CVE-2022-2097: AES OCB fails to encrypt some bytes
First published: Tue Jul 05 2022(Updated: )
AES OCB mode for 32-bit x86 platforms using the AES-NI assembly optimised implementation will not encrypt the entirety of the data under some circumstances. This could reveal sixteen bytes of data that was preexisting in the memory that wasn't written. In the special case of "in place" encryption, sixteen bytes of the plaintext would be revealed. OpenSSL security advisory: <a href="https://www.openssl.org/news/secadv/20220705.txt">https://www.openssl.org/news/secadv/20220705.txt</a> Upstream fix: <a href="https://github.com/openssl/openssl/commit/6ebf6d51596f51d23ccbc17930778d104a57d99c">https://github.com/openssl/openssl/commit/6ebf6d51596f51d23ccbc17930778d104a57d99c</a> [master] <a href="https://github.com/openssl/openssl/commit/919925673d6c9cfed3c1085497f5dfbbed5fc431">https://github.com/openssl/openssl/commit/919925673d6c9cfed3c1085497f5dfbbed5fc431</a> [1_1_1-stable] <a href="https://github.com/openssl/openssl/commit/a98f339ddd7e8f487d6e0088d4a9a42324885a93">https://github.com/openssl/openssl/commit/a98f339ddd7e8f487d6e0088d4a9a42324885a93</a> [openssl-3.0]
Credit: openssl-security@openssl.org openssl-security@openssl.org openssl-security@openssl.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/openssl | <1:1.1.1k-7.el8_6 | 1:1.1.1k-7.el8_6 |
| redhat/openssl | <1:3.0.1-41.el9_0 | 1:3.0.1-41.el9_0 |
| IBM Cognos Analytics | <=12.0.0-12.0.1 | |
| IBM Cognos Analytics | <=11.2.0-11.2.4 FP2 | |
| IBM Cognos Analytics | <=11.1.1-11.1.7 FP7 | |
| redhat/openssl | <1.1.1 | 1.1.1 |
| redhat/openssl | <3.0.5 | 3.0.5 |
| OpenSSL OpenSSL | >=1.1.1<1.1.1q | |
| OpenSSL OpenSSL | >=3.0.0<3.0.5 | |
| Fedoraproject Fedora | =35 | |
| Fedoraproject Fedora | =36 | |
| Netapp Active Iq Unified Manager Vmware Vsphere | ||
| Netapp Clustered Data Ontap Antivirus Connector | ||
| Netapp H300s Firmware | ||
| Netapp H300s Firmware | ||
| Netapp H500s Firmware | ||
| Netapp H500s | ||
| Netapp H700s Firmware | ||
| Netapp H700s | ||
| Netapp H410s Firmware | ||
| Netapp H410s | ||
| Netapp H410c Firmware | ||
| Netapp H410c | ||
| Siemens Sinec Ins | <1.0 | |
| Siemens Sinec Ins | =1.0 | |
| Siemens Sinec Ins | =1.0-sp1 | |
| Siemens Sinec Ins | =1.0-sp2 | |
| Debian Debian Linux | =10.0 | |
| Debian Debian Linux | =11.0 | |
| All of | ||
| Netapp H300s Firmware | ||
| Netapp H300s Firmware | ||
| All of | ||
| Netapp H500s Firmware | ||
| Netapp H500s | ||
| All of | ||
| Netapp H700s | ||
| Netapp H700s Firmware | ||
| All of | ||
| Netapp H410s | ||
| Netapp H410s Firmware | ||
| All of | ||
| Netapp H410c | ||
| Netapp H410c Firmware | ||
| rust/openssl-src | <111.22.0 | 111.22.0 |
| rust/openssl-src | >=300.0.0<300.0.9 | 300.0.9 |
| debian/openssl | 1.1.1w-0+deb11u1 1.1.1w-0+deb11u2 3.0.15-1~deb12u1 3.0.14-1~deb12u2 3.4.0-2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.cve.org/CVERecord?id=CVE-2022-2097 https://nvd.nist.gov/vuln/detail/CVE-2022-2097 https://www.openssl.org/news/secadv/20220705.txt
- https://bugzilla.redhat.com/show_bug.cgi?id=2104905
- https://access.redhat.com/errata/RHSA-2022:5818
- https://access.redhat.com/errata/RHSA-2022:6224
- https://access.redhat.com/security/cve/cve-2022-2097
- https://security-tracker.debian.org/tracker/CVE-2022-1292
- https://nvd.nist.gov/vuln/detail/CVE-2022-1292]
- https://security-tracker.debian.org/tracker/CVE-2022-2068
- https://nvd.nist.gov/vuln/detail/CVE-2022-2068]
- https://security-tracker.debian.org/tracker/CVE-2022-2097
- https://nvd.nist.gov/vuln/detail/CVE-2022-2097]
- https://github.com/openssl/openssl/releases/tag/OpenSSL_1_1_1s]
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1023424
- https://exchange.xforce.ibmcloud.com/vulnerabilities/230425
- https://www.ibm.com/support/pages/node/7123154 (Advisory)
- https://www.openssl.org/news/secadv/20220705.txt
- https://github.com/openssl/openssl/commit/6ebf6d51596f51d23ccbc17930778d104a57d99c
- https://github.com/openssl/openssl/commit/919925673d6c9cfed3c1085497f5dfbbed5fc431
- https://github.com/openssl/openssl/commit/a98f339ddd7e8f487d6e0088d4a9a42324885a93
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2105034
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2105035
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2105036
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2105037
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2105032
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2105033
- https://cert-portal.siemens.com/productcert/pdf/ssa-332410.pdf
- https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=919925673d6c9cfed3c1085497f5dfbbed5fc431
- https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=a98f339ddd7e8f487d6e0088d4a9a42324885a93
- https://lists.debian.org/debian-lts-announce/2023/02/msg00019.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/R6CK57NBQFTPUMXAPJURCGXUYT76NQAK/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/V6567JERRHHJW2GNGJGKDRNHR7SNPZK7/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VCMNWKERPBKOEBNL7CLTTX3ZZCZLH7XA/
- https://security.gentoo.org/glsa/202210-02
- https://security.netapp.com/advisory/ntap-20220715-0011/
- https://security.netapp.com/advisory/ntap-20230420-0008/
- https://www.debian.org/security/2023/dsa-5343
- https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=919925673d6c9cfed3c1085497f5dfbbed5fc431
- https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=a98f339ddd7e8f487d6e0088d4a9a42324885a93
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R6CK57NBQFTPUMXAPJURCGXUYT76NQAK/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V6567JERRHHJW2GNGJGKDRNHR7SNPZK7/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VCMNWKERPBKOEBNL7CLTTX3ZZCZLH7XA/
- https://security.netapp.com/advisory/ntap-20240621-0006/
- https://nvd.nist.gov/vuln/detail/CVE-2022-2097
- https://rustsec.org/advisories/RUSTSEC-2022-0032.html
- https://security.netapp.com/advisory/ntap-20240621-0006
- https://security.netapp.com/advisory/ntap-20230420-0008
- https://security.netapp.com/advisory/ntap-20220715-0011
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VCMNWKERPBKOEBNL7CLTTX3ZZCZLH7XA
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/V6567JERRHHJW2GNGJGKDRNHR7SNPZK7
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/R6CK57NBQFTPUMXAPJURCGXUYT76NQAK
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VCMNWKERPBKOEBNL7CLTTX3ZZCZLH7XA
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V6567JERRHHJW2GNGJGKDRNHR7SNPZK7
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R6CK57NBQFTPUMXAPJURCGXUYT76NQAK
- https://github.com/advisories/GHSA-3wx7-46ch-7rq2 (Advisory)
- https://launchpad.net/bugs/cve/CVE-2022-2097
- https://git.openssl.org/gitweb/?p=openssl.git;a=commit;h=a98f339ddd7e8f487d6e0088d4a9a42324885a93
- https://git.openssl.org/gitweb/?p=openssl.git;a=commit;h=919925673d6c9cfed3c1085497f5dfbbed5fc431
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-2097
- https://ubuntu.com/security/CVE-2022-2097
Frequently Asked Questions
What is the severity of CVE-2022-2097?
The severity of CVE-2022-2097 is high.
Which platforms are affected by CVE-2022-2097?
CVE-2022-2097 affects 32-bit x86 platforms.
What is the impacted software for CVE-2022-2097?
The impacted software for CVE-2022-2097 is OpenSSL.
How can I fix CVE-2022-2097?
To fix CVE-2022-2097, update OpenSSL to version 1.1.1 or higher.
Where can I find more information about CVE-2022-2097?
For more information about CVE-2022-2097, you can refer to the following references: [Link 1](https://security-tracker.debian.org/tracker/CVE-2022-1292), [Link 2](https://nvd.nist.gov/vuln/detail/CVE-2022-1292), [Link 3](https://security-tracker.debian.org/tracker/CVE-2022-2068).
- collector/redhat-cve
- collector/debian-bugs
- alias/CVE-2022-2097
- agent/type
- agent/remedy
- agent/first-publish-date
- agent/author
- collector/ibm-support
- source/IBM
- agent/software-canonical-lookup
- collector/redhat-bugzilla
- source/Red Hat
- collector/nvd-index
- agent/software-canonical-lookup-request
- agent/title
- collector/nvd-api
- source/NVD
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-3wx7-46ch-7rq2
- agent/weakness
- agent/severity
- collector/launchpad-cve
- source/Launchpad
- collector/github-advisory
- collector/nvd-cve
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- collector/usn-cve
- source/Ubuntu
- agent/references
- agent/tags
- agent/event
- agent/description
- collector/security-tracker-debian
- source/Debian
- agent/softwarecombine
- agent/trending
- package-manager/redhat
- vendor/ibm
- canonical/ibm cognos analytics
- version/ibm cognos analytics/12.0.0-12.0.1
- version/ibm cognos analytics/11.2.0-11.2.4 fp2
- version/ibm cognos analytics/11.1.1-11.1.7 fp7
- vendor/openssl
- canonical/openssl openssl
- version/openssl openssl/1.1.1
- version/openssl openssl/3.0.0
- vendor/fedoraproject
- canonical/fedoraproject fedora
- version/fedoraproject fedora/35
- version/fedoraproject fedora/36
- vendor/netapp
- canonical/netapp active iq unified manager vmware vsphere
- canonical/netapp clustered data ontap antivirus connector
- canonical/netapp h300s firmware
- canonical/netapp h500s firmware
- canonical/netapp h500s
- canonical/netapp h700s firmware
- canonical/netapp h700s
- canonical/netapp h410s firmware
- canonical/netapp h410s
- canonical/netapp h410c firmware
- canonical/netapp h410c
- vendor/siemens
- canonical/siemens sinec ins
- version/siemens sinec ins/1.0
- version/siemens sinec ins/1.0-sp1
- version/siemens sinec ins/1.0-sp2
- vendor/debian
- canonical/debian debian linux
- version/debian debian linux/10.0
- version/debian debian linux/11.0
- package-manager/rust
- package-manager/debian