CVE-2012-0884

medium · 5

The implementation of Cryptographic Message Syntax (CMS) and PKCS #7 in OpenSSL before 0.9.8u and 1.x before 1.0.0h does not properly restrict certain oracle behavior, which makes it easier for context-dependent attackers to decrypt data via a Million Message Attack (MMA) adaptive chosen ciphertext attack.

CVSS

13.7%

EPSS (exploit prob.)

96th

EPSS percentile

2012-03-13

Published

AV:N/AC:L/Au:N/C:P/I:N/A:N

Weaknesses

CWE-310

Affected products

Vendor	Product	Affected versions
openssl	openssl	<= 0.9.8t
openssl	openssl	0.9.0b
openssl	openssl	0.9.1b
openssl	openssl	0.9.1c
openssl	openssl	0.9.2b
openssl	openssl	0.9.3
openssl	openssl	0.9.3a
openssl	openssl	0.9.4
openssl	openssl	0.9.5
openssl	openssl	0.9.5a
openssl	openssl	0.9.6
openssl	openssl	0.9.6a
openssl	openssl	0.9.6b
openssl	openssl	0.9.6c
openssl	openssl	0.9.6d
openssl	openssl	0.9.6e
openssl	openssl	0.9.6f
openssl	openssl	0.9.6g
openssl	openssl	0.9.6h
openssl	openssl	0.9.6i
openssl	openssl	0.9.6j
openssl	openssl	0.9.6k
openssl	openssl	0.9.6l
openssl	openssl	0.9.6m
openssl	openssl	0.9.7
openssl	openssl	0.9.7a
openssl	openssl	0.9.7b
openssl	openssl	0.9.7c
openssl	openssl	0.9.7d
openssl	openssl	0.9.7e
openssl	openssl	0.9.7f
openssl	openssl	0.9.7g
openssl	openssl	0.9.7h
openssl	openssl	0.9.7i
openssl	openssl	0.9.7j
openssl	openssl	0.9.7k
openssl	openssl	0.9.7l
openssl	openssl	0.9.7m
openssl	openssl	0.9.8
openssl	openssl	0.9.8a

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2012-0884