OpenSSL
OpenSSL Security Releases - April 2024
openssl-2024-04 Apr 1, 2024 Source: Vendor
OpenSSL security advisories for April 2024, compiled from CVE.org records.
Source of record
The credited names below are quoted verbatim from the vendor's own advisory:
https://www.cve.org/CVERecord?id=CVE-2023-6237
Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.
Credited
2 lines
Showing 1–2 of 2
CVE-2023-6237
BR2024-0000-031351
OpenSSL
unclaimed
Issue summary: Checking excessively long invalid RSA public keys may take
a long time.
Impact summary: Applications that use the function EVP_PKEY_public_check()
to check RSA public keys may exper...
Credited as OSS-Fuzz
CVE-2024-2511
BR2024-0000-031849
OpenSSL
unclaimed
Issue summary: Some non-default TLS server configurations can cause unbounded
memory growth when processing TLSv1.3 sessions
Impact summary: An attacker may exploit certain server configurations t...
Credited as Manish Patidar (Hewlett Packard Enterprise)