OpenSSL Software Foundation OpenSSL
4 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2017-3738 | 1.0.2-1.02m ; 1.1.0-1.1.0g | There is an overflow bug in the AVX2 Montgomery multiplication procedure used in exponentiation with 1024-bit moduli. No EC algorithms are a | MEDIUM 5.9 | 13 % | ||
| CVE-2017-3737 | 1.0.2b-1.0.2m | OpenSSL 1.0.2 (starting from version 1.0.2b) introduced an "error state" mechanism. The intent was that if a fatal error occurred during a h | MEDIUM 5.9 | 79 % | ||
| CVE-2017-3736 | 1.1.0 - 1.1.0f ; 1.0.2 - 1.0.2l | There is a carry propagating bug in the x86_64 Montgomery squaring procedure in OpenSSL before 1.0.2m and 1.1.0 before 1.1.0g. No EC algorit | MEDIUM 6.5 | 10 % | ||
| CVE-2017-3735 | 1.1.0 ; 1.0.2 | While parsing an IPAddressFamily extension in an X.509 certificate, it is possible to do a one-byte overread. This would result in an incorr | MEDIUM 5.3 | 21 % |