Cryptographic Issues Affecting openssl package, versions <0.9.8a-1
Threat Intelligence
EPSS
0.07% (33rd
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-DEBIAN11-OPENSSL-517354
- published 20 Jun 2012
- disclosed 20 Jun 2012
Introduced: 20 Jun 2012
CVE-2011-5095 Open this link in a new tabHow to fix?
Upgrade Debian:11 openssl to version 0.9.8a-1 or higher.
NVD Description
Note: Versions mentioned in the description apply only to the upstream openssl package and not the openssl package as distributed by Debian.
See How to fix? for Debian:11 relevant fixed versions and status.
The Diffie-Hellman key-exchange implementation in OpenSSL 0.9.8, when FIPS mode is enabled, does not properly validate a public parameter, which makes it easier for man-in-the-middle attackers to obtain the shared secret key by modifying network traffic, a related issue to CVE-2011-1923.
CVSS Scores
version 3.1