Detections
Analytics
Alpine: openssl: security update to 3.3.2-r3
high Tenable Self-Hosted Container Security Plugin ID 420847
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- Issue summary: Use of the low-level GF(2^m) elliptic curve APIs with untrusted explicit values for the
field polynomial can lead to out-of-bounds memory reads or writes. Impact summary: Out of bound memory
writes can lead to an application crash or even a possibility of a remote code execution, however, in all
the protocols involving Elliptic Curve Cryptography that we're aware of, either only "named curves" are
supported, or, if explicit curve parameters are supported, they specify an X9.62 encoding of binary
(GF(2^m)) curves that can't represent problematic input values. Thus the likelihood of existence of a
vulnerable application is low. In particular, the X9.62 encoding is used for ECC keys in X.509
certificates, so problematic inputs cannot occur in the context of processing X.509 certificates. Any
problematic use-cases would have to be using an "exotic" curve encoding. The affected APIs include:
EC_GROUP_new_curve_GF2m(), EC_GROUP_new_from_params(), and various supporting BN_GF2m_*() functions.
Applications working with "exotic" explicit binary (GF(2^m)) curve parameters, that make it possible to
represent invalid field polynomials with a zero constant term, via the above or similar APIs, may
terminate abruptly as a result of reading or writing outside of array bounds. Remote code execution cannot
easily be ruled out. The FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue.
(CVE-2024-9143)
See Also
Plugin Details
Severity: High
ID: 420847
Version: Revision 1.8
Type: Local
Published: 2/7/2025
Updated: 12/19/2025
Supported Sensors: Agentless Assessment
Risk Information
VPR
Risk Factor: Medium
Score: 5
Percentile: 94.39
CVSS v2
Risk Factor: Medium
Base Score: 5.4
Temporal Score: 4
Vector: CVSS2#AV:N/AC:H/Au:N/C:N/I:N/A:C
CVSS Score Source: CVE-2024-9143
CVSS v3
Risk Factor: Medium
Base Score: 4.3
Temporal Score: 3.8
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
CVSS v4
Risk Factor: High
Base Score: 8.2
Threat Score: 4.6
Threat Vector: CVSS:4.0/E:U
Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Vulnerability Information
Exploit Ease: No known exploits are available
Vulnerability Publication Date: 10/16/2024
Reference Information
CVE: CVE-2024-9143
IAVA: 2025-A-0127