openEuler 20.03 LTS SP4 update for openssl

1) Out-of-bounds write

EUVDB-ID: #VU98757

Risk: Low

CVSSv3.1: 5.2 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-9143

CWE-ID: CWE-787 - Out-of-bounds write

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error when using the low-level GF(2^m) elliptic curve APIs with untrusted explicit values for the field polynomial. A remote attacker can send specially crafted input to the server, trigger an out-of-bounds write and perform a denial of service (DoS) attack.

Note, the vulnerability can be exploited against the application in rare cases only that involve "exotic" curve encoding.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 20.03 LTS SP4

openssl-help: before 1.1.1f-38

openssl-libs: before 1.1.1f-38

openssl-devel: before 1.1.1f-38

openssl-debugsource: before 1.1.1f-38

openssl-debuginfo: before 1.1.1f-38

openssl: before 1.1.1f-38

CPE2.3

• cpe:2.3:o:openeuler:openeuler:20.03:LTS SP4:*:*:*:*:*:*
• cpe:2.3:o:openeuler:openssl-help:*:*:*:*:*:openeuler:*:*
• cpe:2.3:o:openeuler:openssl-libs:*:*:*:*:*:openeuler:*:*
• cpe:2.3:o:openeuler:openssl-devel:*:*:*:*:*:openeuler:*:*
• cpe:2.3:o:openeuler:openssl-debugsource:*:*:*:*:*:openeuler:*:*
• cpe:2.3:o:openeuler:openssl-debuginfo:*:*:*:*:*:openeuler:*:*
• cpe:2.3:o:openeuler:openssl:*:*:*:*:*:openeuler:*:*

External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2480

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.