{"schemaVersion":3,"id":"USN-7264-1","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"openssl vulnerabilities\n\nIt was discovered that OpenSSL clients incorrectly handled authenticating\nservers using RFC7250 Raw Public Keys. In certain cases, the connection\nwill not abort as expected, possibly causing the communication to be\nintercepted. (CVE-2024-12797)\n\nGeorge Pantelakis and Alicja Kario discovered that OpenSSL had a timing\nside-channel when performing ECDSA signature computations. A remote\nattacker could possibly use this issue to recover private data.\n(CVE-2024-13176)\n\nIt was discovered that OpenSSL incorrectly handled certain memory\noperations when using low-level GF(2^m) elliptic curve APIs with untrusted\nexplicit values for the field polynomial. When being used in this uncommon\nfashion, a remote attacker could use this issue to cause OpenSSL to crash,\nresulting in a denial of service, or possibly execute arbitrary code.\n(CVE-2024-9143)","dates":{"published":"2025-02-11T16:09:22.533Z","modified":"2026-02-04T03:23:15.728Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":null,"severity":"unknown","version":null,"versionLabel":null,"source":null,"vector":null,"computed":false,"selection":"none"},"metrics":[]},"epss":{"probability":null,"percentile":null,"severity":"unknown","asOf":null,"change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[],"last30":[]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[],"affected":[{"vendor":"ubuntu","product":"openssl","name":"openssl","label":"openssl","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/openssl","purlType":"deb","versions":[{"text":"< 3.3.1-2ubuntu2.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.3.1-2ubuntu2.1","eol":null,"hubHref":null}],"affectedCount":1,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://ubuntu.com/security/notices/USN-7264-1","label":"ubuntu.com/security/notices/USN-7264-1","hostname":"ubuntu.com","tags":["Advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-9143","label":"ubuntu.com/security/CVE-2024-9143","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2024-12797","label":"ubuntu.com/security/CVE-2024-12797","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2024-13176","label":"ubuntu.com/security/CVE-2024-13176","hostname":"ubuntu.com","tags":["REPORT"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":["CVE-2024-12797","CVE-2024-13176","CVE-2024-9143"]},"timeline":[{"kind":"published","date":"2025-02-11T16:09:22.533Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-02-04T03:23:15.728Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":0,"level":"minimal","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-21T21:14:47.369Z","stale":false,"partial":false}}