git: 1e9ef2db7b49 - main - security/vuxml: Document OpenSSL vulnerabilities

Go to: [ bottom of page ] [ top of archives ] [ this month ]
From: Bernard Spil <brnrd_at_FreeBSD.org>
Date: Tue, 03 Sep 2024 17:52:11 UTC
The branch main has been updated by brnrd:

URL: https://cgit.FreeBSD.org/ports/commit/?id=1e9ef2db7b49a9dd2d8f160ddacfc4c757c1078f

commit 1e9ef2db7b49a9dd2d8f160ddacfc4c757c1078f
Author:     Bernard Spil <brnrd@FreeBSD.org>
AuthorDate: 2024-09-03 17:52:07 +0000
Commit:     Bernard Spil <brnrd@FreeBSD.org>
CommitDate: 2024-09-03 17:52:07 +0000

    security/vuxml: Document OpenSSL vulnerabilities
---
 security/vuxml/vuln/2024.xml | 55 ++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 55 insertions(+)

diff --git a/security/vuxml/vuln/2024.xml b/security/vuxml/vuln/2024.xml
index b19e07afa115..f304ad6bc6a7 100644
--- a/security/vuxml/vuln/2024.xml
+++ b/security/vuxml/vuln/2024.xml
@@ -1,3 +1,58 @@
+  <vuln vid="21f505f4-6a1c-11ef-b611-84a93843eb75">
+    <topic>OpenSSL -- Multiple vulnerabilities</topic>
+    <affects>
+      <package>
+	<name>openssl</name>
+	<range><lt>3.0.15,1</lt></range>
+      </package>
+      <package>
+	<name>openssl31</name>
+	<range><lt>3.1.7</lt></range>
+      </package>
+      <package>
+	<name>openssl32</name>
+	<range><lt>3.2.3</lt></range>
+      </package>
+      <package>
+	<name>openssl33</name>
+	<range><lt>3.3.2</lt></range>
+      </package>
+      <package>
+	<name>openssl-quictls</name>
+	<range><lt>3.0.15</lt></range>
+      </package>
+      <package>
+	<name>openssl31-quictls</name>
+	<range><lt>3.1.7</lt></range>
+      </package>
+    </affects>
+    <description>
+	<body xmlns="http://www.w3.org/1999/xhtml">
+	<p>The OpenSSL project reports:</p>
+	<blockquote cite="https://www.openssl.org/news/secadv/20240528.txt">
+	  <p>Possible denial of service in X.509 name checks [Moderate severity]
+	    Applications performing certificate name checks (e.g., TLS clients
+	    checking server certificates) may attempt to read an invalid
+	    memory address resulting in abnormal termination of the application
+	    process.</p>
+	  <p>SSL_select_next_proto buffer overread [Low severity]
+	    Calling the OpenSSL API function SSL_select_next_proto with an empty
+	    supported client protocols buffer may cause a crash or memory
+	    contents to be sent to the peer.</p>
+	</blockquote>
+	</body>
+    </description>
+    <references>
+      <cvename>CVE-2024-5535</cvename>
+      <cvename>CVE-2024-6119</cvename>
+      <url>https://openssl-library.org/news/vulnerabilities/</url>
+    </references>
+    <dates>
+      <discovery>2024-09-03</discovery>
+      <entry>2024-09-03</entry>
+    </dates>
+  </vuln>
+
   <vuln vid="26125e09-69ca-11ef-8a0f-a8a1599412c6">
     <topic>chromium -- multiple security fixes</topic>
     <affects>