CVE-2022-2097

CVSS V2 Medium 5 CVSS V3 Medium 5.3
Description
AES OCB mode for 32-bit x86 platforms using the AES-NI assembly optimised implementation will not encrypt the entirety of the data under some circumstances. This could reveal sixteen bytes of data that was preexisting in the memory that wasn't written. In the special case of "in place" encryption, sixteen bytes of the plaintext would be revealed. Since OpenSSL does not support OCB based cipher suites for TLS and DTLS, they are both unaffected. Fixed in OpenSSL 3.0.5 (Affected 3.0.0-3.0.4). Fixed in OpenSSL 1.1.1q (Affected 1.1.1-1.1.1p).
Overview
  • CVE ID
  • CVE-2022-2097
  • Assigner
  • openssl-security@openssl.org
  • Vulnerability Status
  • Modified
  • Published Version
  • 2022-07-05T11:15:08
  • Last Modified Date
  • 2023-04-20T09:15:07
Weakness Enumerations
CWE URL
CWE-326 http://cwe.mitre.org/data/definitions/326.html
CPE Configuration (Product)
CPE Vulnerable Operator Version Start Version End
AND
cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:* 1 OR 1.1.1 1.1.1q
cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:* 1 OR 3.0.0 3.0.5
AND
cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:* 1 OR
AND
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:* 1 OR
cpe:2.3:a:netapp:clustered_data_ontap_antivirus_connector:-:*:*:*:*:*:*:* 1 OR
AND
cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:* 1 OR
cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:* 1 OR
cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:* 1 OR
cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:netapp:h410c_firmware:-:*:*:*:*:*:*:* 1 OR
cpe:2.3:h:netapp:h410c:-:*:*:*:*:*:*:* 0 OR
CVSS Version 2
  • Version
  • 2.0
  • Vector String
  • AV:N/AC:L/Au:N/C:P/I:N/A:N
  • Access Vector
  • NETWORK
  • Access Compatibility
  • LOW
  • Authentication
  • NONE
  • Confidentiality Impact
  • PARTIAL
  • Integrity Impact
  • NONE
  • Availability Impact
  • NONE
  • Base Score
  • 5
  • Severity
  • MEDIUM
  • Exploitability Score
  • 10
  • Impact Score
  • 2.9
CVSS Version 3
  • Version
  • 3.1
  • Vector String
  • CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
  • Attack Vector
  • NETWORK
  • Attack Compatibility
  • LOW
  • Privileges Required
  • NONE
  • User Interaction
  • NONE
  • Scope
  • UNCHANGED
  • Confidentiality Impact
  • LOW
  • Availability Impact
  • NONE
  • Base Score
  • 5.3
  • Base Severity
  • MEDIUM
  • Exploitability Score
  • 3.9
  • Impact Score
  • 1.4
References
Reference URL Reference Tags
https://cert-portal.siemens.com/productcert/pdf/ssa-332410.pdf Third Party Advisory
https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=919925673d6c9cfed3c1085497f5dfbbed5fc431 Mailing List Patch Vendor Advisory
https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=a98f339ddd7e8f487d6e0088d4a9a42324885a93 Mailing List Patch Vendor Advisory
https://lists.debian.org/debian-lts-announce/2023/02/msg00019.html Mailing List Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/R6CK57NBQFTPUMXAPJURCGXUYT76NQAK/ Mailing List Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/V6567JERRHHJW2GNGJGKDRNHR7SNPZK7/ Mailing List Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VCMNWKERPBKOEBNL7CLTTX3ZZCZLH7XA/ Mailing List Third Party Advisory
https://security.gentoo.org/glsa/202210-02 Third Party Advisory
https://security.netapp.com/advisory/ntap-20220715-0011/ Third Party Advisory
https://security.netapp.com/advisory/ntap-20230420-0008/
https://www.debian.org/security/2023/dsa-5343 Third Party Advisory
https://www.openssl.org/news/secadv/20220705.txt Vendor Advisory
Sources
Source Name Source URL
NIST https://nvd.nist.gov/vuln/detail/CVE-2022-2097
MITRE https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-2097
History
Created Old Value New Value Data Type Notes
2022-07-05 12:00:06 Added to TrackCVE
2023-01-10 13:17:18 2023-01-10T13:15:14 CVE Modified Date updated
2023-01-10 13:17:18 Analyzed Modified Vulnerability Status updated
2023-01-10 13:17:19 References updated
2023-01-12 05:14:33 Modified Undergoing Analysis Vulnerability Status updated
2023-02-09 00:15:55 2023-02-09T00:15:11 CVE Modified Date updated
2023-02-09 00:15:56 References updated
2023-02-20 14:12:31 2023-02-20T13:15:10 CVE Modified Date updated
2023-02-20 14:12:32 References updated
2023-02-23 17:13:28 2023-02-23T16:14:24 CVE Modified Date updated
2023-02-23 17:13:28 Undergoing Analysis Analyzed Vulnerability Status updated
2023-04-20 10:05:27 2023-04-20T09:15:07 CVE Modified Date updated
2023-04-20 10:05:27 Analyzed Modified Vulnerability Status updated
2023-04-20 10:05:28 References updated