Skip to content
Threat Feed
Subscribe

Product

Openssl

11 briefs RSS
high threat

Disruption of Integrity Technology Group Hacking Tools

The US government disrupted infrastructure supporting Integrity Technology Group tools MicroScan and FishHub, which Chinese state-sponsored actors, including Flax Typhoon, used to compromise critical infrastructure.

Struts +6 Flax Typhoon +1 state-sponsored intelligence-disruption critical-infrastructure espionage
3t 6i
medium advisory

Multiple Vulnerabilities in OpenSSL

Multiple security flaws in various OpenSSL versions allow remote attackers to perform denial of service, compromise confidentiality, and breach data integrity.

OpenSSL +7 vulnerability patch-management
5c updated
medium advisory

Multiple Vulnerabilities in OpenSSL

Multiple vulnerabilities across several OpenSSL branches allow remote attackers to cause denial of service or bypass security policies.

OpenSSL 1.0.2 +7
7c
medium advisory

OpenSSL Denial of Service Vulnerability

A vulnerability in OpenSSL allows a remote, unauthenticated attacker to trigger a Denial of Service condition by sending malicious traffic to affected systems.

OpenSSL vulnerability dos
1t
medium advisory

Multiple Vulnerabilities in OpenSSL Allow for DoS, Information Disclosure, and Ciphertext Recovery

Multiple vulnerabilities in OpenSSL can be exploited by a remote attacker to conduct a denial-of-service attack, disclose information, or recover ciphertext over a network.

OpenSSL vulnerability denial-of-service information-disclosure ciphertext-recovery
2r 2t
high advisory

rust-openssl Unchecked Callback Length Memory Leak

The rust-openssl crate versions 0.9.24 prior to 0.10.78 are vulnerable to memory leaks due to unchecked callback lengths in PSK/cookie trampolines, potentially leading to buffer overflows.

openssl rust memory leak buffer overflow
2r
medium advisory

OpenSSL Vulnerability Allows Denial of Service and Information Disclosure

A remote, authenticated attacker can exploit a vulnerability in OpenSSL to perform a denial-of-service attack and disclose information.

OpenSSL denial-of-service information-disclosure
2r 2t
high advisory

rust-openssl AES Key Wrap Out-of-Bounds Write Vulnerability

The rust-openssl package is vulnerable to an out-of-bounds write due to an incorrect bounds assertion in the `aes::unwrap_key()` function, potentially leading to arbitrary code execution if attacker-controlled buffer sizes are permitted.

openssl aes keywrap oob-write memory-corruption
2r
medium advisory

OpenSSL Data Encryption Detection

This brief documents detection of OpenSSL being used to encrypt data using command-line arguments specifying input and output files, potentially indicating data exfiltration preparation or ransomware activity by threat actors.

OpenSSL defense-evasion collection data-encryption
2r 2t
high advisory

rust-openssl Stack Buffer Overflow Vulnerability

The rust-openssl crate is vulnerable to a stack-based buffer overflow (CVE-2026-41681) where the `EVP_DigestFinal()` function writes beyond the allocated buffer, potentially corrupting the stack, affecting versions >= 0.10.39 and < 0.10.78.

openssl buffer overflow rust vulnerability
2r
high advisory

Heap/Stack Overflow in rust-openssl with OpenSSL 1.1.x

The rust-openssl crate's `Deriver::derive` and `PkeyCtxRef::derive` functions can cause heap/stack overflows when used with OpenSSL 1.1.x due to insufficient buffer length validation in X25519, X448, DH, and HKDF-extract, affecting rust-openssl versions >= 0.9.27 and < 0.10.78.

openssl buffer-overflow rust cryptography
2r