Red Hat OpenSSL vulnerabilities

10 CVEs affecting Red Hat OpenSSL, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2024-2467, published 2024-04-25.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2009-1386, published 2009-06-04. Medium severity, CVSS 5.0. EPSS: 80.1% chance of exploitation in the next 30 days. ssl/s3_pkt.c in OpenSSL before 0.9.8i allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a DTLS ChangeCipherSpec packet that occurs before…
CVE-2012-2110, published 2012-04-19. High severity, CVSS 7.5. EPSS: 47.9% chance of exploitation in the next 30 days. The asn1_d2i_read_bio function in crypto/asn1/a_d2i_fp.c in OpenSSL before 0.9.8v, 1.0.0 before 1.0.0i, and 1.0.1 before 1.0.1a does not properly interpret integer data, which allows remote attackers…
CVE-2012-2333, published 2012-05-14. Medium severity, CVSS 6.8. EPSS: 27.9% chance of exploitation in the next 30 days. Integer underflow in OpenSSL before 0.9.8x, 1.0.0 before 1.0.0j, and 1.0.1 before 1.0.1c, when TLS 1.1, TLS 1.2, or DTLS is used with CBC encryption, allows remote attackers to cause a denial of…
CVE-2013-0166, published 2013-02-08. Medium severity, CVSS 5.0. EPSS: 19.7% chance of exploitation in the next 30 days. OpenSSL before 0.9.8y, 1.0.0 before 1.0.0k, and 1.0.1 before 1.0.1d does not properly perform signature verification for OCSP responses, which allows remote OCSP servers to cause a denial of service…
CVE-2004-0112, published 2004-11-23. Medium severity, CVSS 5.0. EPSS: 10.4% chance of exploitation in the next 30 days. The SSL/TLS handshaking code in OpenSSL 0.9.7a, 0.9.7b, and 0.9.7c, when using Kerberos ciphersuites, does not properly check the length of Kerberos tickets during a handshake, which allows remote…
CVE-2009-1387, published 2009-06-04. Medium severity, CVSS 5.0. EPSS: 10.3% chance of exploitation in the next 30 days. The dtls1_retrieve_buffered_fragment function in ssl/d1_both.c in OpenSSL before 1.0.0 Beta 2 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via an…
CVE-2004-0079, published 2004-11-23. High severity, CVSS 7.5. EPSS: 9.5% chance of exploitation in the next 30 days. The do_change_cipher_spec function in OpenSSL 0.9.6c to 0.9.6k, and 0.9.7a to 0.9.7c, allows remote attackers to cause a denial of service (crash) via a crafted SSL/TLS handshake that triggers a null…
CVE-2009-4355, published 2010-01-14. Medium severity, CVSS 5.0. EPSS: 9.2% chance of exploitation in the next 30 days. Memory leak in the zlib_stateful_finish function in crypto/comp/c_zlib.c in OpenSSL 0.9.8l and earlier and 1.0.0 Beta through Beta 4 allows remote attackers to cause a denial of service (memory…
CVE-2004-0081, published 2004-11-23. Medium severity, CVSS 5.0. EPSS: 7.2% chance of exploitation in the next 30 days. OpenSSL 0.9.6 before 0.9.6d does not properly handle unknown message types, which allows remote attackers to cause a denial of service (infinite loop), as demonstrated using the Codenomicon TLS Test…
CVE-2024-2467, published 2024-04-25. Medium severity, CVSS 5.9. EPSS: 0.5% chance of exploitation in the next 30 days. A timing-based side-channel flaw exists in the perl-Crypt-OpenSSL-RSA package, which could be sufficient to recover plaintext across a network in a Bleichenbacher-style attack. To achieve successful…