Software Detail

Software Informaton Top

Encryption

Software Detail

openssl

Number Of NVD

271

CRITICAL

HIGH

MEDIUM

152

LOW

URL	https://www.openssl.org/
Explanation	OpenSSLはSSLプロトコル・TLSプロトコルの、オープンソースで開発・提供されるソフトウェアです。 Version3からはApache2.0 Licenseでそれ以前のバージョンは「OpenSSL License」と「SSLeay license」のダブルライセンスです。サポート切れになった特定バージョン(1.0.2)は費用がかかりますが、Securityアップデートを受けるプランがあります。 LinuxなどUnix系OSでは標準でインストールされており、OSのアップデートなどで自動的に新しいバージョンに更新される事が殆どです。古いバージョンのOSではサポートが終了したOpenSSLしか使用できないなど、セキュリティの問題が発生する場合があります。
Tag	OpenSSL License Original SSLeay License オープンソース商用ライセンス有り Apache License v2.0

Add Information URL

No	Name	URL
1	リリースに関する説明とサポート終了バージョンについて	https://www.openssl.org/policies/releasestrat.html
2	opensslのGit	https://github.com/openssl/openssl
3	脆弱性情報のページ	https://www.openssl.org/news/vulnerabilities.html
4	サポート契約	https://www.openssl.org/support/contracts.html

List Of Product [ Click to show release history and vulnerability information ]

No	Name	Latest Version	Release date	Initial release	Normal Support	Critical	High	Medium	Low
71	openssl 1.1.1(LTS)	1.1.1w	Sept. 11, 2023	Sept. 11, 2018	Sept. 11, 2023	3	20	25	2
72	openssl 1.1.0	1.1.0j	Nov. 20, 2018	Aug. 26, 2016	Aug. 31, 2018	1	12	14	2
73	openssl 1.0.2(LTS)	1.0.2u	Dec. 20, 2019	Jan. 23, 2015	Dec. 31, 2019	9	35	64	10
74	openssl 1.0.1	1.0.1t	May 3, 2016	March 14, 2012	Dec. 31, 2016	7	25	58	5
75	openssl 1.0.0	1.0.0t	Dec. 3, 2015	March 29, 2010	Dec. 31, 2015	1	14	57	5
76	openssl 0.9.8	0.9.8zh	Dec. 4, 2015	July 6, 2005	Dec. 31, 2015	1	5	9	3
77	openssl a.00(LTS)	a.00.09.07l				0	0	0	0
78	openssl 3	3.6.3	June 9, 2026			4	26	19	1
79	openssl 1.0(LTS)	1.0.2zf				7	29	80	7
80	openssl 0.9(LTS)	0.9.8zh				2	30	76	7

NVD Vulnerability Information

CRITICAL
HIGH
MEDIUM
LOW

No	CVSS3 CVSS2	Level Attach Vector	Title	CWE	CVE	cpe23Uri	or higher	or less	less than	Update date Published date	Show Affected	Exploit PoC Search
71	5.3 5.0	MEDIUM Network	There is an overflow bug in the x64_64 Montgomery squaring procedure used in exponentiation with 512-bit moduli. No EC algorithms are affected. Analysis suggests that attacks against 2-prime RSA1024,…	CWE-190 Integer Overflow or Wraparound	CVE-2019-1551	cpe:2.3:a:openssl:openssl::	1.1.1 1.0.2	1.1.1d 1.0.2t		2024-11-21 13:36 2019-12-7	Show	GitHub Exploit DB Packet Storm

72	3.7 4.3	LOW Network	In situations where an attacker receives automated notification of the success or failure of a decryption attempt an attacker, after sending a very large number of messages to be decrypted, can recov…	CWE-327 CWE-203 Use of a Broken or Risky Cryptographic Algorithm Information Exposure Through Discrepancy	CVE-2019-1563	cpe:2.3:a:openssl:openssl::	1.1.1 1.0.2 1.1.0	1.1.1c 1.0.2s 1.1.0k		2024-11-21 13:36 2019-09-11	Show	GitHub Exploit DB Packet Storm

73	5.3 5.0	MEDIUM Network	OpenSSL 1.1.1 introduced a rewritten random number generator (RNG). This was intended to include protection in the event of a fork() system call in order to ensure that the parent and child processes…	CWE-330 Use of Insufficiently Random Values	CVE-2019-1549	cpe:2.3:a:openssl:openssl::	1.1.1	1.1.1c		2024-11-21 13:36 2019-09-11	Show	GitHub Exploit DB Packet Storm

74	4.7 1.9	MEDIUM Local	Normally in OpenSSL EC groups always have a co-factor present and this is used in side channel resistant code paths. However, in some cases, it is possible to construct a group using explicit paramet…	NVD-CWE-noinfo	CVE-2019-1547	cpe:2.3:a:openssl:openssl::	1.1.1 1.0.2 1.1.0	1.1.1c 1.0.2s 1.1.0k		2024-11-21 13:36 2019-09-11	Show	GitHub Exploit DB Packet Storm

75	3.3 1.9	LOW Local	OpenSSL has internal defaults for a directory tree where it can find a configuration file as well as certificates used for verification in TLS. This directory is most commonly referred to as OPENSSLD…	CWE-295 Improper Certificate Validation	CVE-2019-1552	cpe:2.3:a:openssl:openssl::	1.1.1 1.0.2 1.1.0	1.1.1c 1.0.2s 1.1.0k		2024-11-21 13:36 2019-07-31	Show	GitHub Exploit DB Packet Storm

76	7.4 5.8	HIGH Network	ChaCha20-Poly1305 is an AEAD cipher, and requires a unique nonce input for every encryption operation. RFC 7539 specifies that the nonce value (IV) should be 96 bits (12 bytes). OpenSSL allows a vari…	CWE-327 CWE-330 Use of a Broken or Risky Cryptographic Algorithm Use of Insufficiently Random Values	CVE-2019-1543	cpe:2.3:a:openssl:openssl::	1.1.1 1.1.0	1.1.1b 1.1.0j		2024-11-21 13:36 2019-03-7	Show	GitHub Exploit DB Packet Storm

77	5.9 4.3	MEDIUM Network	If an application encounters a fatal protocol error and then calls SSL_shutdown() twice (once to send a close_notify, and once to receive one) then OpenSSL can respond differently to the calling appl…	CWE-203 Information Exposure Through Discrepancy	CVE-2019-1559	cpe:2.3:a:openssl:openssl::	1.0.2		1.0.2r	2024-11-21 13:36 2019-02-28	Show	GitHub Exploit DB Packet Storm

78	4.7 1.9	MEDIUM Local	Simultaneous Multi-threading (SMT) in processors can enable local users to exploit software vulnerable to timing attacks via a side-channel timing attack on 'port contention'.	CWE-203 Information Exposure Through Discrepancy	CVE-2018-5407	cpe:2.3:a:openssl:openssl::	1.0.2 1.1.0		1.0.2q 1.1.0i	2024-11-21 13:08 2018-11-16	Show	GitHub Exploit DB Packet Storm

79	5.9 4.3	MEDIUM Network	The OpenSSL DSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing algorithm to recover the private key. Fixed in Ope…	CWE-327 Use of a Broken or Risky Cryptographic Algorithm	CVE-2018-0734	cpe:2.3:a:openssl:openssl:1.1.1:* cpe:2.3:a:openssl:openssl::	1.0.2 1.1.0	1.0.2p 1.1.0i		2024-11-21 12:38 2018-10-30	Show	GitHub Exploit DB Packet Storm

80	5.9 4.3	MEDIUM Network	The OpenSSL ECDSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing algorithm to recover the private key. Fixed in O…	CWE-327 Use of a Broken or Risky Cryptographic Algorithm	CVE-2018-0735	cpe:2.3:a:openssl:openssl:1.1.1:* cpe:2.3:a:openssl:openssl::	1.1.0	1.1.0i		2024-11-21 12:38 2018-10-29	Show	GitHub Exploit DB Packet Storm