CVE search results

11 – 20 of 440 results

Detailed view

Sort by:

CVE-2024-7589

Medium priority

Not affected

A signal handler in sshd(8) may call a logging function that is not async-signal-safe. The signal handler is invoked when a client does not authenticate within the LoginGraceTime seconds (120 by default). This signal handler...

2 affected packages

openssh, openssh-ssh1

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS	16.04 LTS
openssh	Not affected	Not affected	Not affected	Not affected	Not affected
openssh-ssh1	Not affected	Not affected	Not affected	Not affected	—

CVE-2024-6409

Medium priority

Not affected

A race condition vulnerability was discovered in how signals are handled by OpenSSH's server (sshd). If a remote attacker does not authenticate within a set time period, then sshd's SIGALRM handler is called...

2 affected packages

openssh, openssh-ssh1

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS	16.04 LTS
openssh	Not affected	Not affected	Not affected	Not affected	Not affected
openssh-ssh1	Not affected	Not affected	Not affected	Not affected	—

CVE-2024-39894

Medium priority

Fixed

OpenSSH 9.5 through 9.7 before 9.8 sometimes allows timing attacks against echo-off password entry (e.g., for su and Sudo) because of an ObscureKeystrokeTiming logic error. Similarly, other timing attacks against keystroke entry...

2 affected packages

openssh, openssh-ssh1

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS	16.04 LTS
openssh	Fixed	Not affected	Not affected	Not affected	Not affected
openssh-ssh1	Not affected	Not affected	Not affected	Not affected	—

CVE-2024-6387

High priority

Fixed

A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead sshd to handle some signals in an unsafe manner. An unauthenticated, remote attacker may be able to trigger...

2 affected packages

openssh, openssh-ssh1

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS	16.04 LTS
openssh	Fixed	Fixed	Not affected	Not affected	Not affected
openssh-ssh1	Not affected	Not affected	Not affected	Not affected	—

CVE-2024-5535

Low priority

Some fixes available 4 of 19

Issue summary: Calling the OpenSSL API function SSL_select_next_proto with an empty supported client protocols buffer may cause a crash or memory contents to be sent to the peer. Impact summary: A buffer overread can have a range...

4 affected packages

edk2, nodejs, openssl, openssl1.0

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS	16.04 LTS
edk2	Needs evaluation	Needs evaluation	Needs evaluation	Needs evaluation	Needs evaluation
nodejs	Not affected	Vulnerable	Not affected	Needs evaluation	Needs evaluation
openssl	Fixed	Fixed	Fixed	Needs evaluation	Needs evaluation
openssl1.0	Not in release	Not in release	Not in release	Needs evaluation	—

CVE-2024-4741

Low priority

Some fixes available 4 of 18

Issue summary: Calling the OpenSSL API function SSL_free_buffers may cause memory to be accessed that was previously freed in some situations Impact summary: A use after free can have a range of potential consequences such as the...

4 affected packages

edk2, nodejs, openssl, openssl1.0

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS	16.04 LTS
edk2	Vulnerable	Vulnerable	Vulnerable	Needs evaluation	Needs evaluation
nodejs	Not affected	Vulnerable	Not affected	Needs evaluation	Needs evaluation
openssl	Fixed	Fixed	Fixed	Needs evaluation	Needs evaluation
openssl1.0	Not in release	Not in release	Not in release	Not affected	—

CVE-2024-4603

Low priority

Some fixes available 3 of 9

Issue summary: Checking excessively long DSA keys or parameters may be very slow. Impact summary: Applications that use the functions EVP_PKEY_param_check() or EVP_PKEY_public_check() to check a DSA public key or DSA parameters...

4 affected packages

edk2, nodejs, openssl, openssl1.0

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS	16.04 LTS
edk2	Vulnerable	Not affected	Not affected	Not affected	Not affected
nodejs	Not affected	Vulnerable	Not affected	Needs evaluation	Needs evaluation
openssl	Fixed	Fixed	Not affected	Not affected	Not affected
openssl1.0	Not in release	Not in release	Not in release	Not affected	—

CVE-2024-2467

Medium priority

Vulnerable

A timing-based side-channel flaw exists in the perl-Crypt-OpenSSL-RSA package, which could be sufficient to recover plaintext across a network in a Bleichenbacher-style attack. To achieve successful decryption, an attacker would...

1 affected package

libcrypt-openssl-rsa-perl

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS	16.04 LTS
libcrypt-openssl-rsa-perl	Vulnerable	Vulnerable	Vulnerable	Vulnerable	Vulnerable

CVE-2024-2511

Low priority

Some fixes available 4 of 18

Issue summary: Some non-default TLS server configurations can cause unbounded memory growth when processing TLSv1.3 sessions Impact summary: An attacker may exploit certain server configurations to trigger unbounded memory growth...

4 affected packages

edk2, nodejs, openssl, openssl1.0

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS	16.04 LTS
edk2	Vulnerable	Vulnerable	Vulnerable	Needs evaluation	Needs evaluation
nodejs	Not affected	Vulnerable	Not affected	Needs evaluation	Needs evaluation
openssl	Fixed	Fixed	Fixed	Needs evaluation	Needs evaluation
openssl1.0	Not in release	Not in release	Not in release	Not affected	—

CVE-2024-3296

Medium priority

Needs evaluation

A timing-based side-channel flaw exists in the rust-openssl package, which could be sufficient to recover a plaintext across a network in a Bleichenbacher-style attack. To achieve successful decryption, an attacker would have to...

1 affected package

rust-openssl

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS	16.04 LTS
rust-openssl	Needs evaluation	Needs evaluation	Needs evaluation	—	—

Export to JSON

Results by page:

Search CVE reports