CVE-2010-1633: OpenSSL

Medium severity, CVSS 6.4. EPSS: 2.4% chance of exploitation in the next 30 days.

RSA verification recovery in the EVP_PKEY_verify_recover function in OpenSSL 1.x before 1.0.0a, as used by pkeyutl and possibly other applications, returns uninitialized memory upon failure, which might allow context-dependent attackers to bypass intended key requirements or obtain sensitive information via unspecified vectors. NOTE: some of these details are obtained from third party information.

Affected products

• OpenSSL OpenSSL: version 1.0.0 only

Published 2010-06-03. Last modified 2026-06-16.