Alpine: libcrypto3, multiple openssl packages: security update to 1.0.0-r0 (deprecated)

high Tenable Self-Hosted Container Security Plugin ID 401253

Description

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

- crypto/x509/x509_vfy.c in OpenSSL 1.0.x before 1.0.0e does not initialize certain structure members, which
makes it easier for remote attackers to bypass CRL validation by using a nextUpdate value corresponding to
a time in the past. (CVE-2011-3207)

- The ephemeral ECDH ciphersuite functionality in OpenSSL 0.9.8 through 0.9.8r and 1.0.x before 1.0.0e does
not ensure thread safety during processing of handshake messages from clients, which allows remote
attackers to cause a denial of service (daemon crash) via out-of-order messages that violate the TLS
protocol. (CVE-2011-3210)

Plugin Details

Severity: High

ID: 401253

Version: Revision 1.25

Type: Local

Family: Alpine Linux Local Security Checks

Published: 8/16/2023

Updated: 1/16/2026

Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.3

Percentile: 53.04

CVSS v2

Risk Factor: Medium

Base Score: 5

Temporal Score: 3.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:N

CVSS Score Source: CVE-2011-3207

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS Score Source: CVE-2011-3210

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 9/6/2011

Vulnerability Publication Date: 9/6/2011

Reference Information

CVE: CVE-2011-3207, CVE-2011-3210

BID: 49469, 49471

IAVA: 2011-A-0122-S

Detections

Analytics