This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.

[TLP:CLEAR] OpenSSL warns of 1 vulnerability

OpenSSL warns of a vulnerability that allows writing outside the bounds of allocated memory. Due to the low severity of this issue, no new OpenSSL versions will be released at this time. The fix will be included in the next release of each branch once available, in versions 3.3.3, 3.2.4, 3.1.8, 3.0.16, 1.1.1zb and 1.0.2zl [1]. However, fixes are already available in the OpenSSL git repository in commit c0d3e4d3 (for version 3.3) [2], commit bc7e04d7 (for version 3.2) [3], commit fdf67233 (for version 3.1) [4] and commit 72ae83ad (for version 3.0) [5]. For premium support customers, the fix is available in commit 8efc0cba (for version 1.1.1) [6] and in commit 9d576994 (for version 1.0.2) [7]. Slackware released a fix as part of SSA:2024-295-01 - openssl-1.1.1zb [8].

OpenSSL - out-of-bounds memory write (CVE-2024-9143)
CVSS 8.8 (High)

Using the low-level APIs for GF(2^m) elliptic curves, such as EC_GROUP_new_curve_GF2m(), EC_GROUP_new_from_params() and the BN_GF2m_* functions, with untrusted explicit values for the field polynomials can lead to out-of-bounds memory accesses, which may cause an application crash or potentially remote code execution. All known protocols using ECC support only "named curves" or the secure X9.62 encoding of binary curves in ECC keys in X.509 certificates, so the likelihood of the vulnerability being exploitable is low. The risk mainly affects applications that use "exotic" curve encodings with invalid polynomials [1].

The vulnerability is present in product:

  • OpenSSL; >=3.3.0, <3.3.3; >=3.2.0, <3.2.4; >=3.1.0, <3.1.8; >=3.0.0, <3.0.16; >=1.1.1, <1.1.1zb; >=1.0.2, <1.0.2zl

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 16. 10. 2024.

By CESNET, z.s.p.o. Michaela Jarošová on 22. 10. 2024.

CESNET, z.s.p.o. Logo