CVE-2022-2097

Aliases:GHSA-3wx7-46ch-7rq2RUSTSEC-2022-0032
Advisory lineage Upstream: 0 Downstream: 20
Modified
Published: 05 Jul 2022, 10:30
Last modified:17 Sept 2024, 01:06

Vulnerability Summary

Overall Risk (default)
low
21/100
CVSS Score
5.3 MEDIUM
v3.1 (nvd)
EPSS Score
0.51% LOW
1% probability +0.10%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

05 Jul 2022, 10:30
Published
Vulnerability first disclosed
17 Sept 2024, 01:06
Last Modified
Vulnerability information updated

Description

AES OCB mode for 32-bit x86 platforms using the AES-NI assembly optimised implementation will not encrypt the entirety of the data under some circumstances. This could reveal sixteen bytes of data that was preexisting in the memory that wasn't written. In the special case of "in place" encryption, sixteen bytes of the plaintext would be revealed. Since OpenSSL does not support OCB based cipher suites for TLS and DTLS, they are both unaffected. Fixed in OpenSSL 3.0.5 (Affected 3.0.0-3.0.4). Fixed in OpenSSL 1.1.1q (Affected 1.1.1-1.1.1p).

CVSS Metrics

  • v3.1•MEDIUM•Score: 5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
  • v3.1•HIGH•Score: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
  • v2.0•MEDIUM•Score: 5AV:N/AC:L/Au:N/C:P/I:N/A:N

EPSS Trends

Current EPSS score: 0.51%• Percentile: 67%

Techniques & Countermeasures

  • CWE-327•Use of a Broken or Risky Cryptographic Algorithm

    The product uses a broken or risky cryptographic algorithm or protocol.

Affected Systems

  • Crates.Io•openssl-src

    < 111.22.0 | ≥ 300.0.0, < 300.0.9

  • debian•debian_linux

    10.0 | 11.0

  • fedoraproject•fedora

    35 | 36

  • netapp•active_iq_unified_manager

    na

  • netapp•clustered_data_ontap_antivirus_connector

    na

  • netapp•h300s_firmware

    na

  • netapp•h410c_firmware

    na

  • netapp•h410s_firmware

    na

  • netapp•h500s_firmware

    na

  • netapp•h700s_firmware

    na

  • Unknown•OpenSSL

    ≥ 1.1.1, < 1.1.1q | ≥ 3.0.0, < 3.0.5 | Fixed in OpenSSL 3.0.5 (Affected 3.0.0-3.0.4) | Fixed in OpenSSL 1.1.1q (Affected 1.1.1-1.1.1p)

  • siemens•sinec_ins

    < 1.0 | 1.0 | 1.0:sp1 | 1.0:sp2

References (28)