CVE-2024-41996 Affecting openssl package, versions *
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-UBUNTU2204-OPENSSL-7838287
- published 7 Sep 2024
- disclosed 26 Aug 2024
Introduced: 26 Aug 2024
CVE-2024-41996 Open this link in a new tabHow to fix?
There is no fixed version for Ubuntu:22.04 openssl.
NVD Description
Note: Versions mentioned in the description apply only to the upstream openssl package and not the openssl package as distributed by Ubuntu.
See How to fix? for Ubuntu:22.04 relevant fixed versions and status.
Validating the order of the public keys in the Diffie-Hellman Key Agreement Protocol, when an approved safe prime is used, allows remote attackers (from the client side) to trigger unnecessarily expensive server-side DHE modular-exponentiation calculations. The client may cause asymmetric resource consumption. The basic attack scenario is that the client must claim that it can only communicate with DHE, and the server must be configured to allow DHE and validate the order of the public key.