search

pazhanivel07 / OpenSSL_1_0_1g_AfterPatch

Other
0 stars 0 forks source link

CVE-2016-0705 (Critical) detected in opensslOpenSSL_1_0_2za #74

Open mend-bolt-for-github[bot] opened 1 year ago

mend-bolt-for-github[bot] commented 1 year ago

CVE-2016-0705 - Critical Severity Vulnerability

Vulnerable Library - opensslOpenSSL_1_0_2za

TLS/SSL and crypto library

Library home page: https://github.com/openssl/openssl.git

Found in HEAD commit: 3fbbb063388e28edaf82a166f24d4ce71e0b1514

Found in base branch: master

Vulnerable Source Files (2)

/crypto/dsa/dsa_ameth.c /crypto/dsa/dsa_ameth.c

Vulnerability Details

Double free vulnerability in the dsa_priv_decode function in crypto/dsa/dsa_ameth.c in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a malformed DSA private key.

Publish Date: 2016-03-03

URL: CVE-2016-0705

CVSS 3 Score Details (9.8)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2016-0705

Release Date: 2016-03-03

Fix Resolution: 1.0.1s,1.0.2g

Step up your Open Source Security Game with Mend here