CVE-2012-0884

Published: Mar 13, 2012Modified: Apr 29, 2026

5.0

Vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability: 10.0 / Impact: 2.9

Source: NVD

Description

The implementation of Cryptographic Message Syntax (CMS) and PKCS #7 in OpenSSL before 0.9.8u and 1.x before 1.0.0h does not properly restrict certain oracle behavior, which makes it easier for context-dependent attackers to decrypt data via a Million Message Attack (MMA) adaptive chosen ciphertext attack.

Affected (66)

Products: Openssl: Openssl

1 product

Configuration A

66 vulnerable

Vulnerable Software	Affected Versions
Openssl Openssl	Up to 0.9.8t
Openssl Openssl	Version 0.9.0b
Openssl Openssl	Version 0.9.1b
Openssl Openssl	Version 0.9.1c
Openssl Openssl	Version 0.9.2b
Openssl Openssl	Version 0.9.3
Openssl Openssl	Version 0.9.3a
Openssl Openssl	Version 0.9.4
Openssl Openssl	Version 0.9.5
Openssl Openssl	Version 0.9.5a
Openssl Openssl	Version 0.9.6
Openssl Openssl	Version 0.9.6a
Openssl Openssl	Version 0.9.6b
Openssl Openssl	Version 0.9.6c
Openssl Openssl	Version 0.9.6d
Openssl Openssl	Version 0.9.6e
Openssl Openssl	Version 0.9.6f
Openssl Openssl	Version 0.9.6g
Openssl Openssl	Version 0.9.6h
Openssl Openssl	Version 0.9.6i
Openssl Openssl	Version 0.9.6j
Openssl Openssl	Version 0.9.6k
Openssl Openssl	Version 0.9.6l
Openssl Openssl	Version 0.9.6m
Openssl Openssl	Version 0.9.7
Openssl Openssl	Version 0.9.7a
Openssl Openssl	Version 0.9.7b
Openssl Openssl	Version 0.9.7c
Openssl Openssl	Version 0.9.7d
Openssl Openssl	Version 0.9.7e
Openssl Openssl	Version 0.9.7f
Openssl Openssl	Version 0.9.7g
Openssl Openssl	Version 0.9.7h
Openssl Openssl	Version 0.9.7i
Openssl Openssl	Version 0.9.7j
Openssl Openssl	Version 0.9.7k
Openssl Openssl	Version 0.9.7l
Openssl Openssl	Version 0.9.7m
Openssl Openssl	Version 0.9.8
Openssl Openssl	Version 0.9.8a
Openssl Openssl	Version 0.9.8b
Openssl Openssl	Version 0.9.8c
Openssl Openssl	Version 0.9.8d
Openssl Openssl	Version 0.9.8e
Openssl Openssl	Version 0.9.8f
Openssl Openssl	Version 0.9.8g
Openssl Openssl	Version 0.9.8h
Openssl Openssl	Version 0.9.8i
Openssl Openssl	Version 0.9.8j
Openssl Openssl	Version 0.9.8k
Openssl Openssl	Version 0.9.8l
Openssl Openssl	Version 0.9.8m
Openssl Openssl	Version 0.9.8n
Openssl Openssl	Version 0.9.8o
Openssl Openssl	Version 0.9.8p
Openssl Openssl	Version 0.9.8q
Openssl Openssl	Version 0.9.8r
Openssl Openssl	Version 0.9.8s
Openssl Openssl	Version 1.0.0
Openssl Openssl	Version 1.0.0a
Openssl Openssl	Version 1.0.0b
Openssl Openssl	Version 1.0.0c
Openssl Openssl	Version 1.0.0d
Openssl Openssl	Version 1.0.0e
Openssl Openssl	Version 1.0.0f
Openssl Openssl	Version 1.0.0g

Related CWEs

References (46)

http://lists.fedoraproject.org/pipermail/package-announce/2012-April/077086.html

Source: secalert@redhat.com

http://lists.fedoraproject.org/pipermail/package-announce/2012-April/077221.html

Source: secalert@redhat.com

http://lists.fedoraproject.org/pipermail/package-announce/2012-April/077666.html

Source: secalert@redhat.com

http://lists.fedoraproject.org/pipermail/package-announce/2012-November/092905.html

Source: secalert@redhat.com

http://marc.info/?l=bugtraq&m=133728068926468&w=2

Source: secalert@redhat.com

http://marc.info/?l=bugtraq&m=133951357207000&w=2

Source: secalert@redhat.com

http://marc.info/?l=bugtraq&m=134039053214295&w=2

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2012-0426.html

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2012-0488.html

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2012-0531.html

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2012-1306.html

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2012-1307.html

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2012-1308.html

Source: secalert@redhat.com

http://secunia.com/advisories/48580

Source: secalert@redhat.com

http://secunia.com/advisories/48895

Source: secalert@redhat.com

http://secunia.com/advisories/48916

Source: secalert@redhat.com

http://secunia.com/advisories/57353

Source: secalert@redhat.com

http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004564

Source: secalert@redhat.com

http://www.debian.org/security/2012/dsa-2454

Source: secalert@redhat.com

http://www.kb.cert.org/vuls/id/737740

Source: secalert@redhat.com

US Government Resource

http://www.openssl.org/news/secadv_20120312.txt

Source: secalert@redhat.com

Vendor Advisory

https://downloads.avaya.com/css/P8/documents/100162507

Source: secalert@redhat.com

https://hermes.opensuse.org/messages/14330767

Source: secalert@redhat.com

http://lists.fedoraproject.org/pipermail/package-announce/2012-April/077086.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.fedoraproject.org/pipermail/package-announce/2012-April/077221.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.fedoraproject.org/pipermail/package-announce/2012-April/077666.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.fedoraproject.org/pipermail/package-announce/2012-November/092905.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://marc.info/?l=bugtraq&m=133728068926468&w=2

Source: af854a3a-2127-422b-91ae-364da2661108

http://marc.info/?l=bugtraq&m=133951357207000&w=2

Source: af854a3a-2127-422b-91ae-364da2661108

http://marc.info/?l=bugtraq&m=134039053214295&w=2

Source: af854a3a-2127-422b-91ae-364da2661108

http://rhn.redhat.com/errata/RHSA-2012-0426.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://rhn.redhat.com/errata/RHSA-2012-0488.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://rhn.redhat.com/errata/RHSA-2012-0531.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://rhn.redhat.com/errata/RHSA-2012-1306.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://rhn.redhat.com/errata/RHSA-2012-1307.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://rhn.redhat.com/errata/RHSA-2012-1308.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/48580

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/48895

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/48916

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/57353

Source: af854a3a-2127-422b-91ae-364da2661108

http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004564

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.debian.org/security/2012/dsa-2454

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.kb.cert.org/vuls/id/737740

Source: af854a3a-2127-422b-91ae-364da2661108

US Government Resource

http://www.openssl.org/news/secadv_20120312.txt

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

https://downloads.avaya.com/css/P8/documents/100162507

Source: af854a3a-2127-422b-91ae-364da2661108

https://hermes.opensuse.org/messages/14330767

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.