Matrixssl vulnerabilities, page 2
24 vulnerabilities
Known vulnerabilities in Matrixssl products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 1 product.
MediumCVE-2019-13629matrixsslmatrixssl matrixsslMatrixSSL 4.2.1 and earlier contains a timing side channel in ECDSA signature generation. This allows a local or a remote attacker, able to measure the duration of hundreds to thousands of signing operations, to compute the private key used. The issue occurs because crypto/pubkey/ecc_math.c scalar multiplication leaks the bit length of the scalar.EPSS1.24%CriticalCVE-2019-14431matrixsslmatrixssl matrixsslIn MatrixSSL 3.8.3 Open through 4.2.1 Open, the DTLS server mishandles incoming network messages leading to a heap-based buffer overflow of up to 256 bytes and possible Remote Code Execution in parseSSLHandshake in sslDecode.c. During processing of a crafted packet, the server mishandles the fragment length value provided in the DTLS message.EPSS3.63%CriticalCVE-2019-10914matrixsslmatrixssl matrixsslpubRsaDecryptSignedElementExt in MatrixSSL 4.0.1 Open, as used in Inside Secure TLS Toolkit, has a stack-based buffer overflow during X.509 certificate verification because of missing validation in psRsaDecryptPubExt in crypto/pubkey/rsa_pub.c.EPSS1.44%HighCVE-2023-24609matrixssl +1 morematrixssl matrixsslMatrix SSL 4.x through 4.6.0 and Rambus TLS Toolkit have a length-subtraction integer overflow for Client Hello Pre-Shared Key extension parsing in the TLS 1.3 server. An attacked device calculates an SHA-2 hash over at least 65 KB (in RAM). With a large number of crafted TLS messages, the CPU becomes heavily loaded. This occurs in tls13VerifyBinder and tls13TranscriptHashUpdate.EPSS0.73%