OpenSSL
OpenSSL Security Releases - May 2022
openssl-2022-05 May 1, 2022 Source: Vendor
OpenSSL security advisories for May 2022, compiled from CVE.org records.
Source of record
The credited names below are quoted verbatim from the vendor's own advisory:
https://www.cve.org/CVERecord?id=CVE-2022-1292
Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.
Credited
4 lines
Showing 1–4 of 4
CVE-2022-1292
BR2022-0000-030735
OpenSSL
unclaimed
The c_rehash script does not properly sanitise shell metacharacters to prevent command injection. This script is distributed by some operating systems in a manner where it is automatically executed...
Credited as Elison Niven (Sophos)
CVE-2022-1343
BR2022-0000-030736
OpenSSL
unclaimed
The function `OCSP_basic_verify` verifies the signer certificate on an OCSP response. In the case where the (non-default) flag OCSP_NOCHECKS is used then the response will be positive (meaning a su...
Credited as Raul Metsma
CVE-2022-1434
BR2022-0000-030737
OpenSSL
unclaimed
The OpenSSL 3.0 implementation of the RC4-MD5 ciphersuite incorrectly uses the AAD data as the MAC key. This makes the MAC key trivially predictable. An attacker could exploit this issue by perform...
Credited as Tom Colley (Broadcom)
CVE-2022-1473
BR2022-0000-030740
OpenSSL
unclaimed
The OPENSSL_LH_flush() function, which empties a hash table, contains a bug that breaks reuse of the memory occuppied by the removed hash table entries. This function is used when decoding certific...
Credited as Aliaksei Levin