Поиск уязвимостей
Количество 32
Количество 32
CVE-2026-22796
Issue summary: A type confusion vulnerability exists in the signature verification of signed PKCS#7 data where an ASN1_TYPE union member is accessed without first validating the type, causing an invalid or NULL pointer dereference when processing malformed PKCS#7 data. Impact summary: An application performing signature verification of PKCS#7 data or calling directly the PKCS7_digest_from_attributes() function can be caused to dereference an invalid or NULL pointer when reading, resulting in a Denial of Service. The function PKCS7_digest_from_attributes() accesses the message digest attribute value without validating its type. When the type is not V_ASN1_OCTET_STRING, this results in accessing invalid memory through the ASN1_TYPE union, causing a crash. Exploiting this vulnerability requires an attacker to provide a malformed signed PKCS#7 to an application that verifies it. The impact of the exploit is just a Denial of Service, the PKCS7 API is legacy and applications should be usi...
CVE-2026-22796
Issue summary: A type confusion vulnerability exists in the signature verification of signed PKCS#7 data where an ASN1_TYPE union member is accessed without first validating the type, causing an invalid or NULL pointer dereference when processing malformed PKCS#7 data. Impact summary: An application performing signature verification of PKCS#7 data or calling directly the PKCS7_digest_from_attributes() function can be caused to dereference an invalid or NULL pointer when reading, resulting in a Denial of Service. The function PKCS7_digest_from_attributes() accesses the message digest attribute value without validating its type. When the type is not V_ASN1_OCTET_STRING, this results in accessing invalid memory through the ASN1_TYPE union, causing a crash. Exploiting this vulnerability requires an attacker to provide a malformed signed PKCS#7 to an application that verifies it. The impact of the exploit is just a Denial of Service, the PKCS7 API is legacy and applications should be usi...
CVE-2026-22796
Issue summary: A type confusion vulnerability exists in the signature verification of signed PKCS#7 data where an ASN1_TYPE union member is accessed without first validating the type, causing an invalid or NULL pointer dereference when processing malformed PKCS#7 data. Impact summary: An application performing signature verification of PKCS#7 data or calling directly the PKCS7_digest_from_attributes() function can be caused to dereference an invalid or NULL pointer when reading, resulting in a Denial of Service. The function PKCS7_digest_from_attributes() accesses the message digest attribute value without validating its type. When the type is not V_ASN1_OCTET_STRING, this results in accessing invalid memory through the ASN1_TYPE union, causing a crash. Exploiting this vulnerability requires an attacker to provide a malformed signed PKCS#7 to an application that verifies it. The impact of the exploit is just a Denial of Service, the PKCS7 API is legacy and applications should be usi
CVE-2026-22796
ASN1_TYPE Type Confusion in the PKCS7_digest_from_attributes() function
CVE-2026-22796
Issue summary: A type confusion vulnerability exists in the signature ...
GHSA-r9hf-rxjm-gv2f
Issue summary: A type confusion vulnerability exists in the signature verification of signed PKCS#7 data where an ASN1_TYPE union member is accessed without first validating the type, causing an invalid or NULL pointer dereference when processing malformed PKCS#7 data. Impact summary: An application performing signature verification of PKCS#7 data or calling directly the PKCS7_digest_from_attributes() function can be caused to dereference an invalid or NULL pointer when reading, resulting in a Denial of Service. The function PKCS7_digest_from_attributes() accesses the message digest attribute value without validating its type. When the type is not V_ASN1_OCTET_STRING, this results in accessing invalid memory through the ASN1_TYPE union, causing a crash. Exploiting this vulnerability requires an attacker to provide a malformed signed PKCS#7 to an application that verifies it. The impact of the exploit is just a Denial of Service, the PKCS7 API is legacy and applications should be ...
BDU:2026-01220
Уязвимость функции PKCS7_digest_from_attributes() библиотеки OpenSSL, позволяющая нарушителю вызвать отказ в обслуживании
ROS-20260420-80-0008
Уязвимость openssl
ROS-20260420-73-0015
Уязвимость openssl3
ROS-20260420-73-0014
Уязвимость openssl
SUSE-SU-2026:0498-1
Security update for openssl1
SUSE-SU-2026:0333-1
Security update for openssl-1_0_0
SUSE-SU-2026:0332-1
Security update for openssl-1_0_0
SUSE-SU-2026:0360-1
Security update for openssl-1_1
SUSE-SU-2026:0359-1
Security update for openssl-1_1
SUSE-SU-2026:0358-1
Security update for openssl-1_1
SUSE-SU-2026:0346-1
Security update for openssl-1_1
SUSE-SU-2026:0331-1
Security update for openssl-1_1
SUSE-SU-2026:0312-1
Security update for openssl-3
SUSE-SU-2026:0311-1
Security update for openssl-3
Уязвимостей на страницу
Уязвимость | CVSS | EPSS | Опубликовано | |
|---|---|---|---|---|
 | CVE-2026-22796 Issue summary: A type confusion vulnerability exists in the signature verification of signed PKCS#7 data where an ASN1_TYPE union member is accessed without first validating the type, causing an invalid or NULL pointer dereference when processing malformed PKCS#7 data. Impact summary: An application performing signature verification of PKCS#7 data or calling directly the PKCS7_digest_from_attributes() function can be caused to dereference an invalid or NULL pointer when reading, resulting in a Denial of Service. The function PKCS7_digest_from_attributes() accesses the message digest attribute value without validating its type. When the type is not V_ASN1_OCTET_STRING, this results in accessing invalid memory through the ASN1_TYPE union, causing a crash. Exploiting this vulnerability requires an attacker to provide a malformed signed PKCS#7 to an application that verifies it. The impact of the exploit is just a Denial of Service, the PKCS7 API is legacy and applications should be usi... | CVSS3: 5.3 | 1% Низкий | 10 месяцев назад |
 | CVE-2026-22796 Issue summary: A type confusion vulnerability exists in the signature verification of signed PKCS#7 data where an ASN1_TYPE union member is accessed without first validating the type, causing an invalid or NULL pointer dereference when processing malformed PKCS#7 data. Impact summary: An application performing signature verification of PKCS#7 data or calling directly the PKCS7_digest_from_attributes() function can be caused to dereference an invalid or NULL pointer when reading, resulting in a Denial of Service. The function PKCS7_digest_from_attributes() accesses the message digest attribute value without validating its type. When the type is not V_ASN1_OCTET_STRING, this results in accessing invalid memory through the ASN1_TYPE union, causing a crash. Exploiting this vulnerability requires an attacker to provide a malformed signed PKCS#7 to an application that verifies it. The impact of the exploit is just a Denial of Service, the PKCS7 API is legacy and applications should be usi... | CVSS3: 5.9 | 1% Низкий | 10 месяцев назад |
 | CVE-2026-22796 Issue summary: A type confusion vulnerability exists in the signature verification of signed PKCS#7 data where an ASN1_TYPE union member is accessed without first validating the type, causing an invalid or NULL pointer dereference when processing malformed PKCS#7 data. Impact summary: An application performing signature verification of PKCS#7 data or calling directly the PKCS7_digest_from_attributes() function can be caused to dereference an invalid or NULL pointer when reading, resulting in a Denial of Service. The function PKCS7_digest_from_attributes() accesses the message digest attribute value without validating its type. When the type is not V_ASN1_OCTET_STRING, this results in accessing invalid memory through the ASN1_TYPE union, causing a crash. Exploiting this vulnerability requires an attacker to provide a malformed signed PKCS#7 to an application that verifies it. The impact of the exploit is just a Denial of Service, the PKCS7 API is legacy and applications should be usi | CVSS3: 5.3 | 1% Низкий | 10 месяцев назад |
 | CVE-2026-22796 ASN1_TYPE Type Confusion in the PKCS7_digest_from_attributes() function | CVSS3: 5.3 | 1% Низкий | 29 дней назад |
| CVE-2026-22796 Issue summary: A type confusion vulnerability exists in the signature ... | CVSS3: 5.3 | 1% Низкий | 10 месяцев назад |
| GHSA-r9hf-rxjm-gv2f Issue summary: A type confusion vulnerability exists in the signature verification of signed PKCS#7 data where an ASN1_TYPE union member is accessed without first validating the type, causing an invalid or NULL pointer dereference when processing malformed PKCS#7 data. Impact summary: An application performing signature verification of PKCS#7 data or calling directly the PKCS7_digest_from_attributes() function can be caused to dereference an invalid or NULL pointer when reading, resulting in a Denial of Service. The function PKCS7_digest_from_attributes() accesses the message digest attribute value without validating its type. When the type is not V_ASN1_OCTET_STRING, this results in accessing invalid memory through the ASN1_TYPE union, causing a crash. Exploiting this vulnerability requires an attacker to provide a malformed signed PKCS#7 to an application that verifies it. The impact of the exploit is just a Denial of Service, the PKCS7 API is legacy and applications should be ... | CVSS3: 5.3 | 1% Низкий | 10 месяцев назад |
 | BDU:2026-01220 Уязвимость функции PKCS7_digest_from_attributes() библиотеки OpenSSL, позволяющая нарушителю вызвать отказ в обслуживании | CVSS3: 5.3 | 1% Низкий | 10 месяцев назад |
 | ROS-20260420-80-0008 Уязвимость openssl | CVSS3: 5.3 | 1% Низкий | 7 месяцев назад |
| ROS-20260420-73-0015 Уязвимость openssl3 | CVSS3: 5.3 | 1% Низкий | 7 месяцев назад |
| ROS-20260420-73-0014 Уязвимость openssl | CVSS3: 5.3 | 1% Низкий | 7 месяцев назад |
 | SUSE-SU-2026:0498-1 Security update for openssl1 | 9 месяцев назад | ||
| SUSE-SU-2026:0333-1 Security update for openssl-1_0_0 | 9 месяцев назад | ||
| SUSE-SU-2026:0332-1 Security update for openssl-1_0_0 | 9 месяцев назад | ||
| SUSE-SU-2026:0360-1 Security update for openssl-1_1 | 9 месяцев назад | ||
| SUSE-SU-2026:0359-1 Security update for openssl-1_1 | 9 месяцев назад | ||
| SUSE-SU-2026:0358-1 Security update for openssl-1_1 | 9 месяцев назад | ||
| SUSE-SU-2026:0346-1 Security update for openssl-1_1 | 9 месяцев назад | ||
| SUSE-SU-2026:0331-1 Security update for openssl-1_1 | 9 месяцев назад | ||
| SUSE-SU-2026:0312-1 Security update for openssl-3 | 9 месяцев назад | ||
| SUSE-SU-2026:0311-1 Security update for openssl-3 | 9 месяцев назад |
Уязвимостей на страницу