![]() ![]() It to ignore empty associated data entries which are unauthenticated asĪ consequence. Fix developed by Matt Caswell.ĬVE-2023-2975 AES-SIV implementation ignores empty associated data entries 07 July 2023: Issue summary: The AES-SIV cipher implementation contains a bug that causes ![]() The OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue. The OpenSSL SSL/TLS implementation is not affected by this issue. The function DH_check() is itself called by a number of other OpenSSL functions. An application that calls DH_check() and supplies a key or parameters obtainedįrom an untrusted source could be vulernable to a Denial of Service attack. Some of those checks use the supplied modulus valueĮven if it has already been found to be too large. However the DH_check() function checks numerous aspects of the key or parameters Trying to useĪ very large modulus is slow and OpenSSL will not normally use a modulus which One of thoseĬhecks confirms that the modulus ('p' parameter) is not too large. The function DH_check() performs various checks on DH parameters. ![]() Impact summary: Applications that use the functions DH_check(), DH_check_ex()įrom an untrusted source this may lead to a Denial of Service.
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |