CVE-2022-29242CWE-120

Buffer Overflow on creating key transport blob in GOST Engine

Medium · published May 24, 2022

CVSS v3.1
5.9
EPSS
2%
Percentile
77.2
In the wild
Unconfirmed
What it is

GOST engine is a reference implementation of the Russian GOST crypto algorithms for OpenSSL. TLS clients using GOST engine when ciphersuite `TLS_GOSTR341112_256_WITH_KUZNYECHIK_CTR_OMAC` is agreed and the server uses 512 bit GOST secret keys are vulnerable to buffer overflow. GOST engine version 3.0.1 contains a patch for this issue. Disabling ciphersuite `TLS_GOSTR341112_256_WITH_KUZNYECHIK_CTR_OMAC` is a possible workaround.

The record
Technical detail
CVSS v3.1
5.9 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.01710 · 77.2th percentile
Weakness
CWE-120 · Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Published
2022-05-24T14:55Z
EPSS history
Timeline
  • 24 MAY 14:55Z
    Buffer Overflow on creating key transport blob in GOST Engine
    cvelistv5