CVE-2022-29242

HOCH 7.5CVE-2022-29242 · Published 24/05/2022 · updated 17/06/2026

Kurz gesagt

CVE-2022-29242 ist eine Schwachstelle (HOCH (CVSS 7.5)) in gost engine (gost engine project).
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 1.7%, höher als bei 77.5% aller Schwachstellen.
Abhilfe: auf 3.0.1 oder neuer aktualisieren.

Package	Affected versions	Patched versions
gost engine gost_engine_project	`< 3.0.1`	`3.0.1`

Description

GOST engine is a reference implementation of the Russian GOST crypto algorithms for OpenSSL. TLS clients using GOST engine when ciphersuite `TLS_GOSTR341112_256_WITH_KUZNYECHIK_CTR_OMAC` is agreed and the server uses 512 bit GOST secret keys are vulnerable to buffer overflow. GOST engine version 3.0.1 contains a patch for this issue. Disabling ciphersuite `TLS_GOSTR341112_256_WITH_KUZNYECHIK_CTR_OMAC` is a possible workaround.

References

gost-engine/engine commit 7df7661 · Patch
gost-engine/engine commit b2b4d62 · Patch
gost-engine/engine commit c6655a0 · Patch
gost-engine/engine release v3.0.1 · Release Notes
gost-engine/engine security advisory · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free