Описание
Issue summary: ChaCha20-Poly1305 and AES-OCB decryption with an empty ciphertext can report success without verifying the supplied authentication tag when the operation is finalized by calling the EVP_Cipher() function. Impact summary: Applications calling EVP_Cipher() on an empty ciphertext and expecting the call to check the AEAD tag may accept forged messages. CWE: CWE-354 (Improper Validation of Integrity Check Value) Description: The EVP_Cipher() API call for AEAD ciphers behaves like a one shot encryption and decryption call. It also verifies the AEAD tag after the decryption operation. However for AES-OCB and ChaCha20-Poly1305 ciphers it skipped the AEAD tag verification when an empty ciphertext was passed to the function. The callers of this function might believe that a successful return indicates a valid AEAD tag for these ciphers, even when that has not truly been validated in this case. FIPS impact: no The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by t...
| Релиз | Статус | Примечание |
|---|---|---|
| devel | needs-triage | |
| esm-apps-legacy/xenial | not-affected | OpenSSL 1.0.2g, AEAD issue 3.0+ only |
| esm-apps/bionic | not-affected | OpenSSL 1.1.0g, AEAD issue 3.0+ only |
| esm-infra/focal | not-affected | OpenSSL 1.1.1e, AEAD issue 3.0+ only |
| jammy | not-affected | OpenSSL 1.1.1j, AEAD issue 3.0+ only |
| noble | released | 2024.02-2ubuntu0.10 |
| resolute | released | 2025.11-3ubuntu7.3 |
| stonking | needs-triage | |
| upstream | needs-triage |
Показывать по
| Релиз | Статус | Примечание |
|---|---|---|
| devel | needs-triage | |
| jammy | DNE | |
| noble | DNE | |
| resolute | needed | |
| stonking | needs-triage | |
| upstream | needs-triage |
Показывать по
| Релиз | Статус | Примечание |
|---|---|---|
| devel | not-affected | uses system openssl |
| esm-apps-legacy/xenial | needs-triage | |
| esm-apps/bionic | needs-triage | |
| esm-apps/focal | not-affected | uses system openssl |
| esm-apps/jammy | not-affected | 3.0+ only |
| esm-apps/noble | not-affected | uses system openssl |
| esm-apps/resolute | not-affected | uses system openssl |
| esm-infra-legacy/trusty | not-affected | uses system openssl |
| jammy | not-affected | 3.0+ only |
| noble | not-affected | uses system openssl |
Показывать по
| Релиз | Статус | Примечание |
|---|---|---|
| devel | not-affected | 4.0.3-1ubuntu1 |
| esm-infra-legacy/trusty | not-affected | 3.0+ only |
| esm-infra-legacy/xenial | not-affected | 3.0+ only |
| esm-infra/bionic | not-affected | 3.0+ only |
| esm-infra/focal | not-affected | 3.0+ only |
| fips-preview/jammy | needed | |
| fips-updates/bionic | not-affected | 3.0+ only |
| fips-updates/focal | not-affected | 3.0+ only |
| fips-updates/jammy | released | 3.0.2-0ubuntu1.29+Fips1 |
| fips-updates/xenial | not-affected | 3.0+ only |
Показывать по
| Релиз | Статус | Примечание |
|---|---|---|
| devel | DNE | |
| fips-preview/jammy | needs-triage | |
| fips-updates/jammy | needs-triage | |
| fips-updates/noble | released | 3.0.13-0ubuntu3.15+Fips1 |
| jammy | DNE | |
| noble | DNE | |
| resolute | DNE | |
| stonking | DNE | |
| upstream | needs-triage |
Показывать по
| Релиз | Статус | Примечание |
|---|---|---|
| devel | DNE | |
| esm-infra/bionic | not-affected | 3.0+ only |
| jammy | DNE | |
| noble | DNE | |
| resolute | DNE | |
| stonking | DNE | |
| upstream | needs-triage |
Показывать по
EPSS
9.1 Critical
CVSS3
Связанные уязвимости
Issue summary: ChaCha20-Poly1305 and AES-OCB decryption with an empty ciphertext can report success without verifying the supplied authentication tag when the operation is finalized by calling the EVP_Cipher() function. Impact summary: Applications calling EVP_Cipher() on an empty ciphertext and expecting the call to check the AEAD tag may accept forged messages. CWE: CWE-354 (Improper Validation of Integrity Check Value) Description: The EVP_Cipher() API call for AEAD ciphers behaves like a one shot encryption and decryption call. It also verifies the AEAD tag after the decryption operation. However for AES-OCB and ChaCha20-Poly1305 ciphers it skipped the AEAD tag verification when an empty ciphertext was passed to the function. The callers of this function might believe that a successful return indicates a valid AEAD tag for these ciphers, even when that has not truly been validated in this case. FIPS impact: no The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by t...
Issue summary: ChaCha20-Poly1305 and AES-OCB decryption with an empty ciphertext can report success without verifying the supplied authentication tag when the operation is finalized by calling the EVP_Cipher() function. Impact summary: Applications calling EVP_Cipher() on an empty ciphertext and expecting the call to check the AEAD tag may accept forged messages. CWE: CWE-354 (Improper Validation of Integrity Check Value) Description: The EVP_Cipher() API call for AEAD ciphers behaves like a one shot encryption and decryption call. It also verifies the AEAD tag after the decryption operation. However for AES-OCB and ChaCha20-Poly1305 ciphers it skipped the AEAD tag verification when an empty ciphertext was passed to the function. The callers of this function might believe that a successful return indicates a valid AEAD tag for these ciphers, even when that has not truly been validated in this case. FIPS impact: no The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by
Issue summary: ChaCha20-Poly1305 and AES-OCB decryption with an empty ...
EPSS
9.1 Critical
CVSS3