Software Detail
Title
CVE
CRITICAL
HIGH
MEDIUM
LOW
CWE
Number of items displayed
openssl Number Of NVD 271 CRITICAL 16 HIGH 87 MEDIUM 152 LOW 16
URL https://www.openssl.org/
Explanation OpenSSLはSSLプロトコル・TLSプロトコルの、オープンソースで開発・提供されるソフトウェアです。

Version3からはApache2.0 Licenseでそれ以前のバージョンは「OpenSSL License」と「SSLeay license」 のダブルライセンスです。
サポート切れになった特定バージョン(1.0.2)は費用がかかりますが、Securityアップデートを受けるプランがあります。

LinuxなどUnix系OSでは標準でインストールされており、OSのアップデートなどで自動的に新しいバージョンに更新される事が殆どです。
古いバージョンのOSではサポートが終了したOpenSSLしか使用できないなど、セキュリティの問題が発生する場合があります。
Tag
  • Apache License v2.0
  • OpenSSL License
  • Original SSLeay License
  • オープンソース
  • 商用ライセンス有り
Add Information URL
No Type Name URL
1 リリースに関する説明とサポート終了バージョンについて https://www.openssl.org/policies/releasestrat.html
2 opensslのGit https://github.com/openssl/openssl
3 脆弱性情報のページ https://www.openssl.org/news/vulnerabilities.html
4 サポート契約 https://www.openssl.org/support/contracts.html
List Of Product  [ Click to show release history and vulnerability information ]
No Name Latest Version Release date Initial release Normal Support Security Support
Service Pack Support		 Extended
for a fee		 Critical High Medium Low
81 openssl 1.1.1(LTS) 1.1.1w Sept. 11, 2023 Sept. 11, 2018 Sept. 11, 2023 3 20 25 2
82 openssl 1.1.0 1.1.0j Nov. 20, 2018 Aug. 26, 2016 Aug. 31, 2018 1 12 14 2
83 openssl 1.0.2(LTS) 1.0.2u Dec. 20, 2019 Jan. 23, 2015 Dec. 31, 2019 9 35 64 10
84 openssl 1.0.1 1.0.1t May 3, 2016 March 14, 2012 Dec. 31, 2016 7 25 58 5
85 openssl 1.0.0 1.0.0t Dec. 3, 2015 March 29, 2010 Dec. 31, 2015 1 14 57 5
86 openssl 0.9.8 0.9.8zh Dec. 4, 2015 July 6, 2005 Dec. 31, 2015 1 5 9 3
87 openssl a.00(LTS) a.00.09.07l 0 0 0 0
88 openssl 3 3.6.3 June 9, 2026 4 26 19 1
89 openssl 1.0(LTS) 1.0.2zf 7 29 80 7
90 openssl 0.9(LTS) 0.9.8zh 2 30 76 7
NVD Vulnerability Information
  • CRITICAL
  • HIGH
  • MEDIUM
  • LOW
No CVSS3
CVSS2		 Level
Attach Vector		 Title CWE CVE cpe23Uri or higher or less more than less than Update date
Published date		 Show Affected Exploit
PoC
Search
81 5.5
2.1 		MEDIUM
Local 		A timing attack flaw was found in OpenSSL 1.0.1u and before that could allow a malicious user with local access to recover ECDSA P-256 private keys. - CVE-2016-7056 cpe:2.3:a:openssl:openssl:*:* 1.0.1u 2024-11-21 11:57
2018-09-11 		Show GitHub Exploit DB Packet Storm
82 7.5
5.0 		HIGH
Network 		During key agreement in a TLS handshake using a DH(E) based ciphersuite a malicious server can send a very large prime value to the client. This will cause the client to spend an unreasonably long pe… CWE-320
 Key Management Errors 		CVE-2018-0732 cpe:2.3:a:openssl:openssl:*:* 1.1.0
1.0.2 		1.1.0h
1.0.2o

2024-11-21 12:38
2018-06-12 		Show GitHub Exploit DB Packet Storm
83 5.9
4.3 		MEDIUM
Network 		The OpenSSL RSA Key generation algorithm has been shown to be vulnerable to a cache timing side channel attack. An attacker with sufficient access to mount cache timing attacks during the RSA key gen… CWE-327
 Use of a Broken or Risky Cryptographic Algorithm 		CVE-2018-0737 cpe:2.3:a:openssl:openssl:*:* 1.0.2b
1.1.0 		1.0.2o
1.1.0h

2024-11-21 12:38
2018-04-17 		Show GitHub Exploit DB Packet Storm
84 6.5
4.3 		MEDIUM
Network 		Constructed ASN.1 types with a recursive definition (such as can be found in PKCS7) could eventually exceed the stack given malicious input with excessive recursion. This could result in a Denial Of … CWE-674
 Uncontrolled Recursion 		CVE-2018-0739 cpe:2.3:a:openssl:openssl:*:* 1.0.2b
1.1.0 		1.0.2n
1.1.0g

2024-11-21 12:38
2018-03-28 		Show GitHub Exploit DB Packet Storm
85 5.9
4.3 		MEDIUM
Network 		Because of an implementation bug the PA-RISC CRYPTO_memcmp function is effectively reduced to only comparing the least significant bit of each byte. This allows an attacker to forge messages that wou… NVD-CWE-noinfo
CVE-2018-0733 cpe:2.3:a:openssl:openssl:*:* 1.1.0 1.1.0g 2024-11-21 12:38
2018-03-28 		Show GitHub Exploit DB Packet Storm
86 5.9
4.3 		MEDIUM
Network 		There is an overflow bug in the AVX2 Montgomery multiplication procedure used in exponentiation with 1024-bit moduli. No EC algorithms are affected. Analysis suggests that attacks against RSA and DSA… CWE-200
Information Exposure 		CVE-2017-3738 cpe:2.3:a:openssl:openssl:1.1.0g:*
cpe:2.3:a:openssl:openssl:1.1.0f:*
cpe:2.3:a:openssl:openssl:1.1.0e:*
cpe:2… 		2024-11-21 12:26
2017-12-8 		Show GitHub Exploit DB Packet Storm
87 5.9
4.3 		MEDIUM
Network 		OpenSSL 1.0.2 (starting from version 1.0.2b) introduced an "error state" mechanism. The intent was that if a fatal error occurred during a handshake then OpenSSL would move into the error state and w… CWE-125
CWE-787
Out-of-bounds Read
 Out-of-bounds Write 		CVE-2017-3737 cpe:2.3:a:openssl:openssl:1.0.2m:*
cpe:2.3:a:openssl:openssl:1.0.2l:*
cpe:2.3:a:openssl:openssl:1.0.2k:*
cpe:2… 		2024-11-21 12:26
2017-12-8 		Show GitHub Exploit DB Packet Storm
88 7.5
5.0 		HIGH
Network 		A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL protocol defined processing of ALERT packets during a connection handshake. A remote… - CVE-2016-8610 cpe:2.3:a:openssl:openssl:1.1.0:*
cpe:2.3:a:openssl:openssl:1.0.1:*
cpe:2.3:a:openssl:openssl:0.9.8:*
cpe:2.3:… 		1.0.2 1.0.2h 2024-11-21 11:59
2017-11-14 		Show GitHub Exploit DB Packet Storm
89 6.5
4.0 		MEDIUM
Network 		There is a carry propagating bug in the x86_64 Montgomery squaring procedure in OpenSSL before 1.0.2m and 1.1.0 before 1.1.0g. No EC algorithms are affected. Analysis suggests that attacks against RS… CWE-200
Information Exposure 		CVE-2017-3736 cpe:2.3:a:openssl:openssl:*:* 1.1.0
1.0.2

1.1.0g
1.0.2m 		2024-11-21 12:26
2017-11-3 		Show GitHub Exploit DB Packet Storm
90 5.3
5.0 		MEDIUM
Network 		While parsing an IPAddressFamily extension in an X.509 certificate, it is possible to do a one-byte overread. This would result in an incorrect text display of the certificate. This bug has been pres… CWE-119
Incorrect Access of Indexable Resource ('Range Error')  		CVE-2017-3735 cpe:2.3:a:openssl:openssl:1.1.0f:*
cpe:2.3:a:openssl:openssl:1.1.0e:*
cpe:2.3:a:openssl:openssl:1.1.0d:*
cpe:2… 		2024-11-21 12:26
2017-08-29 		Show GitHub Exploit DB Packet Storm