CVE-2011-4576

medium · 5

The SSL 3.0 implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f does not properly initialize data structures for block cipher padding, which might allow remote attackers to obtain sensitive information by decrypting the padding data sent by an SSL peer.

CVSS

15.6%

EPSS (exploit prob.)

97th

EPSS percentile

2012-01-06

Published

AV:N/AC:L/Au:N/C:P/I:N/A:N

Weaknesses

CWE-310

Affected products

Vendor	Product	Affected versions
openssl	openssl	<= 0.9.8r
openssl	openssl	0.9.1c
openssl	openssl	0.9.2b
openssl	openssl	0.9.4
openssl	openssl	0.9.5
openssl	openssl	0.9.5a
openssl	openssl	0.9.6
openssl	openssl	0.9.6a
openssl	openssl	0.9.6b
openssl	openssl	0.9.6c
openssl	openssl	0.9.6d
openssl	openssl	0.9.6e
openssl	openssl	0.9.6f
openssl	openssl	0.9.6g
openssl	openssl	0.9.6h
openssl	openssl	0.9.6h
openssl	openssl	0.9.6i
openssl	openssl	0.9.6j
openssl	openssl	0.9.6k
openssl	openssl	0.9.6l
openssl	openssl	0.9.6m
openssl	openssl	0.9.7
openssl	openssl	0.9.7a
openssl	openssl	0.9.7b
openssl	openssl	0.9.7c
openssl	openssl	0.9.7d
openssl	openssl	0.9.7e
openssl	openssl	0.9.7f
openssl	openssl	0.9.7g
openssl	openssl	0.9.7h
openssl	openssl	0.9.7i
openssl	openssl	0.9.7j
openssl	openssl	0.9.7k
openssl	openssl	0.9.7l
openssl	openssl	0.9.7m
openssl	openssl	0.9.8
openssl	openssl	0.9.8a
openssl	openssl	0.9.8b
openssl	openssl	0.9.8c
openssl	openssl	0.9.8d

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2011-4576