Description crypto/bn/bn_nist.c in OpenSSL before 0.9.8h on 32-bit platforms, as used in stunnel and other products, in certain circumstances involving ECDH or ECDHE cipher suites, uses an incorrect modular reduction algorithm in its implementation of the P-256 and P-384 NIST elliptic curves, which allows remote attackers to obtain the private key of a TLS server via multiple handshake attempts.
Metrics CVSS Version 4.0 CVSS Version 3.x CVSS Version 2.0 SSVC
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No CVSS 3.x data is available for this CVE.
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration Affected Products Product Versions openssl openssl <= 0.9.8g
0.9.1c
0.9.2b
0.9.3
0.9.3a
0.9.4
0.9.5
0.9.5 beta1
0.9.5 beta2
0.9.5a
0.9.5a beta1
0.9.5a beta2
0.9.6
0.9.6 beta1
0.9.6 beta2
0.9.6 beta3
0.9.6a
0.9.6a beta1
0.9.6a beta2
0.9.6a beta3
0.9.6b
0.9.6c
0.9.6d
0.9.6e
0.9.6f
0.9.6g
0.9.6h
0.9.6i
0.9.6j
0.9.6k
0.9.6l
0.9.6m
0.9.7
0.9.7 beta1
0.9.7 beta2
0.9.7 beta3
0.9.7 beta4
0.9.7 beta5
0.9.7 beta6
0.9.7a
0.9.7b
0.9.7c
0.9.7d
0.9.7e
0.9.7f
0.9.7g
0.9.7h
0.9.7i
0.9.7j
0.9.7k
0.9.7l
0.9.7m
0.9.8
0.9.8a
0.9.8b
0.9.8c
0.9.8d
0.9.8e
0.9.8f
Viewing 5 of 59 versions. View all CPE cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:x86:* cpe:2.3:a:openssl:openssl:0.9.1c:*:*:*:*:*:x86:* cpe:2.3:a:openssl:openssl:0.9.2b:*:*:*:*:*:x86:* cpe:2.3:a:openssl:openssl:0.9.3:*:*:*:*:*:x86:* cpe:2.3:a:openssl:openssl:0.9.3a:*:*:*:*:*:x86:* cpe:2.3:a:openssl:openssl:0.9.4:*:*:*:*:*:x86:* cpe:2.3:a:openssl:openssl:0.9.5:*:*:*:*:*:x86:* cpe:2.3:a:openssl:openssl:0.9.5:beta1:*:*:*:*:x86:* cpe:2.3:a:openssl:openssl:0.9.5:beta2:*:*:*:*:x86:* cpe:2.3:a:openssl:openssl:0.9.5a:*:*:*:*:*:x86:* cpe:2.3:a:openssl:openssl:0.9.5a:beta1:*:*:*:*:x86:* cpe:2.3:a:openssl:openssl:0.9.5a:beta2:*:*:*:*:x86:* cpe:2.3:a:openssl:openssl:0.9.6:*:*:*:*:*:x86:* cpe:2.3:a:openssl:openssl:0.9.6:beta1:*:*:*:*:x86:* cpe:2.3:a:openssl:openssl:0.9.6:beta2:*:*:*:*:x86:* cpe:2.3:a:openssl:openssl:0.9.6:beta3:*:*:*:*:x86:* cpe:2.3:a:openssl:openssl:0.9.6a:*:*:*:*:*:x86:* cpe:2.3:a:openssl:openssl:0.9.6a:beta1:*:*:*:*:x86:* cpe:2.3:a:openssl:openssl:0.9.6a:beta2:*:*:*:*:x86:* cpe:2.3:a:openssl:openssl:0.9.6a:beta3:*:*:*:*:x86:* cpe:2.3:a:openssl:openssl:0.9.6b:*:*:*:*:*:x86:* cpe:2.3:a:openssl:openssl:0.9.6c:*:*:*:*:*:x86:* cpe:2.3:a:openssl:openssl:0.9.6d:*:*:*:*:*:x86:* cpe:2.3:a:openssl:openssl:0.9.6e:*:*:*:*:*:x86:* cpe:2.3:a:openssl:openssl:0.9.6f:*:*:*:*:*:x86:* cpe:2.3:a:openssl:openssl:0.9.6g:*:*:*:*:*:x86:* cpe:2.3:a:openssl:openssl:0.9.6h:*:*:*:*:*:x86:* cpe:2.3:a:openssl:openssl:0.9.6i:*:*:*:*:*:x86:* cpe:2.3:a:openssl:openssl:0.9.6j:*:*:*:*:*:x86:* cpe:2.3:a:openssl:openssl:0.9.6k:*:*:*:*:*:x86:* cpe:2.3:a:openssl:openssl:0.9.6l:*:*:*:*:*:x86:* cpe:2.3:a:openssl:openssl:0.9.6m:*:*:*:*:*:x86:* cpe:2.3:a:openssl:openssl:0.9.7:*:*:*:*:*:x86:* cpe:2.3:a:openssl:openssl:0.9.7:beta1:*:*:*:*:x86:* cpe:2.3:a:openssl:openssl:0.9.7:beta2:*:*:*:*:x86:* cpe:2.3:a:openssl:openssl:0.9.7:beta3:*:*:*:*:x86:* cpe:2.3:a:openssl:openssl:0.9.7:beta4:*:*:*:*:x86:* cpe:2.3:a:openssl:openssl:0.9.7:beta5:*:*:*:*:x86:* cpe:2.3:a:openssl:openssl:0.9.7:beta6:*:*:*:*:x86:* cpe:2.3:a:openssl:openssl:0.9.7a:*:*:*:*:*:x86:* cpe:2.3:a:openssl:openssl:0.9.7b:*:*:*:*:*:x86:* cpe:2.3:a:openssl:openssl:0.9.7c:*:*:*:*:*:x86:* cpe:2.3:a:openssl:openssl:0.9.7d:*:*:*:*:*:x86:* cpe:2.3:a:openssl:openssl:0.9.7e:*:*:*:*:*:x86:* cpe:2.3:a:openssl:openssl:0.9.7f:*:*:*:*:*:x86:* cpe:2.3:a:openssl:openssl:0.9.7g:*:*:*:*:*:x86:* cpe:2.3:a:openssl:openssl:0.9.7h:*:*:*:*:*:x86:* cpe:2.3:a:openssl:openssl:0.9.7i:*:*:*:*:*:x86:* cpe:2.3:a:openssl:openssl:0.9.7j:*:*:*:*:*:x86:* cpe:2.3:a:openssl:openssl:0.9.7k:*:*:*:*:*:x86:* cpe:2.3:a:openssl:openssl:0.9.7l:*:*:*:*:*:x86:* cpe:2.3:a:openssl:openssl:0.9.7m:*:*:*:*:*:x86:* cpe:2.3:a:openssl:openssl:0.9.8:*:*:*:*:*:x86:* cpe:2.3:a:openssl:openssl:0.9.8a:*:*:*:*:*:x86:* cpe:2.3:a:openssl:openssl:0.9.8b:*:*:*:*:*:x86:* cpe:2.3:a:openssl:openssl:0.9.8c:*:*:*:*:*:x86:* cpe:2.3:a:openssl:openssl:0.9.8d:*:*:*:*:*:x86:* cpe:2.3:a:openssl:openssl:0.9.8e:*:*:*:*:*:x86:* cpe:2.3:a:openssl:openssl:0.9.8f:*:*:*:*:*:x86:* Remediation No remediation found in references.
Change History 5 change records found show changes