TI-2023-00208 CVE-2023-0215 · GHSA-r7jw-wp68-3xch
Use-after-free following BIO_new_NDEF
Priority MEDIUM 47
The public API function BIO_new_NDEF is a helper function used for streaming ASN.1 data via a BIO.
Vulnerabilities
8 records
TI-2023-00209 CVE-2023-0216 · GHSA-29xx-hcv2-c4cp
Invalid pointer dereference in d2i_PKCS7 functions
Priority MEDIUM 43
An invalid pointer dereference on read can be triggered when an application tries to load malformed PKCS7 data with the d2i_PKCS7(), d2i_PKCS7_bio() or d2i_PKCS7_fp() functions.
TI-2023-00271 CVE-2023-0286 · GHSA-x4qr-2fvf-3mr5
X.400 address type confusion in X.509 GeneralName
Priority HIGH 70
There is a type confusion vulnerability relating to X.400 address processing inside an X.509 GeneralName.
TI-2023-00382 CVE-2023-0401 · GHSA-vrh7-x64v-7vxq
NULL dereference during PKCS7 data verification
Priority MEDIUM 43
A NULL pointer can be dereferenced when signatures are being verified on PKCS7 signed or signedAndEnveloped data.
TI-2022-13925 CVE-2022-32215 · GHSA-5492-mr68-4m2h
The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does…
Priority HIGH 66
The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly handle multi-line Transfer-Encoding headers.
TI-2022-13924 CVE-2022-32214 · GHSA-q5vx-44v4-gch4
The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does…
Priority HIGH 69
The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not strictly use the CRLF sequence to delimit HTTP requests.
TI-2022-13923 CVE-2022-32213 · GHSA-5689-v88g-g6rv
The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does…
Priority MEDIUM 58
The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly parse and validate Transfer-Encoding headers and can lead to HTTP Request Smuggling (HRS).
TI-2002-02356 CVE-2002-20001 · GHSA-jx4r-qc68-xjr5
The Diffie-Hellman Key Agreement Protocol allows remote attackers (from the client side)…
Priority MEDIUM 54
The Diffie-Hellman Key Agreement Protocol allows remote attackers (from the client side) to send arbitrary numbers that are actually not public keys, and trigger expensive server-side DHE modular-exponentiation calculati…