Fluid Attacks Database

Description

The X509_NAME_oneline function in crypto/x509/x509_obj.c in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h allows remote attackers to obtain sensitive information from process stack memory or cause a denial of service (buffer over-read) via crafted EBCDIC ASN.1 data.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
alpine v3.2	openssl	>=0 <1.0.2h-r0	1.0.2h-r0
alpine v3.3	openssl	>=0 <1.0.2h-r0	1.0.2h-r0
alpine v3.5	openssl	>=0 <1.0.2h-r0	1.0.2h-r0
alpine v3.6	openssl	>=0 <1.0.2h-r0	1.0.2h-r0
alpine v3.7	openssl	>=0 <1.0.2h-r0	1.0.2h-r0
alpine v3.8	openssl	>=0 <1.0.2h-r0	1.0.2h-r0
alpine v3.4	openssl	>=0 <1.0.2h-r0	1.0.2h-r0

Aliases

1. CVE-2016-21762. NVD-2016-21763. OSV-ALPINE-2016-21764. OSV-2016-21765. SECURITY-CVE-2016-2176

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.