VIRY.CZRADAR
sektor
téma
typ textu
zrušit filtry

CVE-2026-34182: ZDI-26-790: OpenSSL CMS AuthEnvelopedData Improper Validation of Integrity Check Value Vulnerability

2 karet z 3 položek · v celém archivu · celý přehled CZ · EN/orig

CVE-2026-34182

EPSS 0.01 EPSS k 26. 10. 2026

Hodnocení závažnosti

9.1 CVSS 3.1 CISA-ADP

útok odkudkoli z internetu bez přípravy bez přihlášení bez zásahu uživatele
dopad plný únik dat úplná změna dat bez výpadku
přesah dopad jen na zranitelnou součást

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

zvyšuje závažnost mírně zvyšuje závažnost snižuje závažnost

cve.org · NVD

· zachyceno

SPOJENO PŘES CVE ZDI-26-790: OpenSSL CMS AuthEnvelopedData Improper Validation of Integrity Check Value Vulnerability

This vulnerability allows network-adjacent attackers to tamper with CMS AuthEnvelopedData messages on affected installations of OpenSSL. An attacker must first obtain the ability to modify CMS AuthEnvelopedData messages in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 3.1. The following CVEs are assigned: CVE-2026-34182.

EPSS 0.01 CVSS 3.1 CVE-2026-34182 OpenSSL US

tg: zranitelnost

· zachyceno · Zero Day Initiative · ZDI-26-790: OpenSSL CMS AuthEnvelopedData Improper Validation of Integrity Check Value Vulnerability · Microsoft Security · CVE-2026-34182 CMS AuthEnvelopedData Processing May Accept Forged Messages

CVE-2026-57062 CMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS format for AES-GCM because aes-ICVlen is supposed to be 12 bytes but 4 bytes is accepted. NOTE: this is related to CVE-2026-34182.

Information published.

EPSS 0.01 CVE-2026-34182 CVE-2026-57062 GnuPG US

· Microsoft Security · CVE-2026-57062 CMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS format for AES-GCM because aes-ICVlen is supposed to be 12 bytes but 4 bytes is accepted. NOTE: this is related to CVE-2026-34182.