Issue summary: The AES-SIV cipher implementation contains a bug that causes it to ignore empty associated data entries which are unauthenticated as a consequence.
Impact summary: Applications that use the AES-SIV algorithm and want to authenticate empty data entries as associated data can be misled by removing, adding or reordering such empty entries as these are ignored by the OpenSSL implementation. We are currently unaware of any such applications.
The AES-SIV algorithm allows for authentication of multiple associated data entries along with the encryption. To authenticate empty data the application has to call EVP_EncryptUpdate() (or EVP_CipherUpdate()) with NULL pointer as the output buffer and 0 as the input buffer length. The AES-SIV implementation in OpenSSL just returns success for such a call instead of performing the associated data authentication operation. The empty data thus will not be authenticated.
As this issue does not affect non-empty associated data authentication and we expect it to be rare for an application to use empty associated data entries this is qualified as Low severity issue.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade openssl-perlUpgrade openssl-libsUpgrade opensslUpgrade openssl-devel | May 8, 2024 | Jul 14, 2023 |
| Alpine Linux | — | Upgrade opensslUpgrade openssl3 | Aug 22, 2024 | Jul 14, 2023 |
| Amazon_linux_2023 | — | Upgrade openssl-libs-debuginfoUpgrade openssl-develUpgrade openssl-perlUpgrade openssl-libsUpgrade opensslUpgrade openssl-debugsourceUpgrade openssl-debuginfo | Feb 17, 2025 | Jul 7, 2023 |
| Debian | — | Upgrade openssl | Jul 30, 2024 | Jul 14, 2023 |
| Freebsd | — | Upgrade openssl30Upgrade openssl31 | Jul 18, 2023 | Jul 16, 2023 |
| Gentoo Linux | — | Upgrade dev-libs/openssl. | Feb 5, 2024 | Jul 14, 2023 |
| Http Openssl | — | Upgrade to the latest version of OpenSSL | Jun 5, 2024 | Jul 14, 2023 |
| Ibm Aix | — | Apply the fix or workaround for openssl_advisory39 | Sep 12, 2023 | Jul 14, 2023 |
| Oracle_linux | — | Upgrade openssl-develUpgrade openssl-fips-providerUpgrade openssl-libsUpgrade opensslUpgrade openssl-perl | May 7, 2024 | Jul 7, 2023 |
| Rapid7 Insightagent | — | — | Mar 19, 2024 | Jul 14, 2023 |
| Redhat_linux | — | Upgrade openssl-perlUpgrade openssl-libsUpgrade openssl-fips-provider-debuginfoUpgrade openssl-develUpgrade openssl-fips-provider-debugsourceUpgrade openssl-debuginfoUpgrade openssl-fips-providerUpgrade opensslUpgrade openssl-libs-debuginfoUpgrade openssl-debugsource | May 1, 2024 | Jul 14, 2023 |
| Rocky_linux | — | Upgrade openssl-libs-debuginfoUpgrade openssl-fips-provider-debugsourceUpgrade openssl-libsUpgrade openssl-perlUpgrade openssl-develUpgrade openssl-fips-provider-debuginfoUpgrade openssl-debuginfoUpgrade opensslUpgrade openssl-fips-providerUpgrade openssl-debugsource | Jul 16, 2024 | Jul 14, 2023 |
| Suse | — | Upgrade libopenssl3Upgrade libopenssl-3-devel-32bitUpgrade openssl-3-docUpgrade openssl-3Upgrade libopenssl-3-develUpgrade libopenssl3-32bit | Jul 31, 2023 | Jul 14, 2023 |
| Ubuntu | — | Upgrade libssl3 | Oct 25, 2023 | Jul 14, 2023 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Jul 14, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub