CVE-2011-4354: OpenSSL

Medium severity, CVSS 5.8. EPSS: 3% chance of exploitation in the next 30 days.

crypto/bn/bn_nist.c in OpenSSL before 0.9.8h on 32-bit platforms, as used in stunnel and other products, in certain circumstances involving ECDH or ECDHE cipher suites, uses an incorrect modular reduction algorithm in its implementation of the P-256 and P-384 NIST elliptic curves, which allows remote attackers to obtain the private key of a TLS server via multiple handshake attempts.

Affected products

• OpenSSL OpenSSL: up to and including 0.9.8g; version 0.9.1c only; version 0.9.2b only; version 0.9.3 only; version 0.9.3a only; version 0.9.4 only; …

Published 2012-01-27. Last modified 2026-06-16.