VIRY.CZRADAR
sektor
téma
typ textu
zrušit filtry

Výsledky hledání

výrobce: OpenSSL× v celém archivu zrušit filtry

17 karet z 18 položek CZ · EN/orig

· zachyceno

ZDI-26-789: OpenSSL CMP Use of Externally-Controlled Format String Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of OpenSSL. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 6.5. The following CVEs are assigned: CVE-2026-63073.

EPSS 0.01 CVSS 6.5 CVE-2026-63073 OpenSSL US

tg: zranitelnost

· zachyceno · Zero Day Initiative · ZDI-26-789: OpenSSL CMP Use of Externally-Controlled Format String Information Disclosure Vulnerability

· zachyceno

SPOJENO PŘES CVE ZDI-26-790: OpenSSL CMS AuthEnvelopedData Improper Validation of Integrity Check Value Vulnerability

This vulnerability allows network-adjacent attackers to tamper with CMS AuthEnvelopedData messages on affected installations of OpenSSL. An attacker must first obtain the ability to modify CMS AuthEnvelopedData messages in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 3.1. The following CVEs are assigned: CVE-2026-34182.

EPSS 0.01 CVSS 3.1 CVE-2026-34182 OpenSSL US

tg: zranitelnost

· zachyceno · Zero Day Initiative · ZDI-26-790: OpenSSL CMS AuthEnvelopedData Improper Validation of Integrity Check Value Vulnerability · Microsoft Security · CVE-2026-34182 CMS AuthEnvelopedData Processing May Accept Forged Messages

SPOJENO PŘES CVE Multiple OpenSSL vulnerabilities affect Festo AX OS in CEPE

[FSA-202602] Festo AX OS versions 25.0.1.46 and 25.9.2.4, which are based on PLCnext by Phoenix Contact, used by the Festo product CEPE are affected by multiple OpenSSL vulnerabilities. The vulnerabilities are identified as CVE-2025-15467 and CVE-2025-69419. Attacks may be possible when maliciously crafted firmware, key files, PKCS#12 files, CMS/PKCS#7 content, or digitally signed objects are uploaded and processed by the affected system. In the device context, exploitation typically requires a…

EPSS 0.75 CVE-2025-15467 CVE-2025-69419 Festo Phoenix Contact OpenSSL výroba a průmysl DE

tg: zranitelnost tp: průmyslové systémy

· CERT@VDE · Multiple OpenSSL vulnerabilities affect Festo AX OS in CEPE

OpenSSL security advisory (AV26-980)

Serial number: AV26-980 Date: October 1, 2026 As of September 29, 2026, OpenSSL is affected by vulnerabilities in the following product: OpenSSL Prior to 1.0.2zs Prior to 1.1.1zj Prior to 3.0.23 Prior to 3.4.8 Prior to 3.5.9 Prior to 3.6.5 Prior to 4.0.3 The Cyber Centre encourages users and administrators to review the provided web link and apply any necessary updates as they become available. Vulnerabilities | OpenSSL Library

OpenSSL CA

tg: zranitelnost

· Cyber Centre Kanada · OpenSSL security advisory (AV26-980)

Risolte vulnerabilità in OpenSSL

Rilasciati aggiornamenti di sicurezza che sanano 14 vulnerabilità, di cui 4 con gravità "alta", in OpenSSL, software open source per la gestione delle comunicazioni crittografiche. Tali vulnerabilità, qualora sfruttata, potrebbero consentire ad un utente malintenzionato di compromettere la disponibilità del servizio o di accedere ad informazioni sensibili sui sistemi interessati.

EPSS 0.01 CVE-2026-72897 CVE-2026-84782 CVE-2026-84783 CVE-2026-84784 OpenSSL IT

tg: zranitelnost

· CSIRT Itálie (ACN) · Risolte vulnerabilità in OpenSSL

· zachyceno

Multiples vulnérabilités dans OpenSSL (30 septembre 2026)

De multiples vulnérabilités ont été découvertes dans OpenSSL. Certaines d'entre elles permettent à un attaquant de provoquer un déni de service à distance, une atteinte à la confidentialité des données et une atteinte à l'intégrité des données.

EPSS 0.01 CVE-2026-35189 CVE-2026-35191 CVE-2026-42772 CVE-2026-54872 CVE-2026-54873 CVE-2026-54875 CVE-2026-72897 CVE-2026-75804 CVE-2026-75805 CVE-2026-75806 CVE-2026-77696 CVE-2026-84782 CVE-2026-84783 CVE-2026-84784 OpenSSL FR

tg: zranitelnost tp: DDoS

· zachyceno · CERT-FR – avis · Multiples vulnérabilités dans OpenSSL (30 septembre 2026)

· zachyceno

SPOJENO PŘES CVE K000162604: NGINX ngx_http_v3_module vulnerability CVE-2026-90439

Classification: Important, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: 6.5, CVEs: CVE-2026-90439, Summary: NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_v3_module module. When using HTTP/3 with OpenSSL versions 3.5.0 and earlier under certain configurations, a limited heap buffer overflow could happen while processing a Transport Layer Security (TLS) handshake. This can happen in a non-deterministic manner that is beyond the attacker's control. This…

EPSS 0.00 CVSS 6.5 CVE-2026-90439 NGINX OpenSSL F5 FI FR

tg: zranitelnost

· zachyceno · NCSC-FI · K000162604: NGINX ngx_http_v3_module vulnerability CVE-2026-90439 · zachyceno · CERT-FR – avis · Vulnérabilité dans F5 NGINX (16 septembre 2026)

· zachyceno

Multiple Vulnerabilities in OpenSSL

Classification: Severe, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: 7.8, CVEs: CVE-2026-63076, CVE-2026-63075, CVE-2026-63074, CVE-2026-63072, CVE-2026-54874, CVE-2026-18798, CVE-2026-14457, CVE-2026-75803, Summary: CVE-2026-63076 7.5 Invalid Pointer Dereference in CMP Server via Crafted protectionAlg CVE-2026-63075 7.5 QUIC ACK-only Packet Retention Can Cause Memory Exhaustion CVE-2026-63074 5.9 CMP Indefinite Cache Growth of ExtraCerts CVE-2026-63072 7.5 Heap Buffer…

EPSS 0.02 CVSS 7.8 CVE-2026-14457 CVE-2026-18798 CVE-2026-54874 CVE-2026-63072 CVE-2026-63074 CVE-2026-63075 CVE-2026-63076 CVE-2026-75803 OpenSSL FI

· zachyceno · NCSC-FI · Multiple Vulnerabilities in OpenSSL

· zachyceno

Multiples vulnérabilités dans OpenSSL (26 août 2026)

De multiples vulnérabilités ont été découvertes dans OpenSSL. Elles permettent à un attaquant de provoquer un déni de service à distance et un contournement de la politique de sécurité.

EPSS 0.02 CVE-2026-14457 CVE-2026-18798 CVE-2026-54874 CVE-2026-63072 CVE-2026-63073 CVE-2026-63074 CVE-2026-63075 CVE-2026-63076 CVE-2026-75803 OpenSSL FR

· zachyceno · CERT-FR – avis · Multiples vulnérabilités dans OpenSSL (26 août 2026)

OpenSSL security advisory (AV26-846)

Serial Number: AV26-846Date: August 25, 2026 As of August 25, 2026, OpenSSL is affected by vulnerabilities in the following product: OpenSSL Prior to 1.0.2zr Prior to 1.1.1zi Prior to 3.0.22 Prior to 3.4.7 Prior to 3.5.8 Prior to 3.6.4 Prior to 4.0.2 The Cyber Centre encourages users and administrators to review the provided web link and apply any necessary updates as they become available. Vulnerabilities | OpenSSL Library

OpenSSL CA

· Cyber Centre Kanada · OpenSSL security advisory (AV26-846)

SPOJENO PŘES CVE Risolta vulnerabilità in OpenSSL

Rilasciato aggiornamento di sicurezza per una nuova vulnerabilità, con gravità “alta“, che interessa OpenSSL, nota libreria per l’implementazione degli standard crittografici e i protocolli TLS/SSL. Tale vulnerabilità, qualora sfruttata, potrebbe consentire ad un utente malintenzionato di compromettere la disponibilità del servizio sui sistemi interessati.

EPSS 0.01 CVE-2026-14456 OpenSSL IT FR

· CSIRT Itálie (ACN) · Risolta vulnerabilità in OpenSSL · CERT-FR – avis · Vulnérabilité dans OpenSSL (14 août 2026)

ZDI-26-425: OpenSSL OCSP Stapling Verification Double Free Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenSSL. User interaction is required to exploit this vulnerability in that the target must make a request to a malicious server. The ZDI has assigned a CVSS rating of 7.5. The following CVEs are assigned: CVE-2026-35188.

EPSS 0.00 CVSS 7.5 CVE-2026-35188 OpenSSL US

· Zero Day Initiative · ZDI-26-425: OpenSSL OCSP Stapling Verification Double Free Remote Code Execution Vulnerability

ZDI-26-426: OpenSSL X.509 Email Validation Out-Of-Bounds Read Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of OpenSSL. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 6.5. The following CVEs are assigned: CVE-2026-42771.

EPSS 0.00 CVSS 6.5 CVE-2026-42771 OpenSSL US

· Zero Day Initiative · ZDI-26-426: OpenSSL X.509 Email Validation Out-Of-Bounds Read Information Disclosure Vulnerability

CVE-2017-3736 There is a carry propagating bug in the x86_64 Montgomery squaring procedure in OpenSSL before 1.0.2m and 1.1.0 before 1.1.0g. No EC algorithms are affected. Analysis suggests that attacks against RSA and DSA as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH are considered just feasible (although very difficult) because most of the work necessary to deduce information about a private key may be performed offline. The amount of resources required for such an attack would be very significant and likely only accessible to a limited number of attackers. An attacker would additionally need online access to an unpatched system using the target private key in a scenario with persistent DH parameters and a private key that is shared between multiple clients. This only affects processors that support the BMI1, BMI2 and ADX extensions like Intel Broadwell (5th generation) and later or AMD Ryzen.

Information published.

EPSS 0.10 CVE-2017-3736 OpenSSL US

· Microsoft Security · CVE-2017-3736 There is a carry propagating bug in the x86_64 Montgomery squaring procedure in OpenSSL before 1.0.2m and 1.1.0 before 1.1.0g. No EC algorithms are affected. Analysis suggests that attacks against RSA and DSA as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH are considered just feasible (although very difficult) because most of the work necessary to deduce information about a private key may be performed offline. The amount of resources required for such an attack would be very significant and likely only accessible to a limited number of attackers. An attacker would additionally need online access to an unpatched system using the target private key in a scenario with persistent DH parameters and a private key that is shared between multiple clients. This only affects processors that support the BMI1, BMI2 and ADX extensions like Intel Broadwell (5th generation) and later or AMD Ryzen.