CVE-2011-1945: Low severity openssl vulnerability

Q: What is the severity of CVE-2011-1945?

CVE-2011-1945 is classified as a high severity vulnerability due to its potential impact on cryptographic operations.

Q: How do I fix CVE-2011-1945?

To fix CVE-2011-1945, you should upgrade OpenSSL to a version later than 1.0.0d.

Q: Which versions of OpenSSL are affected by CVE-2011-1945?

CVE-2011-1945 affects OpenSSL versions up to and including 1.0.0d, as well as several older versions.

Q: What types of attacks can exploit CVE-2011-1945?

CVE-2011-1945 can potentially be exploited by attackers to gain unauthorized access to sensitive information through weak cryptographic implementations.

Q: Is CVE-2011-1945 a client-side or server-side vulnerability?

CVE-2011-1945 is primarily a server-side vulnerability, affecting how servers handle elliptic curve cryptography.

Published May 31, 2011

Updated

The elliptic curve cryptography (ECC) subsystem in OpenSSL 1.0.0d and earlier, when the Elliptic Curve Digital Signature Algorithm (ECDSA) is used for the ECDHEECDSA cipher suite, does not properly implement curves over binary fields, which makes it easier for context-dependent attackers to determine private keys via a timing attack and a lattice calculation.

Affected Software

78 affected components

OpenSSL OpenSSL=0.9.7-beta5

OpenSSL OpenSSL=0.9.7-beta3

OpenSSL OpenSSL=0.9.5a-beta2

OpenSSL OpenSSL=0.9.7-beta6

OpenSSL OpenSSL=0.9.8b

OpenSSL OpenSSL=0.9.7l

OpenSSL OpenSSL=0.9.6i

OpenSSL OpenSSL=0.9.8m

OpenSSL OpenSSL=0.9.3

OpenSSL OpenSSL=0.9.8c

OpenSSL OpenSSL=0.9.7-beta2

OpenSSL OpenSSL=1.0.0c

OpenSSL OpenSSL=0.9.7c

OpenSSL OpenSSL=1.0.0-beta1

OpenSSL OpenSSL=0.9.5-beta1

OpenSSL OpenSSL=0.9.8n

OpenSSL OpenSSL=1.0.0-beta2

OpenSSL OpenSSL=0.9.8p

OpenSSL OpenSSL=0.9.6d

OpenSSL OpenSSL=0.9.1c

OpenSSL OpenSSL=0.9.6

OpenSSL OpenSSL=0.9.7j

OpenSSL OpenSSL=0.9.6a

OpenSSL OpenSSL=0.9.8e

OpenSSL OpenSSL=0.9.4

OpenSSL OpenSSL=0.9.8g

OpenSSL OpenSSL=0.9.6a-beta2

OpenSSL OpenSSL=0.9.8k

OpenSSL OpenSSL=0.9.8d

OpenSSL OpenSSL=0.9.5a

OpenSSL OpenSSL=1.0.0-beta3

OpenSSL OpenSSL=0.9.6f

OpenSSL OpenSSL=0.9.8j

OpenSSL OpenSSL=0.9.6-beta3

OpenSSL OpenSSL=0.9.6l

OpenSSL OpenSSL=0.9.7k

OpenSSL OpenSSL=0.9.7g

OpenSSL OpenSSL=0.9.6e

OpenSSL OpenSSL=0.9.7d

OpenSSL OpenSSL=0.9.8l

OpenSSL OpenSSL=0.9.7

OpenSSL OpenSSL=0.9.6b

OpenSSL OpenSSL=0.9.7e

OpenSSL OpenSSL=0.9.7b

OpenSSL OpenSSL=0.9.6a-beta1

OpenSSL OpenSSL=1.0.0-beta4

OpenSSL OpenSSL=0.9.6k

OpenSSL OpenSSL=0.9.8a

OpenSSL OpenSSL=0.9.6g

OpenSSL OpenSSL=0.9.6-beta2

OpenSSL OpenSSL=0.9.7m

OpenSSL OpenSSL=0.9.7-beta4

OpenSSL OpenSSL=0.9.3a

OpenSSL OpenSSL=0.9.6h

OpenSSL OpenSSL=1.0.0

OpenSSL OpenSSL=0.9.7-beta1

OpenSSL OpenSSL=0.9.7i

OpenSSL OpenSSL=0.9.7h

OpenSSL OpenSSL=0.9.8o

OpenSSL OpenSSL=1.0.0-beta5

OpenSSL OpenSSL=0.9.6j

OpenSSL OpenSSL<=1.0.0d

OpenSSL OpenSSL=0.9.8

OpenSSL OpenSSL=0.9.7a

OpenSSL OpenSSL=0.9.6c

OpenSSL OpenSSL=0.9.6-beta1

OpenSSL OpenSSL=0.9.6m

OpenSSL OpenSSL=0.9.8i

OpenSSL OpenSSL=0.9.8f

OpenSSL OpenSSL=0.9.5-beta2

OpenSSL OpenSSL=1.0.0a

OpenSSL OpenSSL=0.9.8h

OpenSSL OpenSSL=0.9.2b

OpenSSL OpenSSL=0.9.5

OpenSSL OpenSSL=0.9.5a-beta1

OpenSSL OpenSSL=1.0.0b

OpenSSL OpenSSL=0.9.6a-beta3

OpenSSL OpenSSL=0.9.7f

Event History

May 31, 2011

CVE Published

via MITRE·08:00 PM

Data Sourced

via MITRE·08:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2011-1945?

CVE-2011-1945 is classified as a high severity vulnerability due to its potential impact on cryptographic operations.

How do I fix CVE-2011-1945?

To fix CVE-2011-1945, you should upgrade OpenSSL to a version later than 1.0.0d.

Which versions of OpenSSL are affected by CVE-2011-1945?