OpenSSL vulnerabilities and threats

CVE-2024-4741 is a use-after-free vulnerability in OpenSSL affecting specific versions including 3.3.0, 3.2.0, 3.1.0, 3.0.0, and 1.1.1. The flaw occurs when the SSL_free_buffers function is called while the internal buffer is still in use, potentially leading to memory corruption, crashes, or arbitrary code execution. This function is rarely used by applications, and the FIPS modules are not affected. No active exploitation is known.

CVE-2024-9143 is an out-of-bounds read and write vulnerability in OpenSSL's low-level GF(2^m) elliptic curve APIs when used with untrusted explicit field polynomial values. This can cause application crashes and potentially remote code execution, but only in rare cases involving exotic curve encodings. Standard protocols using named curves or X9.62 encoding for ECC keys in X.509 certificates are not affected. The FIPS modules are also unaffected.

CVE-2024-5535 is an out-of-bounds read vulnerability in the OpenSSL function SSL_select_next_proto. This occurs when the function is called with an empty client protocols buffer, potentially causing a crash or leaking up to 255 bytes of arbitrary private memory data to the peer. The issue mainly affects applications that incorrectly call this function with a zero-length client protocol list, which is typically a configuration or programming error. The vulnerability is considered low severity by OpenSSL due to limited exploitability and the requirement of application misconfiguration. No patches have been released yet, but a fix is planned for future OpenSSL releases.

CVE-2024-4603 is a vulnerability in OpenSSL 3.0 and 3.1 FIPS providers where unchecked input for loop conditions in DSA key parameter checks can cause excessive processing delays. Applications that call EVP_PKEY_param_check() or EVP_PKEY_public_check() with untrusted DSA keys or parameters may be vulnerable to denial of service due to long computation times on very large modulus values. The OpenSSL SSL/TLS implementation itself is not affected. The vulnerability also affects the OpenSSL pkey and pkeyparam command line tools when used with the -check option.

CVE-2024-2511 is a vulnerability in OpenSSL TLS servers supporting TLSv1.3 that can cause unbounded memory growth under certain non-default configurations. Specifically, when the SSL_OP_NO_TICKET option is used without early_data support and default anti-replay protection, the session cache may fail to flush properly and grow without limit. This can lead to a denial of service (DoS) condition. The issue does not affect TLS clients, FIPS modules in versions 3.0, 3.1, and 3.2, or OpenSSL 1.0.2.

CVE-2014-0160, known as the Heartbleed vulnerability, is a high severity flaw in OpenSSL's TLS and DTLS implementations. It arises from improper handling of Heartbeat Extension packets, enabling remote attackers to extract sensitive information from affected systems. This vulnerability has been exploited in the wild. No specific affected versions or patch information is provided in the input data.