CVE-2022-2097
First published: Tue Jul 05 2022(Updated: )
AES OCB mode for 32-bit x86 platforms using the AES-NI assembly optimised implementation will not encrypt the entirety of the data under some circumstances. This could reveal sixteen bytes of data that was preexisting in the memory that wasn't written. In the special case of "in place" encryption, sixteen bytes of the plaintext would be revealed. Since OpenSSL does not support OCB based cipher suites for TLS and DTLS, they are both unaffected. Fixed in OpenSSL 3.0.5 (Affected 3.0.0-3.0.4). Fixed in OpenSSL 1.1.1q (Affected 1.1.1-1.1.1p).
Credit: openssl-security@openssl.org openssl-security@openssl.org openssl-security@openssl.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/openssl | <1:1.1.1k-7.el8_6 | 1:1.1.1k-7.el8_6 |
| redhat/openssl | <1:3.0.1-41.el9_0 | 1:3.0.1-41.el9_0 |
| OpenSSL OpenSSL | >=1.1.1<1.1.1q | |
| OpenSSL OpenSSL | >=3.0.0<3.0.5 | |
| Fedoraproject Fedora | =35 | |
| Fedoraproject Fedora | =36 | |
| Apple iPadOS | ||
| Netapp Clustered Data Ontap Antivirus Connector | ||
| Apple macOS Ventura | ||
| Apple macOS Ventura | ||
| Apple macOS Big Sur | ||
| Apple macOS Ventura | ||
| Apple macOS Big Sur | ||
| Apple macOS Monterey | ||
| Apple macOS Monterey | ||
| Apple macOS Monterey | ||
| Netapp H410c Firmware | ||
| Netapp H410c | ||
| Siemens Sinec Ins | <1.0 | |
| Siemens Sinec Ins | =1.0 | |
| Siemens Sinec Ins | =1.0-sp1 | |
| Siemens Sinec Ins | =1.0-sp2 | |
| Debian Debian Linux | =10.0 | |
| Debian Debian Linux | =11.0 | |
| ubuntu/nodejs | <12.22.9~dfsg-1ubuntu3.1 | 12.22.9~dfsg-1ubuntu3.1 |
| ubuntu/openssl | <1.1.1-1ubuntu2.1~18.04.20 | 1.1.1-1ubuntu2.1~18.04.20 |
| ubuntu/openssl | <1.1.1 | 1.1.1 |
| ubuntu/openssl | <1.1.1 | 1.1.1 |
| ubuntu/openssl | <3.0.2-0ubuntu1.6 | 3.0.2-0ubuntu1.6 |
| ubuntu/openssl | <3.0.5-2ubuntu1 | 3.0.5-2ubuntu1 |
| ubuntu/openssl | <3.0.5-2ubuntu1 | 3.0.5-2ubuntu1 |
| ubuntu/openssl | <1.1.1<3.0.5 | 1.1.1 3.0.5 |
| ubuntu/openssl | <3.0.5-2ubuntu1 | 3.0.5-2ubuntu1 |
| redhat/openssl | <1.1.1 | 1.1.1 |
| redhat/openssl | <3.0.5 | 3.0.5 |
| All of | ||
| Apple macOS Ventura | ||
| Apple macOS Ventura | ||
| All of | ||
| Apple macOS Big Sur | ||
| Apple macOS Ventura | ||
| All of | ||
| Apple macOS Big Sur | ||
| Apple macOS Monterey | ||
| All of | ||
| Apple macOS Monterey | ||
| Apple macOS Monterey | ||
| All of | ||
| Netapp H410c Firmware | ||
| Netapp H410c | ||
| debian/openssl | <=1.1.1n-0+deb10u3 | 1.1.1n-0+deb10u6 1.1.1w-0+deb11u1 1.1.1n-0+deb11u5 3.0.11-1~deb12u2 3.1.4-2 3.1.5-1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://security-tracker.debian.org/tracker/CVE-2022-1292
- https://nvd.nist.gov/vuln/detail/CVE-2022-1292]
- https://security-tracker.debian.org/tracker/CVE-2022-2068
- https://nvd.nist.gov/vuln/detail/CVE-2022-2068]
- https://security-tracker.debian.org/tracker/CVE-2022-2097
- https://nvd.nist.gov/vuln/detail/CVE-2022-2097]
- https://github.com/openssl/openssl/releases/tag/OpenSSL_1_1_1s]
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1023424
- https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=919925673d6c9cfed3c1085497f5dfbbed5fc431
- https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=a98f339ddd7e8f487d6e0088d4a9a42324885a93
- https://www.openssl.org/news/secadv/20220705.txt
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/V6567JERRHHJW2GNGJGKDRNHR7SNPZK7/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/R6CK57NBQFTPUMXAPJURCGXUYT76NQAK/
- https://security.netapp.com/advisory/ntap-20220715-0011/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VCMNWKERPBKOEBNL7CLTTX3ZZCZLH7XA/
- https://security.gentoo.org/glsa/202210-02
- https://cert-portal.siemens.com/productcert/pdf/ssa-332410.pdf
- https://www.debian.org/security/2023/dsa-5343
- https://lists.debian.org/debian-lts-announce/2023/02/msg00019.html
- https://security.netapp.com/advisory/ntap-20230420-0008/
- https://launchpad.net/bugs/cve/CVE-2022-2097
- https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=919925673d6c9cfed3c1085497f5dfbbed5fc431
- https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=a98f339ddd7e8f487d6e0088d4a9a42324885a93
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R6CK57NBQFTPUMXAPJURCGXUYT76NQAK/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V6567JERRHHJW2GNGJGKDRNHR7SNPZK7/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VCMNWKERPBKOEBNL7CLTTX3ZZCZLH7XA/
- https://github.com/openssl/openssl/commit/6ebf6d51596f51d23ccbc17930778d104a57d99c
- https://github.com/openssl/openssl/commit/919925673d6c9cfed3c1085497f5dfbbed5fc431
- https://github.com/openssl/openssl/commit/a98f339ddd7e8f487d6e0088d4a9a42324885a93
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2105034
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2105035
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2105036
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2105037
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2105032
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2105033
- https://access.redhat.com/errata/RHSA-2022:5818
- https://access.redhat.com/errata/RHSA-2022:6224
- https://access.redhat.com/security/cve/cve-2022-2097
- https://bugzilla.redhat.com/show_bug.cgi?id=2104905
- https://www.cve.org/CVERecord?id=CVE-2022-2097 https://nvd.nist.gov/vuln/detail/CVE-2022-2097 https://www.openssl.org/news/secadv/20220705.txt
- https://git.openssl.org/gitweb/?p=openssl.git;a=commit;h=a98f339ddd7e8f487d6e0088d4a9a42324885a93
- https://git.openssl.org/gitweb/?p=openssl.git;a=commit;h=919925673d6c9cfed3c1085497f5dfbbed5fc431
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-2097
- https://ubuntu.com/security/notices/USN-5502-1
- https://ubuntu.com/security/notices/USN-6457-1
- https://nvd.nist.gov/vuln/detail/CVE-2022-2097
- https://ubuntu.com/security/CVE-2022-2097
Parent vulnerabilities
(Appears in the following advisories)
Frequently Asked Questions
What is the severity of CVE-2022-2097?
The severity of CVE-2022-2097 is high.
Which platforms are affected by CVE-2022-2097?
CVE-2022-2097 affects 32-bit x86 platforms.
What is the impacted software for CVE-2022-2097?
The impacted software for CVE-2022-2097 is OpenSSL.
How can I fix CVE-2022-2097?
To fix CVE-2022-2097, update OpenSSL to version 1.1.1 or higher.
Where can I find more information about CVE-2022-2097?
For more information about CVE-2022-2097, you can refer to the following references: [Link 1](https://security-tracker.debian.org/tracker/CVE-2022-1292), [Link 2](https://nvd.nist.gov/vuln/detail/CVE-2022-1292), [Link 3](https://security-tracker.debian.org/tracker/CVE-2022-2068).
- agent/author
- agent/description
- agent/event
- agent/first-publish-date
- agent/last-modified-date
- agent/references
- agent/remedy
- agent/severity
- agent/softwarecombine
- agent/tags
- agent/type
- agent/weakness
- collector/debian-bugs
- alias/CVE-2022-2097
- collector/launchpad-cve
- source/Launchpad
- collector/nvd-api
- collector/nvd-cve
- source/NVD
- agent/software-canonical-lookup
- collector/nvd-index
- collector/redhat-bugzilla
- source/Red Hat
- collector/redhat-cve
- collector/security-tracker-debian
- source/Debian
- collector/usn-cve
- source/Ubuntu
- vendor/openssl
- canonical/openssl openssl
- version/openssl openssl/1.1.1
- version/openssl openssl/3.0.0
- vendor/fedoraproject
- canonical/fedoraproject fedora
- version/fedoraproject fedora/35
- version/fedoraproject fedora/36
- vendor/netapp
- canonical/apple ipados
- canonical/netapp clustered data ontap antivirus connector
- canonical/apple macos ventura
- canonical/apple macos big sur
- canonical/apple macos monterey
- canonical/netapp h410c firmware
- canonical/netapp h410c
- vendor/siemens
- canonical/siemens sinec ins
- version/siemens sinec ins/1.0
- version/siemens sinec ins/1.0-sp1
- version/siemens sinec ins/1.0-sp2
- vendor/debian
- canonical/debian debian linux
- version/debian debian linux/10.0
- version/debian debian linux/11.0
- package-manager/redhat
- package-manager/debian
- package-manager/ubuntu