https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=4d8a88c134df634ba610ff8db1eb8478ac5fd345

https://github.com/openssl/openssl/issues/18625

https://www.openssl.org/news/secadv/20220705.txt

https://security.netapp.com/advisory/ntap-20220715-0010/

The version of Oracle HTTP Server installed on the remote host are affected by multiple vulnerabilities as referenced in the Jan 2023 CPU advisory.

  - Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Centralized Thirdparty     Jars (Expat)). The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows     unauthenticated attacker with network access via HTTP to compromise Oracle HTTP Server. Successful attacks of     this vulnerability can result in takeover of Oracle HTTP Server. (CVE-2022-25236)

  - Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: SSL Module (Apache HTTP     Server)). The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows     unauthenticated attacker with network access via HTTPS to compromise Oracle HTTP Server. Successful attacks of     this vulnerability can result in takeover of Oracle HTTP Server. (CVE-2022-31813)     

  - Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: SSL Module (OpenSSL)).     The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated     attacker with network access via HTTPS to compromise Oracle HTTP Server. Successful attacks of this vulnerability     can result in takeover of Oracle HTTP Server. (CVE-2022-2274)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of openssl installed on the remote host is prior to 1.1.1q. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2022-186-01 advisory.

  - AES OCB mode for 32-bit x86 platforms using the AES-NI assembly optimised implementation will not encrypt     the entirety of the data under some circumstances. This could reveal sixteen bytes of data that was     preexisting in the memory that wasn't written. In the special case of in place encryption, sixteen bytes     of the plaintext would be revealed. Since OpenSSL does not support OCB based cipher suites for TLS and     DTLS, they are both unaffected. Fixed in OpenSSL 3.0.5 (Affected 3.0.0-3.0.4). Fixed in OpenSSL 1.1.1q     (Affected 1.1.1-1.1.1p). (CVE-2022-2097)

  - The OpenSSL 3.0.4 release introduced a serious bug in the RSA implementation for X86_64 CPUs supporting     the AVX512IFMA instructions. This issue makes the RSA implementation with 2048 bit private keys incorrect     on such machines and memory corruption will happen during the computation. As a consequence of the memory     corruption an attacker may be able to trigger a remote code execution on the machine performing the     computation. SSL/TLS servers or other servers using 2048 bit RSA private keys running on machines     supporting AVX512IFMA instructions of the X86_64 architecture are affected by this issue. (CVE-2022-2274)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of OpenSSL installed on the remote host is prior to 3.0.5. It is, therefore, affected by multiple vulnerabilities as referenced in the 3.0.5 advisory.

  - AES OCB mode for 32-bit x86 platforms using the AES-NI assembly optimised implementation will not encrypt     the entirety of the data under some circumstances. This could reveal sixteen bytes of data that was     preexisting in the memory that wasn't written. In the special case of in place encryption, sixteen bytes     of the plaintext would be revealed. Since OpenSSL does not support OCB based cipher suites for TLS and     DTLS, they are both unaffected. Fixed in OpenSSL 3.0.5 (Affected 3.0.0-3.0.4). Fixed in OpenSSL 1.1.1q     (Affected 1.1.1-1.1.1p). (CVE-2022-2097)

  - The OpenSSL 3.0.4 release introduced a serious bug in the RSA implementation for X86_64 CPUs supporting     the AVX512IFMA instructions. This issue makes the RSA implementation with 2048 bit private keys incorrect     on such machines and memory corruption will happen during the computation. As a consequence of the memory     corruption an attacker may be able to trigger a remote code execution on the machine performing the     computation. SSL/TLS servers or other servers using 2048 bit RSA private keys running on machines     supporting AVX512IFMA instructions of the X86_64 architecture are affected by this issue. (CVE-2022-2274)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the f0e45968-faff-11ec-856e-d4c9ef517024 advisory.

  - The OpenSSL 3.0.4 release introduced a serious bug in the RSA implementation for X86_64 CPUs supporting     the AVX512IFMA instructions. This issue makes the RSA implementation with 2048 bit private keys incorrect     on such machines and memory corruption will happen during the computation. As a consequence of the memory     corruption an attacker may be able to trigger a remote code execution on the machine performing the     computation. SSL/TLS servers or other servers using 2048 bit RSA private keys running on machines     supporting AVX512IFMA instructions of the X86_64 architecture are affected by this issue. (CVE-2022-2274)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of OpenSSL installed on the remote host is prior to 3.0.5-dev. It is, therefore, affected by a vulnerability as referenced in the 3.0.5-dev advisory.

  - The OpenSSL 3.0.4 release introduced a serious bug in the RSA implementation for X86_64 CPUs supporting     the AVX512IFMA instructions. This issue makes the RSA implementation with 2048 bit private keys incorrect     on such machines and memory corruption will happen during the computation. As a consequence of the memory     corruption an attacker may be able to trigger a remote code execution on the machine performing the     computation. SSL/TLS servers or other servers using 2048 bit RSA private keys running on machines     supporting AVX512IFMA instructions of the X86_64 architecture are affected by this issue. (CVE-2022-2274)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
170268	Oracle HTTP Server (Jan 2023 CPU)	Nessus	Web Servers	critical
162731	Slackware Linux 15.0 / current openssl Multiple Vulnerabilities (SSA:2022-186-01)	Nessus	Slackware Local Security Checks	critical
162720	OpenSSL 3.0.0 < 3.0.5 Multiple Vulnerabilities	Nessus	Web Servers	critical
162699	FreeBSD : OpenSSL -- Bug in RSA implementation for AVX512IFMA (f0e45968-faff-11ec-856e-d4c9ef517024)	Nessus	FreeBSD Local Security Checks	critical
162673	OpenSSL 3.0.4 < 3.0.5-dev Vulnerability	Nessus	Web Servers	critical

CVE-2022-2274

critical

Tenable Plugins

critical

critical

critical

critical

critical