Software Detail
Title
CVE
CRITICAL
HIGH
MEDIUM
LOW
CWE
Number of items displayed
openssl Number Of NVD 271 CRITICAL 16 HIGH 87 MEDIUM 152 LOW 16
URL https://www.openssl.org/
Explanation OpenSSLはSSLプロトコル・TLSプロトコルの、オープンソースで開発・提供されるソフトウェアです。

Version3からはApache2.0 Licenseでそれ以前のバージョンは「OpenSSL License」と「SSLeay license」 のダブルライセンスです。
サポート切れになった特定バージョン(1.0.2)は費用がかかりますが、Securityアップデートを受けるプランがあります。

LinuxなどUnix系OSでは標準でインストールされており、OSのアップデートなどで自動的に新しいバージョンに更新される事が殆どです。
古いバージョンのOSではサポートが終了したOpenSSLしか使用できないなど、セキュリティの問題が発生する場合があります。
Tag
  • Original SSLeay License
  • オープンソース
  • 商用ライセンス有り
  • Apache License v2.0
  • OpenSSL License
Add Information URL
No Type Name URL
1 リリースに関する説明とサポート終了バージョンについて https://www.openssl.org/policies/releasestrat.html
2 opensslのGit https://github.com/openssl/openssl
3 脆弱性情報のページ https://www.openssl.org/news/vulnerabilities.html
4 サポート契約 https://www.openssl.org/support/contracts.html
List Of Product  [ Click to show release history and vulnerability information ]
No Name Latest Version Release date Initial release Normal Support Security Support
Service Pack Support		 Extended
for a fee		 Critical High Medium Low
61 openssl 1.1.1(LTS) 1.1.1w Sept. 11, 2023 Sept. 11, 2018 Sept. 11, 2023 3 20 25 2
62 openssl 1.1.0 1.1.0j Nov. 20, 2018 Aug. 26, 2016 Aug. 31, 2018 1 12 14 2
63 openssl 1.0.2(LTS) 1.0.2u Dec. 20, 2019 Jan. 23, 2015 Dec. 31, 2019 9 35 64 10
64 openssl 1.0.1 1.0.1t May 3, 2016 March 14, 2012 Dec. 31, 2016 7 25 58 5
65 openssl 1.0.0 1.0.0t Dec. 3, 2015 March 29, 2010 Dec. 31, 2015 1 14 57 5
66 openssl 0.9.8 0.9.8zh Dec. 4, 2015 July 6, 2005 Dec. 31, 2015 1 5 9 3
67 openssl a.00(LTS) a.00.09.07l 0 0 0 0
68 openssl 3 3.6.3 June 9, 2026 4 26 19 1
69 openssl 1.0(LTS) 1.0.2zf 7 29 80 7
70 openssl 0.9(LTS) 0.9.8zh 2 30 76 7
NVD Vulnerability Information
  • CRITICAL
  • HIGH
  • MEDIUM
  • LOW
No CVSS3
CVSS2		 Level
Attach Vector		 Title CWE CVE cpe23Uri or higher or less more than less than Update date
Published date		 Show Affected Exploit
PoC
Search
61 7.4
5.8 		HIGH
Network 		ASN.1 strings are represented internally within OpenSSL as an ASN1_STRING structure which contains a buffer holding the string data and a field holding the buffer length. This contrasts with normal C… CWE-125
Out-of-bounds Read 		CVE-2021-3712 cpe:2.3:a:openssl:openssl:*:* 1.0.2
1.1.1

1.0.2za
1.1.1l 		2026-04-14 19:16
2021-08-25 		Show GitHub Exploit DB Packet Storm
62 9.8
7.5 		CRITICAL
Network 		In order to decrypt SM2 encrypted data an application is expected to call the API function EVP_PKEY_decrypt(). Typically an application will call this function twice. The first time, on entry, the "o… CWE-120
Classic Buffer Overflow 		CVE-2021-3711 cpe:2.3:a:openssl:openssl:*:* 1.1.1 1.1.1l 2024-11-21 15:22
2021-08-25 		Show GitHub Exploit DB Packet Storm
63 7.4
5.8 		HIGH
Network 		The X509_V_FLAG_X509_STRICT flag enables additional security checks of the certificates present in a certificate chain. It is not set by default. Starting from OpenSSL version 1.1.1h a check to disal… CWE-295
Improper Certificate Validation  		CVE-2021-3450 cpe:2.3:a:openssl:openssl:*:* 1.1.1h 1.1.1k 2024-11-21 15:21
2021-03-26 		Show GitHub Exploit DB Packet Storm
64 5.9
4.3 		MEDIUM
Network 		An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. If a TLSv1.2 renegotiation ClientHello omits the signature_algorithms extension (where i… CWE-476
 NULL Pointer Dereference 		CVE-2021-3449 cpe:2.3:a:openssl:openssl:*:* 1.1.1 1.1.1k 2024-11-21 15:21
2021-03-26 		Show GitHub Exploit DB Packet Storm
65 5.9
4.3 		MEDIUM
Network 		The OpenSSL public API function X509_issuer_and_serial_hash() attempts to create a unique hash value based on the issuer and serial number data contained within an X509 certificate. However it fails … CWE-476
 NULL Pointer Dereference 		CVE-2021-23841 cpe:2.3:a:openssl:openssl:*:* 1.0.2
1.1.1

1.0.2y
1.1.1j 		2024-11-21 14:51
2021-02-17 		Show GitHub Exploit DB Packet Storm
66 7.5
5.0 		HIGH
Network 		Calls to EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate may overflow the output length argument in some cases where the input length is close to the maximum permissable length for an integ… CWE-190
 Integer Overflow or Wraparound 		CVE-2021-23840 cpe:2.3:a:openssl:openssl:*:* 1.0.2
1.1.1

1.0.2y
1.1.1j 		2024-11-21 14:51
2021-02-17 		Show GitHub Exploit DB Packet Storm
67 3.7
4.3 		LOW
Network 		OpenSSL 1.0.2 supports SSLv2. If a client attempts to negotiate SSLv2 with a server that is configured to support both SSLv2 and more recent SSL and TLS versions then a check is made for a version ro… CWE-327
 Use of a Broken or Risky Cryptographic Algorithm 		CVE-2021-23839 cpe:2.3:a:openssl:openssl:*:* 1.0.2s 1.0.2x 2024-11-21 14:51
2021-02-17 		Show GitHub Exploit DB Packet Storm
68 5.9
4.3 		MEDIUM
Network 		The X.509 GeneralName type is a generic type for representing different types of names. One of those name types is known as EDIPartyName. OpenSSL provides a function GENERAL_NAME_cmp which compares d… CWE-476
 NULL Pointer Dereference 		CVE-2020-1971 cpe:2.3:a:openssl:openssl:*:* 1.0.2
1.1.1

1.0.2x
1.1.1i 		2024-11-21 14:11
2020-12-9 		Show GitHub Exploit DB Packet Storm
69 3.7
4.3 		LOW
Network 		The Raccoon attack exploits a flaw in the TLS specification which can lead to an attacker being able to compute the pre-master secret in connections which have used a Diffie-Hellman (DH) based cipher… CWE-203
 Information Exposure Through Discrepancy 		CVE-2020-1968 cpe:2.3:a:openssl:openssl:*:* 1.0.2 1.0.2v 2024-11-21 14:11
2020-09-9 		Show GitHub Exploit DB Packet Storm
70 7.5
5.0 		HIGH
Network 		Server or client applications that call the SSL_check_chain() function during or after a TLS 1.3 handshake may crash due to a NULL pointer dereference as a result of incorrect handling of the "signat… CWE-476
 NULL Pointer Dereference 		CVE-2020-1967 cpe:2.3:a:openssl:openssl:*:* 1.1.1d 1.1.1f 2024-11-21 14:11
2020-04-21 		Show GitHub Exploit DB Packet Storm