OpenSSL vulnerabilities
Filtered catalog for this technology stack. Use KEV and EPSS sorting to prioritize — then open each CVE for remediation and version matching.
116 matching records
- Medium5.3The function verifies the signer certificate on an OCSP response.Check if you run itEPSS 2.14%May 3, 2022
- High7.3The c_rehash script does not properly sanitise shell metacharacters to prevent command injection.Check this weekEPSS 82.61%May 3, 2022
- High7.5The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli.Check this weekEPSS 73.19%Mar 15, 2022
- Unknownapache2 CVE-2019-0190Patch nowKEVEPSS 59.05%Feb 22, 2022
- UnknownArbitrary code execution in desktop client via OpenSSL configCheck if you run itEPSS 0.66%Jul 10, 2020
- Medium5.9The OpenSSL RSA Key generation algorithm has been shown to be vulnerable to a cache timing side channel attack.Check this weekEPSS 11.60%Apr 16, 2018
- High7.5A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL protocol defined processing of ALERT packets during…Check this weekEPSS 39.66%Nov 13, 2017
- Medium4.3The ssl3_get_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k allows remote SSL servers to conduct RSA-to-EXPORT_RSA downgPatch nowKEVEPSS 98.69%Jan 9, 2015
- High7.5OpenSSL Information Disclosure VulnerabilityPatch nowKEVEPSS 100.00%Apr 7, 2014
- Critical9.1OpenSSL before 0.9.7, 0.9.7 before 0.9.7k, and 0.9.8 before 0.9.8c, when using an RSA key with exponent 3, removes PKCS-1 padding before generating a hash, which allows remote attaCheck if you run itEPSS 3.95%Sep 5, 2006
- High7.5The default configuration on OpenSSL before 0.9.8 uses MD5 for creating message digests instead of a more cryptographically strong algorithm, which makes it easier for remote attacCheck if you run itEPSS 0.84%Sep 16, 2005
- UnknownThe do_change_cipher_spec function in OpenSSL 0.9.6c to 0.9.6k, and 0.9.7a to 0.9.7c, allows remote attackers to cause a denial of service (crash) via a crafted SSL/TLS handshake tCheck if you run itEPSS 9.54%Nov 23, 2004
- Medium5.0The ASN1 library in OpenSSL 0.9.6d and earlier, and 0.9.7-beta2 and earlier, allows remote attackers to cause a denial of service via invalid encodings.Check this weekEPSS 36.20%Aug 12, 2002
- High7.5Buffer overflows in OpenSSL 0.9.6d and earlier, and 0.9.7-beta2 and earlier, allow remote attackers to execute arbitrary code via (1) a large client master key in SSL2…Check this weekEPSS 89.82%Aug 12, 2002
- High7.5OpenSSL 0.9.6d and earlier, and 0.9.7-beta2 and earlier, does not properly handle ASCII representations of integers on 64 bit platforms, which could allow attackers to…Check if you run itEPSS 8.17%Aug 12, 2002
- UnknownCVE-2026-84783 is named on the public Monitored product advisories page.Check if you run itEPSS 0.29%Unknown date