{"id":104516,"date":"2022-06-27T21:36:37","date_gmt":"2022-06-27T19:36:37","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-openssl-3-0-4-privodyashhaya-k-udalyonnomu-povrezhdeniyu-pamyati-proczessa"},"modified":"2022-06-27T21:36:37","modified_gmt":"2022-06-27T19:36:37","slug":"uyazvimost-v-openssl-3-0-4-privodyashhaya-k-udalyonnomu-povrezhdeniyu-pamyati-proczessa","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/uyazvimost-v-openssl-3-0-4-privodyashhaya-k-udalyonnomu-povrezhdeniyu-pamyati-proczessa","title":{"rendered":"A vulnerability in OpenSSL 3.0.4 that leads to remote memory corruption of the process.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
A vulnerability has been discovered in the OpenSSL cryptographic library (CVE not yet assigned), which allows a remote attacker to corrupt the memory contents of a process by sending specially crafted data during the establishment of a TLS connection. It is still unclear whether this issue could lead to the execution of the attacker's code and data leakage from process memory, or if it is limited to causing a crash. <\/p>\n
The vulnerability was identified in OpenSSL version 3.0.4, released on June 21, and is caused by an incorrect fix for an error in the code, which allows up to 8192 bytes of data to be read or written outside the allocated buffer. Exploitation of the vulnerability is only possible on x86_64 systems with AVX512 instruction support. <\/p>\n
Branches of OpenSSL, such as BoringSSL and LibreSSL, as well as the OpenSSL 1.1.1 branch, are not affected by this issue. A fix is currently available only as a patch. In the worst-case scenario, this problem could be more dangerous than the Heartbleed vulnerability, but the threat level is mitigated by the fact that the vulnerability only affects OpenSSL version 3.0.4, while many distributions continue to provide the 1.1.1 branch by default or have not yet packaged updates for version 3.0.4. \n Source: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"