Detections
Analytics
Alpine: libcrypto3, multiple openssl packages: security update to 1.0.1-r7 (deprecated)
high Tenable Cloud Security Plugin ID 401100
Description
There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:- The ssl3_take_mac function in ssl/s3_both.c in OpenSSL 1.0.1 before 1.0.1f allows remote TLS servers to
cause a denial of service (NULL pointer dereference and application crash) via a crafted Next Protocol
Negotiation record in a TLS handshake. (CVE-2013-4353)
- The ssl_get_algorithm2 function in ssl/s3_lib.c in OpenSSL before 1.0.2 obtains a certain version number
from an incorrect data structure, which allows remote attackers to cause a denial of service (daemon
crash) via crafted traffic from a TLS 1.2 client. (CVE-2013-6449)
- The DTLS retransmission implementation in OpenSSL 1.0.0 before 1.0.0l and 1.0.1 before 1.0.1f does not
properly maintain data structures for digest and encryption contexts, which might allow man-in-the-middle
attackers to trigger the use of a different context and cause a denial of service (application crash) by
interfering with packet delivery, related to ssl/d1_both.c and ssl/t1_enc.c. (CVE-2013-6450)
See Also
https://git.alpinelinux.org/aports/commit/?id=b863af9870ec9b963a1d7f903ee51aae24086062
https://git.alpinelinux.org/aports/commit/?id=be0d0a4451a7e1bca824949ec8fd32e20a33c9f6
Plugin Details
Severity: High
ID: 401100
Version: Revision 1.26
Type: Local
Published: 8/16/2023
Updated: 7/2/2026
Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Low
Score: 3
Percentile: 23.18
CVSS v2
Risk Factor: Medium
Base Score: 5.8
Temporal Score: 4.3
Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:P
CVSS Score Source: CVE-2013-6450
CVSS v3
Risk Factor: High
Base Score: 7.5
Temporal Score: 6.5
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
Exploit Ease: No known exploits are available
Patch Publication Date: 1/7/2014
Vulnerability Publication Date: 12/13/2013