GHSA-3wx7-46ch-7rq2

Source

https://github.com/advisories/GHSA-3wx7-46ch-7rq2

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/07/GHSA-3wx7-46ch-7rq2/GHSA-3wx7-46ch-7rq2.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-3wx7-46ch-7rq2

Aliases

Related

CGA-34cr-x5f5-q4cf

Published

2022-07-06T19:57:19Z

Modified

2024-06-24T21:24:18Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator

Summary

AES OCB fails to encrypt some bytes

Details

AES OCB mode for 32-bit x86 platforms using the AES-NI assembly optimized implementation will not encrypt the entirety of the data under some circumstances. This could reveal sixteen bytes of data that was pre-existing in the memory that wasn't written. In the special case of "in place" encryption, sixteen bytes of the plaintext would be revealed.

Since OpenSSL does not support OCB based cipher suites for TLS and DTLS, they are both unaffected.

Database specific

{
    "nvd_published_at": "2022-07-05T11:15:00Z",
    "cwe_ids": [
        "CWE-311",
        "CWE-326",
        "CWE-327"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2022-07-06T19:57:19Z"
}

References

Affected packages

crates.io / openssl-src

Package

Name: openssl-src; View open source insights on deps.dev
Purl: pkg:cargo/openssl-src

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

111.22.0