CVE search results

1 – 10 of 274 results

Detailed view

Sort by:

CVE-2025-4575

Low priority

Not affected

Issue summary: Use of -addreject option with the openssl x509 application adds a trusted use instead of a rejected use for a certificate. Impact summary: If a user intends to make a trusted certificate rejected for a particular...

4 affected packages

edk2, nodejs, openssl, openssl1.0

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS
edk2	Not affected	Not affected	Not affected	Not affected
nodejs	Not affected	Not affected	Not affected	Not affected
openssl	Not affected	Not affected	Not affected	Not affected
openssl1.0	Not in release	Not in release	Not in release	Not affected

CVE-2025-46551

Medium priority

Needs evaluation

JRuby-OpenSSL is an add-on gem for JRuby that emulates the Ruby OpenSSL native library. Starting in JRuby-OpenSSL version 0.12.1 and prior to version 0.15.4 (corresponding to JRuby versions starting in 9.3.4.0 prior to 9.4.12.1...

1 affected package

jruby-openssl

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS
jruby-openssl	Not in release	Needs evaluation	Needs evaluation	Needs evaluation

CVE-2025-3416

Medium priority

Needs evaluation

A flaw was found in OpenSSL’s handling of the properties argument in certain functions. This vulnerability can allow use-after-free exploitation, which may result in undefined behavior or incorrect property parsing, leading to...

1 affected package

rust-openssl

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS
rust-openssl	Needs evaluation	Needs evaluation	Needs evaluation	—

CVE-2024-12797

High priority

Fixed

Issue summary: Clients using RFC7250 Raw Public Keys (RPKs) to authenticate a server may fail to notice that the server was not authenticated, because handshakes don’t abort as expected when the SSL_VERIFY_PEER...

4 affected packages

edk2, nodejs, openssl, openssl1.0

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS
edk2	Not affected	Not affected	Not affected	Not affected
nodejs	Not affected	Not affected	Not affected	Not affected
openssl	Not affected	Not affected	Not affected	Not affected
openssl1.0	Not in release	Not in release	Not in release	Not affected

CVE-2025-24898

Medium priority

Needs evaluation

rust-openssl is a set of OpenSSL bindings for the Rust programming language. In affected versions `ssl::select_next_proto` can return a slice pointing into the `server` argument’s buffer but with a lifetime bound to the `client`...

2 affected packages

rust-openssl, rust-openssl-sys

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS
rust-openssl	Needs evaluation	Needs evaluation	Needs evaluation	—
rust-openssl-sys	Needs evaluation	Needs evaluation	Needs evaluation	—

CVE-2024-13176

Low priority

Some fixes available 5 of 19

Issue summary: A timing side-channel which could potentially allow recovering the private key exists in the ECDSA signature computation. Impact summary: A timing side-channel in ECDSA signature computations could allow recovering...

4 affected packages

edk2, nodejs, openssl, openssl1.0

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS
edk2	Needs evaluation	Needs evaluation	Needs evaluation	Needs evaluation
nodejs	Not affected	Vulnerable	Not affected	Needs evaluation
openssl	Fixed	Fixed	Fixed	Needs evaluation
openssl1.0	Not in release	Not in release	Not in release	Needs evaluation

CVE-2024-9143

Low priority

Some fixes available 4 of 18

Issue summary: Use of the low-level GF(2^m) elliptic curve APIs with untrusted explicit values for the field polynomial can lead to out-of-bounds memory reads or writes. Impact summary: Out of bound memory writes can lead to an...

4 affected packages

edk2, nodejs, openssl, openssl1.0

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS
edk2	Needs evaluation	Needs evaluation	Needs evaluation	Needs evaluation
nodejs	Not affected	Vulnerable	Not affected	Needs evaluation
openssl	Fixed	Fixed	Fixed	Needs evaluation
openssl1.0	Not in release	Not in release	Not in release	Needs evaluation

CVE-2024-6119

Medium priority

Some fixes available 4 of 14

Issue summary: Applications performing certificate name checks (e.g., TLS clients checking server certificates) may attempt to read an invalid memory address resulting in abnormal termination of the application process. Impact...

4 affected packages

edk2, nodejs, openssl, openssl1.0

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS
edk2	Needs evaluation	Needs evaluation	Needs evaluation	Needs evaluation
nodejs	Not affected	Vulnerable	Not affected	Needs evaluation
openssl	Fixed	Fixed	Not affected	Not affected
openssl1.0	Not in release	Not in release	Not in release	Not affected

CVE-2024-41996

Low priority

Vulnerable

Validating the order of the public keys in the Diffie-Hellman Key Agreement Protocol, when an approved safe prime is used, allows remote attackers (from the client side) to trigger unnecessarily expensive server-side...

4 affected packages

edk2, nodejs, openssl, openssl1.0

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS
edk2	Needs evaluation	Not affected	Not affected	Not affected
nodejs	Not affected	Needs evaluation	Not affected	Not affected
openssl	Vulnerable	Vulnerable	Not affected	Not affected
openssl1.0	Not in release	Not in release	Not in release	Not affected

CVE-2024-5535

Low priority

Some fixes available 5 of 21

Issue summary: Calling the OpenSSL API function SSL_select_next_proto with an empty supported client protocols buffer may cause a crash or memory contents to be sent to the peer. Impact summary: A buffer overread can have a range...

4 affected packages

edk2, nodejs, openssl, openssl1.0

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS
edk2	Needs evaluation	Needs evaluation	Needs evaluation	Needs evaluation
nodejs	Not affected	Vulnerable	Not affected	Needs evaluation
openssl	Fixed	Fixed	Fixed	Needs evaluation
openssl1.0	Not in release	Not in release	Not in release	Needs evaluation

Export to JSON

Results by page:

Search CVE reports