The GOST ENGINE in OpenSSL before 1.0.0f does not properly handle invalid parameters for the GOST block cipher, which allows remote attackers to cause a denial of service (daemon crash) via crafted data from a TLS client.
CVSS Details
- CVSS 3.1 Base Score: 5.3
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade openssl | Jul 30, 2024 | Jan 6, 2012 |
| Freebsd | — | Upgrade openssl | Dec 10, 2025 | Jan 14, 2012 |
| Gentoo Linux | — | Upgrade dev-libs/openssl. | Oct 30, 2017 | Jan 5, 2012 |
| Hpsmh | — | Upgrade to the latest version of HP System Management Homepage | Oct 13, 2015 | Jan 5, 2012 |
| Http Openssl | — | Upgrade to the latest version of OpenSSL | Jan 26, 2012 | Jan 6, 2012 |
| Oracle Solaris | — | Upgrade library/security/openssl to version 1.0.0.7-0.175.0.5.0.3.0 on Solaris 11.0 | May 29, 2017 | Jan 5, 2012 |
| Suse | — | Upgrade libopenssl1_1-32bitUpgrade openssl1Upgrade libopenssl1-develUpgrade libopenssl-1_1-develUpgrade libopenssl1_0_0-hmac-32bitUpgrade libopenssl-fips-providerUpgrade openssl-1_0_0Upgrade libopenssl1_1-hmacUpgrade libopenssl-1_0_0-develUpgrade openssl-1_0_0-docUpgrade libopenssl1_0_0-hmacUpgrade openssl1-docUpgrade openssl-docUpgrade libopenssl1_0_0Upgrade openssl-1_1Upgrade libopenssl-1_1-devel-32bitUpgrade libopenssl1_1-hmac-32bitUpgrade libopenssl1_0_0-32bitUpgrade opensslUpgrade libopenssl-develUpgrade libopenssl1_1 | Feb 17, 2015 | Jun 28, 2013 |
| Ubuntu | — | Upgrade opensslUpgrade libssl1.0.0Upgrade libssl0.9.8 | Nov 8, 2024 | Jan 6, 2012 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub