CVE-2010-4252
06.12.2010, 21:05
OpenSSL before 1.0.0c, when J-PAKE is enabled, does not properly validate the public parameters in the J-PAKE protocol, which allows remote attackers to bypass the need for knowledge of the shared secret, and successfully authenticate, by sending crafted values in each round of the protocol.Enginsight
| Vendor | Product | Version |
|---|---|---|
| openssl | openssl | 𝑥 ≤ 1.0.0b |
| openssl | openssl | 0.9.1c:c |
| openssl | openssl | 0.9.2b:b |
| openssl | openssl | 0.9.3 |
| openssl | openssl | 0.9.3a:a |
| openssl | openssl | 0.9.4 |
| openssl | openssl | 0.9.5 |
| openssl | openssl | 0.9.5:beta1 |
| openssl | openssl | 0.9.5:beta2 |
| openssl | openssl | 0.9.5a:a |
| openssl | openssl | 0.9.5a:a |
| openssl | openssl | 0.9.5a:a |
| openssl | openssl | 0.9.6 |
| openssl | openssl | 0.9.6:beta1 |
| openssl | openssl | 0.9.6:beta2 |
| openssl | openssl | 0.9.6:beta3 |
| openssl | openssl | 0.9.6a:a |
| openssl | openssl | 0.9.6a:a |
| openssl | openssl | 0.9.6a:a |
| openssl | openssl | 0.9.6a:a |
| openssl | openssl | 0.9.6b:b |
| openssl | openssl | 0.9.6c:c |
| openssl | openssl | 0.9.6d:d |
| openssl | openssl | 0.9.6e:e |
| openssl | openssl | 0.9.6f:f |
| openssl | openssl | 0.9.6g:g |
| openssl | openssl | 0.9.6h:h |
| openssl | openssl | 0.9.6i:i |
| openssl | openssl | 0.9.6j:j |
| openssl | openssl | 0.9.6k:k |
| openssl | openssl | 0.9.6l:l |
| openssl | openssl | 0.9.6m:m |
| openssl | openssl | 0.9.7 |
| openssl | openssl | 0.9.7:beta1 |
| openssl | openssl | 0.9.7:beta2 |
| openssl | openssl | 0.9.7:beta3 |
| openssl | openssl | 0.9.7:beta4 |
| openssl | openssl | 0.9.7:beta5 |
| openssl | openssl | 0.9.7:beta6 |
| openssl | openssl | 0.9.7a:a |
| openssl | openssl | 0.9.7b:b |
| openssl | openssl | 0.9.7c:c |
| openssl | openssl | 0.9.7d:d |
| openssl | openssl | 0.9.7e:e |
| openssl | openssl | 0.9.7f:f |
| openssl | openssl | 0.9.7g:g |
| openssl | openssl | 0.9.7h:h |
| openssl | openssl | 0.9.7i:i |
| openssl | openssl | 0.9.7j:j |
| openssl | openssl | 0.9.7k:k |
| openssl | openssl | 0.9.7l:l |
| openssl | openssl | 0.9.7m:m |
| openssl | openssl | 0.9.8 |
| openssl | openssl | 0.9.8a:a |
| openssl | openssl | 0.9.8b:b |
| openssl | openssl | 0.9.8c:c |
| openssl | openssl | 0.9.8d:d |
| openssl | openssl | 0.9.8e:e |
| openssl | openssl | 0.9.8f:f |
| openssl | openssl | 0.9.8g:g |
| openssl | openssl | 0.9.8h:h |
| openssl | openssl | 0.9.8i:i |
| openssl | openssl | 0.9.8j:j |
| openssl | openssl | 0.9.8k:k |
| openssl | openssl | 0.9.8l:l |
| openssl | openssl | 0.9.8m:m |
| openssl | openssl | 0.9.8n:n |
| openssl | openssl | 0.9.8o:o |
| openssl | openssl | 0.9.8p:p |
| openssl | openssl | 1.0.0 |
| openssl | openssl | 1.0.0:beta1 |
| openssl | openssl | 1.0.0:beta2 |
| openssl | openssl | 1.0.0:beta3 |
| openssl | openssl | 1.0.0:beta4 |
| openssl | openssl | 1.0.0:beta5 |
| openssl | openssl | 1.0.0a:a |
𝑥
= Vulnerable software versions
Debian Releases
Ubuntu Releases
Common Weakness Enumeration
References