5.8

CVE-2011-4354

crypto/bn/bn_nist.c in OpenSSL before 0.9.8h on 32-bit platforms, as used in stunnel and other products, in certain circumstances involving ECDH or ECDHE cipher suites, uses an incorrect modular reduction algorithm in its implementation of the P-256 and P-384 NIST elliptic curves, which allows remote attackers to obtain the private key of a TLS server via multiple handshake attempts.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
OpenSSL ≫ OpenSSL HwPlatform x86 Version <= 0.9.8g
OpenSSL ≫ OpenSSL Version 0.9.1c HwPlatform x86
OpenSSL ≫ OpenSSL Version 0.9.2b HwPlatform x86
OpenSSL ≫ OpenSSL Version 0.9.3 HwPlatform x86
OpenSSL ≫ OpenSSL Version 0.9.3a HwPlatform x86
OpenSSL ≫ OpenSSL Version 0.9.4 HwPlatform x86
OpenSSL ≫ OpenSSL Version 0.9.5 HwPlatform x86
OpenSSL ≫ OpenSSL Version 0.9.5 Update beta1 HwPlatform x86
OpenSSL ≫ OpenSSL Version 0.9.5 Update beta2 HwPlatform x86
OpenSSL ≫ OpenSSL Version 0.9.5a HwPlatform x86
OpenSSL ≫ OpenSSL Version 0.9.5a Update beta1 HwPlatform x86
OpenSSL ≫ OpenSSL Version 0.9.5a Update beta2 HwPlatform x86
OpenSSL ≫ OpenSSL Version 0.9.6 HwPlatform x86
OpenSSL ≫ OpenSSL Version 0.9.6 Update beta1 HwPlatform x86
OpenSSL ≫ OpenSSL Version 0.9.6 Update beta2 HwPlatform x86
OpenSSL ≫ OpenSSL Version 0.9.6 Update beta3 HwPlatform x86
OpenSSL ≫ OpenSSL Version 0.9.6a HwPlatform x86
OpenSSL ≫ OpenSSL Version 0.9.6a Update beta1 HwPlatform x86
OpenSSL ≫ OpenSSL Version 0.9.6a Update beta2 HwPlatform x86
OpenSSL ≫ OpenSSL Version 0.9.6a Update beta3 HwPlatform x86
OpenSSL ≫ OpenSSL Version 0.9.6b HwPlatform x86
OpenSSL ≫ OpenSSL Version 0.9.6c HwPlatform x86
OpenSSL ≫ OpenSSL Version 0.9.6d HwPlatform x86
OpenSSL ≫ OpenSSL Version 0.9.6e HwPlatform x86
OpenSSL ≫ OpenSSL Version 0.9.6f HwPlatform x86
OpenSSL ≫ OpenSSL Version 0.9.6g HwPlatform x86
OpenSSL ≫ OpenSSL Version 0.9.6h HwPlatform x86
OpenSSL ≫ OpenSSL Version 0.9.6i HwPlatform x86
OpenSSL ≫ OpenSSL Version 0.9.6j HwPlatform x86
OpenSSL ≫ OpenSSL Version 0.9.6k HwPlatform x86
OpenSSL ≫ OpenSSL Version 0.9.6l HwPlatform x86
OpenSSL ≫ OpenSSL Version 0.9.6m HwPlatform x86
OpenSSL ≫ OpenSSL Version 0.9.7 HwPlatform x86
OpenSSL ≫ OpenSSL Version 0.9.7 Update beta1 HwPlatform x86
OpenSSL ≫ OpenSSL Version 0.9.7 Update beta2 HwPlatform x86
OpenSSL ≫ OpenSSL Version 0.9.7 Update beta3 HwPlatform x86
OpenSSL ≫ OpenSSL Version 0.9.7 Update beta4 HwPlatform x86
OpenSSL ≫ OpenSSL Version 0.9.7 Update beta5 HwPlatform x86
OpenSSL ≫ OpenSSL Version 0.9.7 Update beta6 HwPlatform x86
OpenSSL ≫ OpenSSL Version 0.9.7a HwPlatform x86
OpenSSL ≫ OpenSSL Version 0.9.7b HwPlatform x86
OpenSSL ≫ OpenSSL Version 0.9.7c HwPlatform x86
OpenSSL ≫ OpenSSL Version 0.9.7d HwPlatform x86
OpenSSL ≫ OpenSSL Version 0.9.7e HwPlatform x86
OpenSSL ≫ OpenSSL Version 0.9.7f HwPlatform x86
OpenSSL ≫ OpenSSL Version 0.9.7g HwPlatform x86
OpenSSL ≫ OpenSSL Version 0.9.7h HwPlatform x86
OpenSSL ≫ OpenSSL Version 0.9.7i HwPlatform x86
OpenSSL ≫ OpenSSL Version 0.9.7j HwPlatform x86
OpenSSL ≫ OpenSSL Version 0.9.7k HwPlatform x86
OpenSSL ≫ OpenSSL Version 0.9.7l HwPlatform x86
OpenSSL ≫ OpenSSL Version 0.9.7m HwPlatform x86
OpenSSL ≫ OpenSSL Version 0.9.8 HwPlatform x86
OpenSSL ≫ OpenSSL Version 0.9.8a HwPlatform x86
OpenSSL ≫ OpenSSL Version 0.9.8b HwPlatform x86
OpenSSL ≫ OpenSSL Version 0.9.8c HwPlatform x86
OpenSSL ≫ OpenSSL Version 0.9.8d HwPlatform x86
OpenSSL ≫ OpenSSL Version 0.9.8e HwPlatform x86
OpenSSL ≫ OpenSSL Version 0.9.8f HwPlatform x86
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 4.04% 0.893
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 5.8 8.6 4.9
AV:N/AC:M/Au:N/C:P/I:P/A:N
Es wurden noch keine Informationen zu CWE veröffentlicht.
http://www.debian.org/security/2012/dsa-2390
http://crypto.di.uminho.pt/CACE/CT-RSA2012-openssl-src.zip
http://cvs.openssl.org/filediff?f=openssl/crypto/bn/bn_nist.c&v1=1.14&v2=1.21
http://eprint.iacr.org/2011/633
http://marc.info/?t=119271238800004
http://openwall.com/lists/oss-security/2011/12/01/6
http://rt.openssl.org/Ticket/Display.html?id=1593&user=guest&pass=guest
https://bugzilla.redhat.com/show_bug.cgi?id=757909