembly in QUIC

Excessive Memory Allocation in Relative CRLDP Processing

Trust-Anchor Substitution via cert/issuer Typo in CMP rootCaKeyUpdate

ASN1_TYPE Type Confusion in the PKCS7_digest_from_attributes() function

Excessive time spent in DH check / generation with large Q parameter value

Excessive time spent checking DH q parameter value

Excessive time spent checking DH keys and parameters

Issue summary: The AES-SIV cipher implementation contains a bug that causes it to ignore empty associated data entries which are unauthenticated as a consequence

Certificate policy check not enabled

Invalid certificate policies in leaf certificates are silently ignored

AES OCB fails to encrypt some bytes

OCSP_basic_verify may incorrectly verify the response signing certificate

rsaz_512_sqr overflow bug on x86_64

OpenSSL 1.1.1 introduced a rewritten random number generator (RNG)

While parsing an IPAddressFamily extension in an X.509 certificate, it is possible to do a one-byte overread

The ASN1_TFLG_COMBINE implementation in crypto/asn1/tasn_dec.c in OpenSSL before 0.9.8zh, 1.0.0 before 1.0.0t, 1.0.1 before 1.0.1q, and 1.0.2 before 1.0.2e mishandles errors…

The MOD_EXP_CTIME_COPY_FROM_PREBUF function in crypto/bn/bn_exp.c in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g does not properly consider cache-bank access times during…

Double-free When Checking OCSP Stapled Response

A read buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking

Incorrect Tag Processing for Empty Messages in AES-GCM-SIV and AES-SIV modes

Heap out-of-bounds write in BIO_f_linebuffer on short writes

Normally in OpenSSL EC groups always have a co-factor present and this is used in side channel resistant code paths

Simultaneous Multi-threading (SMT) in processors can enable local users to exploit software vulnerable to timing attacks via a side-channel timing attack on 'port contention'

Low-level invalid GF(2^m) parameters lead to OOB memory access

Unauthenticated/unencrypted trailing bytes with low-level OCB function calls

Timing Side-Channel in SM2 Signature Generation

Non-Constant-Time SM2 Scalar Multiplication on ARM64 and RISC-V

Timing Side-Channel in Scalar Multiplication for Non-NIST EC Curves

QUIC Unvalidated Amplification Credit may be Over Accounted

FFC-DH Peer Validation Uses Attacker-Supplied q

Multi-RecipientInfo Bleichenbacher Oracle in CMS_decrypt() and PKCS7_decrypt()

OpenSSL 1.0.2 supports SSLv2

The Raccoon attack exploits a flaw in the TLS specification which can lead to an attacker being able to compute the pre-master secret in connections which have used a…

Padding Oracle in PKCS7_dataDecode and CMS_decrypt_set1_pkey

The DH_check_pub_key function in crypto/dh/dh_check.c in OpenSSL 1.0.2 before 1.0.2f does not ensure that prime numbers are appropriate for Diffie-Hellman (DH) key exchange, which…

The TLS protocol 1.2 and earlier, when a DHE_EXPORT ciphersuite is enabled on a server but not on a client, does not properly convey a DHE_EXPORT choice, which allows…

The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which makes it easier for man-in-the-middle attackers to obtain…

OpenSSL has internal defaults for a directory tree where it can find a configuration file as well as certificates used for verification in TLS

ssl/s3_clnt.c in OpenSSL 1.0.0 before 1.0.0t, 1.0.1 before 1.0.1p, and 1.0.2 before 1.0.2d, when used for a multi-threaded client, writes the PSK identity hint to an incorrect…

The ssl3_get_key_exchange function in ssl/s3_clnt.c in OpenSSL 1.0.2 before 1.0.2e allows remote servers to cause a denial of service (segmentation fault) via a zero p value in an…

Race condition in a certain Red Hat patch to the PRNG lock implementation in the ssleay_rand_bytes function in OpenSSL, as distributed in openssl-1.0.1e-25.el7 in Red Hat…

The do_free_upto function in crypto/cms/cms_smime.c in OpenSSL before 0.9.8zg, 1.0.0 before 1.0.0s, 1.0.1 before 1.0.1n, and 1.0.2 before 1.0.2b allows remote attackers to cause a…

Race condition in the ssl3_get_new_session_ticket function in ssl/s3_clnt.c in OpenSSL before 0.9.8zg, 1.0.0 before 1.0.0s, 1.0.1 before 1.0.1n, and 1.0.2 before 1.0.2b, when used…

The PKCS7_dataDecodefunction in crypto/pkcs7/pk7_doit.c in OpenSSL before 0.9.8zg, 1.0.0 before 1.0.0s, 1.0.1 before 1.0.1n, and 1.0.2 before 1.0.2b allows remote attackers to…

The BN_GF2m_mod_inv function in crypto/bn/bn_gf2m.c in OpenSSL before 0.9.8s, 1.0.0 before 1.0.0e, 1.0.1 before 1.0.1n, and 1.0.2 before 1.0.2b does not properly handle…

The dtls1_clear_queues function in ssl/d1_lib.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h frees data structures without considering that application…