Use of a Broken or Risky Cryptographic Algorithm Affecting openssl package, versions >=3.0.0
Snyk CVSS
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-RUBY-OPENSSL-6149517
- published 10 Jan 2024
- disclosed 9 Jan 2024
- credit Sverker Eriksson
Introduced: 9 Jan 2024
CVE-2023-6129 Open this link in a new tabHow to fix?
There is no fixed version for openssl.
Overview
openssl is a package that wraps the OpenSSL library.
Affected versions of this package are vulnerable to Use of a Broken or Risky Cryptographic Algorithm due to an issue in the POLY1305 MAC implementation on PowerPC CPUs. An attacker can corrupt the application state and cause incorrect calculations or potential denial of service by influencing the use of the POLY1305 MAC algorithm.
Note:
This is only exploitable if the attacker has the ability to affect the algorithm's usage and the application relies on non-volatile XMM registers.