| Package | Affected versions | Patched versions |
|---|---|---|
| openssl | ≥ 1.0.0, < 1.0.0t≥ 1.0.1, < 1.0.1q≥ 1.0.2, < 1.0.2e< 0.9.8zh | 1.0.0t1.0.1q1.0.2e0.9.8zh |
| api gateway | = 11.1.2.3.0= 11.1.2.4.0 | |
| communications webrtc session controller | = 7.0= 7.1= 7.2 | |
| exalogic infrastructure | = 1.0= 2.0 | |
| http server | = 11.5.10.2 | |
| life sciences data hub | = 2.1 | |
| sun ray software | = 11.1 | |
| transportation management | = 6.1= 6.2 | |
| vm server | = 3.2 | |
| vm virtualbox | ≥ 5.0.0, < 5.0.14< 4.3.36 | 5.0.144.3.36 |
The ASN1_TFLG_COMBINE implementation in crypto/asn1/tasn_dec.c in OpenSSL before 0.9.8zh, 1.0.0 before 1.0.0t, 1.0.1 before 1.0.1q, and 1.0.2 before 1.0.2e mishandles errors caused by malformed X509_ATTRIBUTE data, which allows remote attackers to obtain sensitive information from process memory by triggering a decoding failure in a PKCS#7 or CMS application.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free