{"kind": "product", "path": "vulns/alpine-v3.19/openssl", "name": "openssl", "product": "openssl", "ecosystem": "Alpine:v3.19", "items": [{"id": "ALPINE-CVE-2025-9232", "noindex": false, "published": "2025-09-30T14:15:41.313Z", "modified": "2026-08-27T22:18:03.072941456Z", "cvss": 5.9, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "medium", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}], "path": "vulns/alpine-cve-2025-9232", "title": "ALPINE-CVE-2025-9232", "description": "Issue summary: An application using the OpenSSL HTTP client API functions may\ntrigger an out-of-bounds read if the 'no_proxy' environment variable is set and\nthe host portion of the authority component of the HTTP URL is an IPv6 address.\n\nImpact summary: An out-of-bounds read can trigger a crash which leads to\nDenial of Service for an application.\n\nThe OpenSSL HTTP client API functions can be used directly by applications\nbut they are also used by the OCSP client functions and CMP (Certificate\nManagement Protocol) client implementation in OpenSSL. However the URLs used\nby these implementations are unlikely to be controlled by an attacker.\n\nIn", "references": ["https://security.alpinelinux.org/vuln/CVE-2025-9232", "https://osv.dev/vulnerability/ALPINE-CVE-2025-9232"], "fixes": ["3.1.8-r1"], "products": [{"name": "openssl", "path": "vulns/alpine-v3.19/openssl", "ecosystem": "Alpine:v3.19"}]}, {"id": "ALPINE-CVE-2025-9230", "noindex": false, "published": "2025-09-30T14:15:41.050Z", "modified": "2026-08-27T22:18:03.072238375Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "high", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}], "path": "vulns/alpine-cve-2025-9230", "title": "ALPINE-CVE-2025-9230", "description": "Issue summary: An application trying to decrypt CMS messages encrypted using\npassword based encryption can trigger an out-of-bounds read and write.\n\nImpact summary: This out-of-bounds read may trigger a crash which leads to\nDenial of Service for an application. The out-of-bounds write can cause\na memory corruption which can have various consequences including\na Denial of Service or Execution of attacker-supplied code.\n\nAlthough the consequences of a successful exploit of this vulnerability\ncould be severe, the probability that the attacker would be able to\nperform it is low. Besides, password based (PWRI) encryption support in CMS\nmessages is", "references": ["https://security.alpinelinux.org/vuln/CVE-2025-9230", "https://osv.dev/vulnerability/ALPINE-CVE-2025-9230"], "fixes": ["3.1.8-r1"], "products": [{"name": "openssl", "path": "vulns/alpine-v3.19/openssl", "ecosystem": "Alpine:v3.19"}]}, {"id": "ALPINE-CVE-2024-13176", "noindex": false, "published": "2025-01-20T14:15:26.247Z", "modified": "2026-09-15T08:17:48.438722845Z", "cvss": 4.1, "cvss_vector": "CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "severity": "medium", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}], "path": "vulns/alpine-cve-2024-13176", "title": "ALPINE-CVE-2024-13176", "description": "Issue summary: A timing side-channel which could potentially allow recovering\nthe private key exists in the ECDSA signature computation.\n\nImpact summary: A timing side-channel in ECDSA signature computations\ncould allow recovering the private key by an attacker. However, measuring\nthe timing would require either local access to the signing application or\na very fast network connection with low latency.\n\nThere is a timing signal of around 300 nanoseconds when the top word of\nthe inverted ECDSA nonce value is zero. This can happen with significant\nprobability only for some of the supported elliptic curves. In particular\nthe NIST P-521 curve is ", "references": ["https://security.alpinelinux.org/vuln/CVE-2024-13176", "https://osv.dev/vulnerability/ALPINE-CVE-2024-13176"], "fixes": ["3.1.8-r0"], "products": [{"name": "openssl", "path": "vulns/alpine-v3.19/openssl", "ecosystem": "Alpine:v3.19"}]}, {"id": "ALPINE-CVE-2024-4741", "noindex": false, "published": "2024-11-13T11:15:04.480Z", "modified": "2026-09-15T08:17:48.483710190Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "high", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}], "path": "vulns/alpine-cve-2024-4741", "title": "ALPINE-CVE-2024-4741", "description": "Issue summary: Calling the OpenSSL API function SSL_free_buffers may cause\nmemory to be accessed that was previously freed in some situations\n\nImpact summary: A use after free can have a range of potential consequences such\nas the corruption of valid data, crashes or execution of arbitrary code.\nHowever, only applications that directly call the SSL_free_buffers function are\naffected by this issue. Applications that do not call this function are not\nvulnerable. Our investigations indicate that this function is rarely used by\napplications.\n\nThe SSL_free_buffers function is used to free the internal OpenSSL buffer used\nwhen processing an incomin", "references": ["https://security.alpinelinux.org/vuln/CVE-2024-4741", "https://osv.dev/vulnerability/ALPINE-CVE-2024-4741"], "fixes": ["3.1.6-r0"], "products": [{"name": "openssl", "path": "vulns/alpine-v3.19/openssl", "ecosystem": "Alpine:v3.19"}]}, {"id": "ALPINE-CVE-2024-9143", "noindex": false, "published": "2024-10-16T17:15:18.130Z", "modified": "2026-09-15T08:17:48.503435788Z", "cvss": 4.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "severity": "medium", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}], "path": "vulns/alpine-cve-2024-9143", "title": "ALPINE-CVE-2024-9143", "description": "Issue summary: Use of the low-level GF(2^m) elliptic curve APIs with untrusted\nexplicit values for the field polynomial can lead to out-of-bounds memory reads\nor writes.\n\nImpact summary: Out of bound memory writes can lead to an application crash or\neven a possibility of a remote code execution, however, in all the protocols\ninvolving Elliptic Curve Cryptography that we're aware of, either only \"named\ncurves\" are supported, or, if explicit curve parameters are supported, they\nspecify an X9.62 encoding of binary (GF(2^m)) curves that can't represent\nproblematic input values. Thus the likelihood of existence of a vulnerable\napplication is low.\n", "references": ["https://security.alpinelinux.org/vuln/CVE-2024-9143", "https://osv.dev/vulnerability/ALPINE-CVE-2024-9143"], "fixes": ["3.1.7-r1"], "products": [{"name": "openssl", "path": "vulns/alpine-v3.19/openssl", "ecosystem": "Alpine:v3.19"}]}, {"id": "ALPINE-CVE-2024-6119", "noindex": false, "published": "2024-09-03T16:15:07.177Z", "modified": "2026-09-15T08:17:48.497829189Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "high", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}], "path": "vulns/alpine-cve-2024-6119", "title": "ALPINE-CVE-2024-6119", "description": "Issue summary: Applications performing certificate name checks (e.g., TLS\nclients checking server certificates) may attempt to read an invalid memory\naddress resulting in abnormal termination of the application process.\n\nImpact summary: Abnormal termination of an application can a cause a denial of\nservice.\n\nApplications performing certificate name checks (e.g., TLS clients checking\nserver certificates) may attempt to read an invalid memory address when\ncomparing the expected name with an `otherName` subject alternative name of an\nX.509 certificate. This may result in an exception that terminates the\napplication program.\n\nNote that basic cert", "references": ["https://security.alpinelinux.org/vuln/CVE-2024-6119", "https://osv.dev/vulnerability/ALPINE-CVE-2024-6119"], "fixes": ["3.1.7-r0"], "products": [{"name": "openssl", "path": "vulns/alpine-v3.19/openssl", "ecosystem": "Alpine:v3.19"}]}, {"id": "ALPINE-CVE-2024-5535", "noindex": false, "published": "2024-06-27T11:15:24.447Z", "modified": "2026-09-15T08:17:48.494704960Z", "cvss": 9.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "severity": "critical", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}], "path": "vulns/alpine-cve-2024-5535", "title": "ALPINE-CVE-2024-5535", "description": "Issue summary: Calling the OpenSSL API function SSL_select_next_proto with an\nempty supported client protocols buffer may cause a crash or memory contents to\nbe sent to the peer.\n\nImpact summary: A buffer overread can have a range of potential consequences\nsuch as unexpected application beahviour or a crash. In particular this issue\ncould result in up to 255 bytes of arbitrary private data from memory being sent\nto the peer leading to a loss of confidentiality. However, only applications\nthat directly call the SSL_select_next_proto function with a 0 length list of\nsupported client protocols are affected by this issue. This would normally neve", "references": ["https://security.alpinelinux.org/vuln/CVE-2024-5535", "https://osv.dev/vulnerability/ALPINE-CVE-2024-5535"], "fixes": ["3.1.6-r0"], "products": [{"name": "openssl", "path": "vulns/alpine-v3.19/openssl", "ecosystem": "Alpine:v3.19"}]}, {"id": "ALPINE-CVE-2024-4603", "noindex": false, "published": "2024-05-16T16:15:10.643Z", "modified": "2026-09-15T08:17:48.481227629Z", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "severity": "medium", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}], "path": "vulns/alpine-cve-2024-4603", "title": "ALPINE-CVE-2024-4603", "description": "Issue summary: Checking excessively long DSA keys or parameters may be very\nslow.\n\nImpact summary: Applications that use the functions EVP_PKEY_param_check()\nor EVP_PKEY_public_check() to check a DSA public key or DSA parameters may\nexperience long delays. Where the key or parameters that are being checked\nhave been obtained from an untrusted source this may lead to a Denial of\nService.\n\nThe functions EVP_PKEY_param_check() or EVP_PKEY_public_check() perform\nvarious checks on DSA parameters. Some of those computations take a long time\nif the modulus (`p` parameter) is too large.\n\nTrying to use a very large modulus is slow and OpenSSL will not", "references": ["https://security.alpinelinux.org/vuln/CVE-2024-4603", "https://osv.dev/vulnerability/ALPINE-CVE-2024-4603"], "fixes": ["3.1.5-r0"], "products": [{"name": "openssl", "path": "vulns/alpine-v3.19/openssl", "ecosystem": "Alpine:v3.19"}]}, {"id": "ALPINE-CVE-2023-6237", "noindex": false, "published": "2024-04-25T07:15:45.270Z", "modified": "2026-10-23T17:17:56.820669430Z", "cvss": 5.9, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "medium", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}], "path": "vulns/alpine-cve-2023-6237", "title": "ALPINE-CVE-2023-6237", "description": "Issue summary: Checking excessively long invalid RSA public keys may take\na long time.\n\nImpact summary: Applications that use the function EVP_PKEY_public_check()\nto check RSA public keys may experience long delays. Where the key that\nis being checked has been obtained from an untrusted source this may lead\nto a Denial of Service.\n\nWhen function EVP_PKEY_public_check() is called on RSA public keys,\na computation is done to confirm that the RSA modulus, n, is composite.\nFor valid RSA keys, n is a product of two or more large primes and this\ncomputation completes quickly. However, if n is an overly large prime,\nthen this computation would take ", "references": ["https://security.alpinelinux.org/vuln/CVE-2023-6237", "https://osv.dev/vulnerability/ALPINE-CVE-2023-6237"], "fixes": ["3.1.4-r4"], "products": [{"name": "openssl", "path": "vulns/alpine-v3.19/openssl", "ecosystem": "Alpine:v3.19"}]}, {"id": "ALPINE-CVE-2024-2511", "noindex": false, "published": "2024-04-08T14:15:07.660Z", "modified": "2026-09-15T08:17:48.450036681Z", "cvss": 5.9, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "medium", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}], "path": "vulns/alpine-cve-2024-2511", "title": "ALPINE-CVE-2024-2511", "description": "Issue summary: Some non-default TLS server configurations can cause unbounded\nmemory growth when processing TLSv1.3 sessions\n\nImpact summary: An attacker may exploit certain server configurations to trigger\nunbounded memory growth that would lead to a Denial of Service\n\nThis problem can occur in TLSv1.3 if the non-default SSL_OP_NO_TICKET option is\nbeing used (but not if early_data support is also configured and the default\nanti-replay protection is in use). In this case, under certain conditions, the\nsession cache can get into an incorrect state and it will fail to flush properly\nas it fills. The session cache will continue to grow in an unb", "references": ["https://security.alpinelinux.org/vuln/CVE-2024-2511", "https://osv.dev/vulnerability/ALPINE-CVE-2024-2511"], "fixes": ["3.1.4-r6"], "products": [{"name": "openssl", "path": "vulns/alpine-v3.19/openssl", "ecosystem": "Alpine:v3.19"}]}, {"id": "ALPINE-CVE-2024-0727", "noindex": false, "published": "2024-01-26T09:15:07.637Z", "modified": "2026-09-15T08:17:48.429885468Z", "cvss": 5.5, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "severity": "medium", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}], "path": "vulns/alpine-cve-2024-0727", "title": "ALPINE-CVE-2024-0727", "description": "Issue summary: Processing a maliciously formatted PKCS12 file may lead OpenSSL\nto crash leading to a potential Denial of Service attack\n\nImpact summary: Applications loading files in the PKCS12 format from untrusted\nsources might terminate abruptly.\n\nA file in PKCS12 format can contain certificates and keys and may come from an\nuntrusted source. The PKCS12 specification allows certain fields to be NULL, but\nOpenSSL does not correctly check for this case. This can lead to a NULL pointer\ndereference that results in OpenSSL crashing. If an application processes PKCS12\nfiles from an untrusted source using the OpenSSL APIs then that application wi", "references": ["https://security.alpinelinux.org/vuln/CVE-2024-0727", "https://osv.dev/vulnerability/ALPINE-CVE-2024-0727"], "fixes": ["3.1.4-r5"], "products": [{"name": "openssl", "path": "vulns/alpine-v3.19/openssl", "ecosystem": "Alpine:v3.19"}]}, {"id": "ALPINE-CVE-2023-6129", "noindex": false, "published": "2024-01-09T17:15:12.147Z", "modified": "2026-10-23T17:17:56.820412834Z", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H", "severity": "medium", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}], "path": "vulns/alpine-cve-2023-6129", "title": "ALPINE-CVE-2023-6129", "description": "Issue summary: The POLY1305 MAC (message authentication code) implementation\ncontains a bug that might corrupt the internal state of applications running\non PowerPC CPU based platforms if the CPU provides vector instructions.\n\nImpact summary: If an attacker can influence whether the POLY1305 MAC\nalgorithm is used, the application state might be corrupted with various\napplication dependent consequences.\n\nThe POLY1305 MAC (message authentication code) implementation in OpenSSL for\nPowerPC CPUs restores the contents of vector registers in a different order\nthan they are saved. Thus the contents of some of these vector registers\nare corrupted whe", "references": ["https://security.alpinelinux.org/vuln/CVE-2023-6129", "https://osv.dev/vulnerability/ALPINE-CVE-2023-6129"], "fixes": ["3.1.4-r3"], "products": [{"name": "openssl", "path": "vulns/alpine-v3.19/openssl", "ecosystem": "Alpine:v3.19"}]}, {"id": "ALPINE-CVE-2023-5678", "noindex": false, "published": "2023-11-06T16:15:42.670Z", "modified": "2026-10-23T17:17:56.816728563Z", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "severity": "medium", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}], "path": "vulns/alpine-cve-2023-5678", "title": "ALPINE-CVE-2023-5678", "description": "Issue summary: Generating excessively long X9.42 DH keys or checking\nexcessively long X9.42 DH keys or parameters may be very slow.\n\nImpact summary: Applications that use the functions DH_generate_key() to\ngenerate an X9.42 DH key may experience long delays.  Likewise, applications\nthat use DH_check_pub_key(), DH_check_pub_key_ex() or EVP_PKEY_public_check()\nto check an X9.42 DH key or X9.42 DH parameters may experience long delays.\nWhere the key or parameters that are being checked have been obtained from\nan untrusted source this may lead to a Denial of Service.\n\nWhile DH_check() performs all the necessary checks (as of CVE-2023-3817),\nDH_ch", "references": ["https://security.alpinelinux.org/vuln/CVE-2023-5678", "https://osv.dev/vulnerability/ALPINE-CVE-2023-5678"], "fixes": ["3.1.4-r1"], "products": [{"name": "openssl", "path": "vulns/alpine-v3.19/openssl", "ecosystem": "Alpine:v3.19"}]}, {"id": "ALPINE-CVE-2023-5363", "noindex": false, "published": "2023-10-25T18:17:43.613Z", "modified": "2026-10-23T17:17:56.815774195Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "severity": "high", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}], "path": "vulns/alpine-cve-2023-5363", "title": "ALPINE-CVE-2023-5363", "description": "Issue summary: A bug has been identified in the processing of key and\ninitialisation vector (IV) lengths.  This can lead to potential truncation\nor overruns during the initialisation of some symmetric ciphers.\n\nImpact summary: A truncation in the IV can result in non-uniqueness,\nwhich could result in loss of confidentiality for some cipher modes.\n\nWhen calling EVP_EncryptInit_ex2(), EVP_DecryptInit_ex2() or\nEVP_CipherInit_ex2() the provided OSSL_PARAM array is processed after\nthe key and IV have been established.  Any alterations to the key length,\nvia the \"keylen\" parameter or the IV length, via the \"ivlen\" parameter,\nwithin the OSSL_PARAM a", "references": ["https://security.alpinelinux.org/vuln/CVE-2023-5363", "https://osv.dev/vulnerability/ALPINE-CVE-2023-5363"], "fixes": ["3.1.4-r0"], "products": [{"name": "openssl", "path": "vulns/alpine-v3.19/openssl", "ecosystem": "Alpine:v3.19"}]}, {"id": "ALPINE-CVE-2023-3817", "noindex": false, "published": "2023-07-31T16:15:10.497Z", "modified": "2026-10-23T17:17:56.735407627Z", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "severity": "medium", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}], "path": "vulns/alpine-cve-2023-3817", "title": "ALPINE-CVE-2023-3817", "description": "Issue summary: Checking excessively long DH keys or parameters may be very slow.\n\nImpact summary: Applications that use the functions DH_check(), DH_check_ex()\nor EVP_PKEY_param_check() to check a DH key or DH parameters may experience long\ndelays. Where the key or parameters that are being checked have been obtained\nfrom an untrusted source this may lead to a Denial of Service.\n\nThe function DH_check() performs various checks on DH parameters. After fixing\nCVE-2023-3446 it was discovered that a large q parameter value can also trigger\nan overly long computation during some of these checks. A correct q value,\nif present, cannot be larger than", "references": ["https://security.alpinelinux.org/vuln/CVE-2023-3817", "https://osv.dev/vulnerability/ALPINE-CVE-2023-3817"], "fixes": ["3.1.2-r0"], "products": [{"name": "openssl", "path": "vulns/alpine-v3.19/openssl", "ecosystem": "Alpine:v3.19"}]}, {"id": "ALPINE-CVE-2023-3446", "noindex": false, "published": "2023-07-19T12:15:10.003Z", "modified": "2026-10-23T17:17:56.733972651Z", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "severity": "medium", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}], "path": "vulns/alpine-cve-2023-3446", "title": "ALPINE-CVE-2023-3446", "description": "Issue summary: Checking excessively long DH keys or parameters may be very slow.\n\nImpact summary: Applications that use the functions DH_check(), DH_check_ex()\nor EVP_PKEY_param_check() to check a DH key or DH parameters may experience long\ndelays. Where the key or parameters that are being checked have been obtained\nfrom an untrusted source this may lead to a Denial of Service.\n\nThe function DH_check() performs various checks on DH parameters. One of those\nchecks confirms that the modulus ('p' parameter) is not too large. Trying to use\na very large modulus is slow and OpenSSL will not normally use a modulus which\nis over 10,000 bits in lengt", "references": ["https://security.alpinelinux.org/vuln/CVE-2023-3446", "https://osv.dev/vulnerability/ALPINE-CVE-2023-3446"], "fixes": ["3.1.1-r3"], "products": [{"name": "openssl", "path": "vulns/alpine-v3.19/openssl", "ecosystem": "Alpine:v3.19"}]}, {"id": "ALPINE-CVE-2023-2975", "noindex": false, "published": "2023-07-14T12:15:09.023Z", "modified": "2026-10-23T17:17:56.730314759Z", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "severity": "medium", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}], "path": "vulns/alpine-cve-2023-2975", "title": "ALPINE-CVE-2023-2975", "description": "Issue summary: The AES-SIV cipher implementation contains a bug that causes\nit to ignore empty associated data entries which are unauthenticated as\na consequence.\n\nImpact summary: Applications that use the AES-SIV algorithm and want to\nauthenticate empty data entries as associated data can be misled by removing,\nadding or reordering such empty entries as these are ignored by the OpenSSL\nimplementation. We are currently unaware of any such applications.\n\nThe AES-SIV algorithm allows for authentication of multiple associated\ndata entries along with the encryption. To authenticate empty data the\napplication has to call EVP_EncryptUpdate() (or EV", "references": ["https://security.alpinelinux.org/vuln/CVE-2023-2975", "https://osv.dev/vulnerability/ALPINE-CVE-2023-2975"], "fixes": ["3.1.1-r2"], "products": [{"name": "openssl", "path": "vulns/alpine-v3.19/openssl", "ecosystem": "Alpine:v3.19"}]}, {"id": "ALPINE-CVE-2023-2650", "noindex": false, "published": "2023-05-30T14:15:09.683Z", "modified": "2026-10-23T17:17:56.723501776Z", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "severity": "medium", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}], "path": "vulns/alpine-cve-2023-2650", "title": "ALPINE-CVE-2023-2650", "description": "Issue summary: Processing some specially crafted ASN.1 object identifiers or\ndata containing them may be very slow.\n\nImpact summary: Applications that use OBJ_obj2txt() directly, or use any of\nthe OpenSSL subsystems OCSP, PKCS7/SMIME, CMS, CMP/CRMF or TS with no message\nsize limit may experience notable to very long delays when processing those\nmessages, which may lead to a Denial of Service.\n\nAn OBJECT IDENTIFIER is composed of a series of numbers - sub-identifiers -\nmost of which have no size limit.  OBJ_obj2txt() may be used to translate\nan ASN.1 OBJECT IDENTIFIER given in DER encoding form (using the OpenSSL\ntype ASN1_OBJECT) to its canon", "references": ["https://security.alpinelinux.org/vuln/CVE-2023-2650", "https://osv.dev/vulnerability/ALPINE-CVE-2023-2650"], "fixes": ["3.1.1-r0"], "products": [{"name": "openssl", "path": "vulns/alpine-v3.19/openssl", "ecosystem": "Alpine:v3.19"}]}, {"id": "ALPINE-CVE-2023-1255", "noindex": false, "published": "2023-04-20T17:15:06.883Z", "modified": "2026-10-23T17:17:56.714841176Z", "cvss": 5.9, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "medium", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}], "path": "vulns/alpine-cve-2023-1255", "title": "ALPINE-CVE-2023-1255", "description": "Issue summary: The AES-XTS cipher decryption implementation for 64 bit ARM\nplatform contains a bug that could cause it to read past the input buffer,\nleading to a crash.\n\nImpact summary: Applications that use the AES-XTS algorithm on the 64 bit ARM\nplatform can crash in rare circumstances. The AES-XTS algorithm is usually\nused for disk encryption.\n\nThe AES-XTS cipher decryption implementation for 64 bit ARM platform will read\npast the end of the ciphertext buffer if the ciphertext size is 4 mod 5 in 16\nbyte blocks, e.g. 144 bytes or 1024 bytes. If the memory after the ciphertext\nbuffer is unmapped, this will trigger a crash which results in a", "references": ["https://security.alpinelinux.org/vuln/CVE-2023-1255", "https://osv.dev/vulnerability/ALPINE-CVE-2023-1255"], "fixes": ["3.1.0-r4"], "products": [{"name": "openssl", "path": "vulns/alpine-v3.19/openssl", "ecosystem": "Alpine:v3.19"}]}, {"id": "ALPINE-CVE-2023-0465", "noindex": false, "published": "2023-03-28T15:15:06.820Z", "modified": "2026-10-23T17:17:56.689725082Z", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "severity": "medium", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}], "path": "vulns/alpine-cve-2023-0465", "title": "ALPINE-CVE-2023-0465", "description": "Applications that use a non-default option when verifying certificates may be\nvulnerable to an attack from a malicious CA to circumvent certain checks.\n\nInvalid certificate policies in leaf certificates are silently ignored by\nOpenSSL and other certificate policy checks are skipped for that certificate.\nA malicious CA could use this to deliberately assert invalid certificate policies\nin order to circumvent policy checking on the certificate altogether.\n\nPolicy processing is disabled by default but can be enabled by passing\nthe `-policy' argument to the command line utilities or by calling the\n`X509_VERIFY_PARAM_set1_policies()' function.", "references": ["https://security.alpinelinux.org/vuln/CVE-2023-0465", "https://osv.dev/vulnerability/ALPINE-CVE-2023-0465"], "fixes": ["3.1.0-r2"], "products": [{"name": "openssl", "path": "vulns/alpine-v3.19/openssl", "ecosystem": "Alpine:v3.19"}]}], "total": 55, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 3, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "openssl", "path": "vulns/alpine-v3.19/openssl", "ecosystem": "Alpine:v3.19"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": [], "stats": {"recent": 0, "kev": 0}, "lastmod": "2026-10-23T17:17:56.820669430Z", "early_advisories": [], "license": "Vous pouvez librement utiliser la sélection de PatchFirst et nos ajouts (priorités, alertes précoces, textes, synthèses et agrégats) pour vos propres besoins, y compris les activités internes de votre entreprise. La revente, la distribution commerciale et la mise en miroir massive de cette sélection ou de ces ajouts nécessitent un accord écrit avec l’opérateur. Lors de toute utilisation ou publication de la sélection ou de nos ajouts, citez PatchFirst (https://patchfirst.dev/vulns/) avec ce lien vers la page du flux de votre région. Les enregistrements originaux des sources ouvertes restent soumis à leurs licences et conditions respectives. Ces conditions ne limitent pas vos droits sur les données originales, que vous pouvez obtenir directement auprès de ces sources.", "terms_url": "https://patchfirst.dev/fr/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://patchfirst.dev/vulns/"}, "source_changes": "PatchFirst sélectionne, normalise et combine les enregistrements ; des synthèses et des traductions peuvent être ajoutées. Les actualités sont accompagnées d’un lien vers la source originale dans chaque entrée.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Les licences des bases d’origine varient ; voir le catalogue des sources."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Évaluations publiques gratuites ; mention de la source demandée (FIRST EPSS, évaluations produites par Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}