CVE - CVE-2022-2097

CVE-ID
CVE-2022-2097	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
AES OCB mode for 32-bit x86 platforms using the AES-NI assembly optimised implementation will not encrypt the entirety of the data under some circumstances. This could reveal sixteen bytes of data that was preexisting in the memory that wasn't written. In the special case of "in place" encryption, sixteen bytes of the plaintext would be revealed. Since OpenSSL does not support OCB based cipher suites for TLS and DTLS, they are both unaffected. Fixed in OpenSSL 3.0.5 (Affected 3.0.0-3.0.4). Fixed in OpenSSL 1.1.1q (Affected 1.1.1-1.1.1p).
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
CONFIRM:https://cert-portal.siemens.com/productcert/pdf/ssa-332410.pdf CONFIRM:https://security.netapp.com/advisory/ntap-20220715-0011/ CONFIRM:https://security.netapp.com/advisory/ntap-20230420-0008/ CONFIRM:https://security.netapp.com/advisory/ntap-20240621-0006/ CONFIRM:https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=919925673d6c9cfed3c1085497f5dfbbed5fc431 URL:https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=919925673d6c9cfed3c1085497f5dfbbed5fc431 CONFIRM:https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=a98f339ddd7e8f487d6e0088d4a9a42324885a93 URL:https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=a98f339ddd7e8f487d6e0088d4a9a42324885a93 CONFIRM:https://www.openssl.org/news/secadv/20220705.txt URL:https://www.openssl.org/news/secadv/20220705.txt DEBIAN:DSA-5343 URL:https://www.debian.org/security/2023/dsa-5343 FEDORA:FEDORA-2022-3fdc2d3047 URL:https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/V6567JERRHHJW2GNGJGKDRNHR7SNPZK7/ FEDORA:FEDORA-2022-41890e9e44 URL:https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VCMNWKERPBKOEBNL7CLTTX3ZZCZLH7XA/ FEDORA:FEDORA-2022-89a17be281 URL:https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/R6CK57NBQFTPUMXAPJURCGXUYT76NQAK/ GENTOO:GLSA-202210-02 URL:https://security.gentoo.org/glsa/202210-02 MLIST:[debian-lts-announce] 20230220 [SECURITY] [DLA 3325-1] openssl security update URL:https://lists.debian.org/debian-lts-announce/2023/02/msg00019.html
Assigning CNA
OpenSSL Software Foundation
Date Record Created
20220616	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20220616)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)