{"kind": "product", "path": "vulns/alpine-v3.15/openssl3", "name": "openssl3", "product": "openssl3", "ecosystem": "Alpine:v3.15", "items": [{"id": "ALPINE-CVE-2023-3817", "noindex": false, "published": "2023-07-31T16:15:10.497Z", "modified": "2026-10-23T17:17:56.735407627Z", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "severity": "medium", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/alpine-cve-2023-3817", "title": "ALPINE-CVE-2023-3817", "description": "Issue summary: Checking excessively long DH keys or parameters may be very slow.\n\nImpact summary: Applications that use the functions DH_check(), DH_check_ex()\nor EVP_PKEY_param_check() to check a DH key or DH parameters may experience long\ndelays. Where the key or parameters that are being checked have been obtained\nfrom an untrusted source this may lead to a Denial of Service.\n\nThe function DH_check() performs various checks on DH parameters. After fixing\nCVE-2023-3446 it was discovered that a large q parameter value can also trigger\nan overly long computation during some of these checks. A correct q value,\nif present, cannot be larger than", "references": ["https://security.alpinelinux.org/vuln/CVE-2023-3817", "https://osv.dev/vulnerability/ALPINE-CVE-2023-3817"], "fixes": ["3.0.11-r0"], "products": [{"name": "openssl3", "path": "vulns/alpine-v3.15/openssl3", "ecosystem": "Alpine:v3.15"}]}, {"id": "ALPINE-CVE-2023-3446", "noindex": false, "published": "2023-07-19T12:15:10.003Z", "modified": "2026-10-23T17:17:56.733972651Z", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "severity": "medium", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/alpine-cve-2023-3446", "title": "ALPINE-CVE-2023-3446", "description": "Issue summary: Checking excessively long DH keys or parameters may be very slow.\n\nImpact summary: Applications that use the functions DH_check(), DH_check_ex()\nor EVP_PKEY_param_check() to check a DH key or DH parameters may experience long\ndelays. Where the key or parameters that are being checked have been obtained\nfrom an untrusted source this may lead to a Denial of Service.\n\nThe function DH_check() performs various checks on DH parameters. One of those\nchecks confirms that the modulus ('p' parameter) is not too large. Trying to use\na very large modulus is slow and OpenSSL will not normally use a modulus which\nis over 10,000 bits in lengt", "references": ["https://security.alpinelinux.org/vuln/CVE-2023-3446", "https://osv.dev/vulnerability/ALPINE-CVE-2023-3446"], "fixes": ["3.0.9-r2"], "products": [{"name": "openssl3", "path": "vulns/alpine-v3.15/openssl3", "ecosystem": "Alpine:v3.15"}]}, {"id": "ALPINE-CVE-2023-2975", "noindex": false, "published": "2023-07-14T12:15:09.023Z", "modified": "2026-10-23T17:17:56.730314759Z", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "severity": "medium", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/alpine-cve-2023-2975", "title": "ALPINE-CVE-2023-2975", "description": "Issue summary: The AES-SIV cipher implementation contains a bug that causes\nit to ignore empty associated data entries which are unauthenticated as\na consequence.\n\nImpact summary: Applications that use the AES-SIV algorithm and want to\nauthenticate empty data entries as associated data can be misled by removing,\nadding or reordering such empty entries as these are ignored by the OpenSSL\nimplementation. We are currently unaware of any such applications.\n\nThe AES-SIV algorithm allows for authentication of multiple associated\ndata entries along with the encryption. To authenticate empty data the\napplication has to call EVP_EncryptUpdate() (or EV", "references": ["https://security.alpinelinux.org/vuln/CVE-2023-2975", "https://osv.dev/vulnerability/ALPINE-CVE-2023-2975"], "fixes": ["3.0.9-r1"], "products": [{"name": "openssl3", "path": "vulns/alpine-v3.15/openssl3", "ecosystem": "Alpine:v3.15"}]}, {"id": "ALPINE-CVE-2023-2650", "noindex": false, "published": "2023-05-30T14:15:09.683Z", "modified": "2026-10-23T17:17:56.723501776Z", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "severity": "medium", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/alpine-cve-2023-2650", "title": "ALPINE-CVE-2023-2650", "description": "Issue summary: Processing some specially crafted ASN.1 object identifiers or\ndata containing them may be very slow.\n\nImpact summary: Applications that use OBJ_obj2txt() directly, or use any of\nthe OpenSSL subsystems OCSP, PKCS7/SMIME, CMS, CMP/CRMF or TS with no message\nsize limit may experience notable to very long delays when processing those\nmessages, which may lead to a Denial of Service.\n\nAn OBJECT IDENTIFIER is composed of a series of numbers - sub-identifiers -\nmost of which have no size limit.  OBJ_obj2txt() may be used to translate\nan ASN.1 OBJECT IDENTIFIER given in DER encoding form (using the OpenSSL\ntype ASN1_OBJECT) to its canon", "references": ["https://security.alpinelinux.org/vuln/CVE-2023-2650", "https://osv.dev/vulnerability/ALPINE-CVE-2023-2650"], "fixes": ["3.0.9-r0"], "products": [{"name": "openssl3", "path": "vulns/alpine-v3.15/openssl3", "ecosystem": "Alpine:v3.15"}]}, {"id": "ALPINE-CVE-2023-1255", "noindex": false, "published": "2023-04-20T17:15:06.883Z", "modified": "2026-10-23T17:17:56.714841176Z", "cvss": 5.9, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "medium", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/alpine-cve-2023-1255", "title": "ALPINE-CVE-2023-1255", "description": "Issue summary: The AES-XTS cipher decryption implementation for 64 bit ARM\nplatform contains a bug that could cause it to read past the input buffer,\nleading to a crash.\n\nImpact summary: Applications that use the AES-XTS algorithm on the 64 bit ARM\nplatform can crash in rare circumstances. The AES-XTS algorithm is usually\nused for disk encryption.\n\nThe AES-XTS cipher decryption implementation for 64 bit ARM platform will read\npast the end of the ciphertext buffer if the ciphertext size is 4 mod 5 in 16\nbyte blocks, e.g. 144 bytes or 1024 bytes. If the memory after the ciphertext\nbuffer is unmapped, this will trigger a crash which results in a", "references": ["https://security.alpinelinux.org/vuln/CVE-2023-1255", "https://osv.dev/vulnerability/ALPINE-CVE-2023-1255"], "fixes": ["3.0.8-r3"], "products": [{"name": "openssl3", "path": "vulns/alpine-v3.15/openssl3", "ecosystem": "Alpine:v3.15"}]}, {"id": "ALPINE-CVE-2023-0465", "noindex": false, "published": "2023-03-28T15:15:06.820Z", "modified": "2026-10-23T17:17:56.689725082Z", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "severity": "medium", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/alpine-cve-2023-0465", "title": "ALPINE-CVE-2023-0465", "description": "Applications that use a non-default option when verifying certificates may be\nvulnerable to an attack from a malicious CA to circumvent certain checks.\n\nInvalid certificate policies in leaf certificates are silently ignored by\nOpenSSL and other certificate policy checks are skipped for that certificate.\nA malicious CA could use this to deliberately assert invalid certificate policies\nin order to circumvent policy checking on the certificate altogether.\n\nPolicy processing is disabled by default but can be enabled by passing\nthe `-policy' argument to the command line utilities or by calling the\n`X509_VERIFY_PARAM_set1_policies()' function.", "references": ["https://security.alpinelinux.org/vuln/CVE-2023-0465", "https://osv.dev/vulnerability/ALPINE-CVE-2023-0465"], "fixes": ["3.0.8-r2"], "products": [{"name": "openssl3", "path": "vulns/alpine-v3.15/openssl3", "ecosystem": "Alpine:v3.15"}]}, {"id": "ALPINE-CVE-2023-0464", "noindex": false, "published": "2023-03-22T17:15:13.130Z", "modified": "2026-10-23T17:17:56.688684472Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "high", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/alpine-cve-2023-0464", "title": "ALPINE-CVE-2023-0464", "description": "A security vulnerability has been identified in all supported versions\n\nof OpenSSL related to the verification of X.509 certificate chains\nthat include policy constraints.  Attackers may be able to exploit this\nvulnerability by creating a malicious certificate chain that triggers\nexponential use of computational resources, leading to a denial-of-service\n(DoS) attack on affected systems.\n\nPolicy processing is disabled by default but can be enabled by passing\nthe `-policy' argument to the command line utilities or by calling the\n`X509_VERIFY_PARAM_set1_policies()' function.", "references": ["https://security.alpinelinux.org/vuln/CVE-2023-0464", "https://osv.dev/vulnerability/ALPINE-CVE-2023-0464"], "fixes": ["3.0.8-r1"], "products": [{"name": "openssl3", "path": "vulns/alpine-v3.15/openssl3", "ecosystem": "Alpine:v3.15"}]}, {"id": "ALPINE-CVE-2022-4203", "noindex": false, "published": "2023-02-24T15:15:11.980Z", "modified": "2026-10-15T07:17:54.256868166Z", "cvss": 4.9, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", "severity": "medium", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/alpine-cve-2022-4203", "title": "ALPINE-CVE-2022-4203", "description": "A read buffer overrun can be triggered in X.509 certificate verification,\nspecifically in name constraint checking. Note that this occurs\nafter certificate chain signature verification and requires either a\nCA to have signed the malicious certificate or for the application to\ncontinue certificate verification despite failure to construct a path\nto a trusted issuer.\n\nThe read buffer overrun might result in a crash which could lead to\na denial of service attack. In theory it could also result in the disclosure\nof private memory contents (such as private keys, or sensitive plaintext)\nalthough we are not aware of any working exploit leading to me", "references": ["https://security.alpinelinux.org/vuln/CVE-2022-4203", "https://osv.dev/vulnerability/ALPINE-CVE-2022-4203"], "fixes": ["3.0.8-r0"], "products": [{"name": "openssl3", "path": "vulns/alpine-v3.15/openssl3", "ecosystem": "Alpine:v3.15"}]}, {"id": "ALPINE-CVE-2023-0401", "noindex": false, "published": "2023-02-08T20:15:24.323Z", "modified": "2026-10-23T17:17:56.686881773Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "high", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/alpine-cve-2023-0401", "title": "ALPINE-CVE-2023-0401", "description": "A NULL pointer can be dereferenced when signatures are being\nverified on PKCS7 signed or signedAndEnveloped data. In case the hash\nalgorithm used for the signature is known to the OpenSSL library but\nthe implementation of the hash algorithm is not available the digest\ninitialization will fail. There is a missing check for the return\nvalue from the initialization function which later leads to invalid\nusage of the digest API most likely leading to a crash.\n\nThe unavailability of an algorithm can be caused by using FIPS\nenabled configuration of providers or more commonly by not loading\nthe legacy provider.\n\nPKCS7 data is processed by the SMIME l", "references": ["https://security.alpinelinux.org/vuln/CVE-2023-0401", "https://osv.dev/vulnerability/ALPINE-CVE-2023-0401"], "fixes": ["3.0.8-r0"], "products": [{"name": "openssl3", "path": "vulns/alpine-v3.15/openssl3", "ecosystem": "Alpine:v3.15"}]}, {"id": "ALPINE-CVE-2023-0286", "noindex": false, "published": "2023-02-08T20:15:24.267Z", "modified": "2026-10-23T17:17:56.684062548Z", "cvss": 7.4, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H", "severity": "high", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/alpine-cve-2023-0286", "title": "ALPINE-CVE-2023-0286", "description": "There is a type confusion vulnerability relating to X.400 address processing\ninside an X.509 GeneralName. X.400 addresses were parsed as an ASN1_STRING but\nthe public structure definition for GENERAL_NAME incorrectly specified the type\nof the x400Address field as ASN1_TYPE. This field is subsequently interpreted by\nthe OpenSSL function GENERAL_NAME_cmp as an ASN1_TYPE rather than an\nASN1_STRING.\n\nWhen CRL checking is enabled (i.e. the application sets the\nX509_V_FLAG_CRL_CHECK flag), this vulnerability may allow an attacker to pass\narbitrary pointers to a memcmp call, enabling them to read memory contents or\nenact a denial of service. In most", "references": ["https://security.alpinelinux.org/vuln/CVE-2023-0286", "https://osv.dev/vulnerability/ALPINE-CVE-2023-0286"], "fixes": ["3.0.8-r0"], "products": [{"name": "openssl3", "path": "vulns/alpine-v3.15/openssl3", "ecosystem": "Alpine:v3.15"}]}, {"id": "ALPINE-CVE-2023-0217", "noindex": false, "published": "2023-02-08T20:15:24.213Z", "modified": "2026-10-23T17:17:56.683767693Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "high", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/alpine-cve-2023-0217", "title": "ALPINE-CVE-2023-0217", "description": "An invalid pointer dereference on read can be triggered when an\napplication tries to check a malformed DSA public key by the\nEVP_PKEY_public_check() function. This will most likely lead\nto an application crash. This function can be called on public\nkeys supplied from untrusted sources which could allow an attacker\nto cause a denial of service attack.\n\nThe TLS implementation in OpenSSL does not call this function\nbut applications might call the function if there are additional\nsecurity requirements imposed by standards such as FIPS 140-3.", "references": ["https://security.alpinelinux.org/vuln/CVE-2023-0217", "https://osv.dev/vulnerability/ALPINE-CVE-2023-0217"], "fixes": ["3.0.8-r0"], "products": [{"name": "openssl3", "path": "vulns/alpine-v3.15/openssl3", "ecosystem": "Alpine:v3.15"}]}, {"id": "ALPINE-CVE-2023-0216", "noindex": false, "published": "2023-02-08T20:15:24.160Z", "modified": "2026-10-23T17:17:56.682799616Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "high", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/alpine-cve-2023-0216", "title": "ALPINE-CVE-2023-0216", "description": "An invalid pointer dereference on read can be triggered when an\napplication tries to load malformed PKCS7 data with the\nd2i_PKCS7(), d2i_PKCS7_bio() or d2i_PKCS7_fp() functions.\n\nThe result of the dereference is an application crash which could\nlead to a denial of service attack. The TLS implementation in OpenSSL\ndoes not call this function however third party applications might\ncall these functions on untrusted data.", "references": ["https://security.alpinelinux.org/vuln/CVE-2023-0216", "https://osv.dev/vulnerability/ALPINE-CVE-2023-0216"], "fixes": ["3.0.8-r0"], "products": [{"name": "openssl3", "path": "vulns/alpine-v3.15/openssl3", "ecosystem": "Alpine:v3.15"}]}, {"id": "ALPINE-CVE-2023-0215", "noindex": false, "published": "2023-02-08T20:15:24.107Z", "modified": "2026-10-23T17:17:56.682676963Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "high", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/alpine-cve-2023-0215", "title": "ALPINE-CVE-2023-0215", "description": "The public API function BIO_new_NDEF is a helper function used for streaming\nASN.1 data via a BIO. It is primarily used internally to OpenSSL to support the\nSMIME, CMS and PKCS7 streaming capabilities, but may also be called directly by\nend user applications.\n\nThe function receives a BIO from the caller, prepends a new BIO_f_asn1 filter\nBIO onto the front of it to form a BIO chain, and then returns the new head of\nthe BIO chain to the caller. Under certain conditions, for example if a CMS\nrecipient public key is invalid, the new filter BIO is freed and the function\nreturns a NULL result indicating a failure. However, in this case, the BIO cha", "references": ["https://security.alpinelinux.org/vuln/CVE-2023-0215", "https://osv.dev/vulnerability/ALPINE-CVE-2023-0215"], "fixes": ["3.0.8-r0"], "products": [{"name": "openssl3", "path": "vulns/alpine-v3.15/openssl3", "ecosystem": "Alpine:v3.15"}]}, {"id": "ALPINE-CVE-2022-4450", "noindex": false, "published": "2023-02-08T20:15:23.973Z", "modified": "2026-10-15T07:17:54.273142116Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "high", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/alpine-cve-2022-4450", "title": "ALPINE-CVE-2022-4450", "description": "The function PEM_read_bio_ex() reads a PEM file from a BIO and parses and\ndecodes the \"name\" (e.g. \"CERTIFICATE\"), any header data and the payload data.\nIf the function succeeds then the \"name_out\", \"header\" and \"data\" arguments are\npopulated with pointers to buffers containing the relevant decoded data. The\ncaller is responsible for freeing those buffers. It is possible to construct a\nPEM file that results in 0 bytes of payload data. In this case PEM_read_bio_ex()\nwill return a failure code but will populate the header argument with a pointer\nto a buffer that has already been freed. If the caller also frees this buffer\nthen a double free wil", "references": ["https://security.alpinelinux.org/vuln/CVE-2022-4450", "https://osv.dev/vulnerability/ALPINE-CVE-2022-4450"], "fixes": ["3.0.8-r0"], "products": [{"name": "openssl3", "path": "vulns/alpine-v3.15/openssl3", "ecosystem": "Alpine:v3.15"}]}, {"id": "ALPINE-CVE-2022-4304", "noindex": false, "published": "2023-02-08T20:15:23.887Z", "modified": "2026-10-15T07:17:54.268586460Z", "cvss": 5.9, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "severity": "medium", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/alpine-cve-2022-4304", "title": "ALPINE-CVE-2022-4304", "description": "A timing based side channel exists in the OpenSSL RSA Decryption implementation\nwhich could be sufficient to recover a plaintext across a network in a\nBleichenbacher style attack. To achieve a successful decryption an attacker\nwould have to be able to send a very large number of trial messages for\ndecryption. The vulnerability affects all RSA padding modes: PKCS#1 v1.5,\nRSA-OEAP and RSASVE.\n\nFor example, in a TLS connection, RSA is commonly used by a client to send an\nencrypted pre-master secret to the server. An attacker that had observed a\ngenuine connection between a client and a server could use this flaw to send\ntrial messages to the ser", "references": ["https://security.alpinelinux.org/vuln/CVE-2022-4304", "https://osv.dev/vulnerability/ALPINE-CVE-2022-4304"], "fixes": ["3.0.8-r0"], "products": [{"name": "openssl3", "path": "vulns/alpine-v3.15/openssl3", "ecosystem": "Alpine:v3.15"}]}, {"id": "ALPINE-CVE-2022-3996", "noindex": false, "published": "2022-12-13T16:15:22.007Z", "modified": "2026-10-15T07:17:54.246930942Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "high", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/alpine-cve-2022-3996", "title": "ALPINE-CVE-2022-3996", "description": "If an X.509 certificate contains a malformed policy constraint and\npolicy processing is enabled, then a write lock will be taken twice\nrecursively.  On some operating systems (most widely: Windows) this\nresults in a denial of service when the affected process hangs.  Policy\nprocessing being enabled on a publicly facing server is not considered\nto be a common setup.\n\nPolicy processing is enabled by passing the `-policy'\nargument to the command line utilities or by calling the\n`X509_VERIFY_PARAM_set1_policies()' function.\n\nUpdate (31 March 2023): The description of the policy processing enablement\nwas corrected based on CVE-2023-0466.", "references": ["https://security.alpinelinux.org/vuln/CVE-2022-3996", "https://osv.dev/vulnerability/ALPINE-CVE-2022-3996"], "fixes": ["3.0.8-r0"], "products": [{"name": "openssl3", "path": "vulns/alpine-v3.15/openssl3", "ecosystem": "Alpine:v3.15"}]}, {"id": "ALPINE-CVE-2022-3786", "noindex": false, "published": "2022-11-01T18:15:11.047Z", "modified": "2026-10-15T07:17:54.243006495Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "high", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/alpine-cve-2022-3786", "title": "ALPINE-CVE-2022-3786", "description": "A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after certificate chain signature verification and requires either a CA to have signed a malicious certificate or for an application to continue certificate verification despite failure to construct a path to a trusted issuer. An attacker can craft a malicious email address in a certificate to overflow an arbitrary number of bytes containing the `.' character (decimal 46) on the stack. This buffer overflow could result in a crash (causing a denial of service). In a TLS client, this can be triggered by connecting", "references": ["https://security.alpinelinux.org/vuln/CVE-2022-3786", "https://osv.dev/vulnerability/ALPINE-CVE-2022-3786"], "fixes": ["3.0.7-r0"], "products": [{"name": "openssl3", "path": "vulns/alpine-v3.15/openssl3", "ecosystem": "Alpine:v3.15"}]}, {"id": "ALPINE-CVE-2022-3602", "noindex": false, "published": "2022-11-01T18:15:10.983Z", "modified": "2026-10-15T07:17:54.238371008Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "high", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/alpine-cve-2022-3602", "title": "ALPINE-CVE-2022-3602", "description": "A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after certificate chain signature verification and requires either a CA to have signed the malicious certificate or for the application to continue certificate verification despite failure to construct a path to a trusted issuer. An attacker can craft a malicious email address to overflow four attacker-controlled bytes on the stack. This buffer overflow could result in a crash (causing a denial of service) or potentially remote code execution. Many platforms implement stack overflow protections which would mitig", "references": ["https://security.alpinelinux.org/vuln/CVE-2022-3602", "https://osv.dev/vulnerability/ALPINE-CVE-2022-3602"], "fixes": ["3.0.7-r0"], "products": [{"name": "openssl3", "path": "vulns/alpine-v3.15/openssl3", "ecosystem": "Alpine:v3.15"}]}, {"id": "ALPINE-CVE-2022-3358", "noindex": false, "published": "2022-10-11T15:15:10.233Z", "modified": "2026-10-15T07:17:54.224981725Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "severity": "high", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/alpine-cve-2022-3358", "title": "ALPINE-CVE-2022-3358", "description": "OpenSSL supports creating a custom cipher via the legacy EVP_CIPHER_meth_new() function and associated function calls. This function was deprecated in OpenSSL 3.0 and application authors are instead encouraged to use the new provider mechanism in order to implement custom ciphers. OpenSSL versions 3.0.0 to 3.0.5 incorrectly handle legacy custom ciphers passed to the EVP_EncryptInit_ex2(), EVP_DecryptInit_ex2() and EVP_CipherInit_ex2() functions (as well as other similarly named encryption and decryption initialisation functions). Instead of using the custom cipher directly it incorrectly tries to fetch an equivalent cipher from the available ", "references": ["https://security.alpinelinux.org/vuln/CVE-2022-3358", "https://osv.dev/vulnerability/ALPINE-CVE-2022-3358"], "fixes": ["3.0.6-r0"], "products": [{"name": "openssl3", "path": "vulns/alpine-v3.15/openssl3", "ecosystem": "Alpine:v3.15"}]}, {"id": "ALPINE-CVE-2022-2097", "noindex": false, "published": "2022-07-05T11:15:08.340Z", "modified": "2026-10-15T07:17:54.157325058Z", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "severity": "medium", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/alpine-cve-2022-2097", "title": "ALPINE-CVE-2022-2097", "description": "AES OCB mode for 32-bit x86 platforms using the AES-NI assembly optimised implementation will not encrypt the entirety of the data under some circumstances. This could reveal sixteen bytes of data that was preexisting in the memory that wasn't written. In the special case of \"in place\" encryption, sixteen bytes of the plaintext would be revealed. Since OpenSSL does not support OCB based cipher suites for TLS and DTLS, they are both unaffected. Fixed in OpenSSL 3.0.5 (Affected 3.0.0-3.0.4). Fixed in OpenSSL 1.1.1q (Affected 1.1.1-1.1.1p).", "references": ["https://security.alpinelinux.org/vuln/CVE-2022-2097", "https://osv.dev/vulnerability/ALPINE-CVE-2022-2097"], "fixes": ["3.0.5-r0"], "products": [{"name": "openssl3", "path": "vulns/alpine-v3.15/openssl3", "ecosystem": "Alpine:v3.15"}]}], "total": 41, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 3, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "openssl3", "path": "vulns/alpine-v3.15/openssl3", "ecosystem": "Alpine:v3.15"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": [], "stats": {"recent": 0, "kev": 0}, "lastmod": "2026-10-23T17:17:56.735407627Z", "early_advisories": [], "license": "Sie dürfen die Auswahl von PatchFirst und unsere Ergänzungen (Prioritäten, Frühwarnungen, Texte, Zusammenfassungen und Aggregate) für eigene Zwecke einschließlich interner geschäftlicher Aufgaben frei nutzen. Weiterverkauf, kommerzielle Verbreitung und massenhafte Spiegelung dieser Auswahl oder Ergänzungen erfordern eine schriftliche Vereinbarung mit dem Betreiber. Nennen Sie bei jeder Nutzung oder Veröffentlichung der Auswahl oder unserer Ergänzungen PatchFirst (https://patchfirst.dev/vulns/) mit diesem Link zur Feedseite Ihrer Region als Quelle. Originaleinträge aus offenen Quellen unterliegen weiterhin ihren jeweiligen Lizenzen und Bedingungen. Diese Bedingungen beschränken Ihre Rechte an den Originaldaten nicht, die Sie direkt bei den Quellen beziehen können.", "terms_url": "https://patchfirst.dev/de/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://patchfirst.dev/vulns/"}, "source_changes": "PatchFirst wählt Einträge aus, normalisiert und kombiniert sie; Zusammenfassungen und Übersetzungen können hinzukommen. Nachrichten werden im jeweiligen Eintrag mit einem Link zur Originalquelle belegt.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Die Lizenzen der Ursprungsdatenbanken unterscheiden sich; siehe Quellenkatalog."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Frei zugängliche Bewertungen; Quellenangabe erbeten (FIRST EPSS, Bewertungen von Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}