CVE-2011-1945
The elliptic curve cryptography (ECC) subsystem in OpenSSL 1.0.0d and earlier, when the Elliptic...
CVE-2011-1945 is a low vulnerability (CVSS 2.6) in Openssl, published May 31, 2011. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.29%, the 88th percentile. Fixed in openssl 1.0.0e-1.
The elliptic curve cryptography (ECC) subsystem in OpenSSL 1.0.0d and earlier, when the Elliptic Curve Digital Signature Algorithm (ECDSA) is used for the ECDHE_ECDSA cipher suite, does not properly implement curves over binary fields, which makes it easier for context-dependent attackers to determine private keys via a timing attack and a lattice calculation.
Exploit likelihood
What each source reports
NVD Score used
The elliptic curve cryptography (ECC) subsystem in OpenSSL 1.0.0d and earlier, when the Elliptic Curve Digital Signature Algorithm (ECDSA) is used for the ECDHE_ECDSA cipher suite, does not properly implement curves over binary fields, which makes it easier for context-dependent attackers to determine private keys via a timing attack and a lattice calculation.
- Record
CVE-2011-1945- CVSS 2.0
- 2.6 Low
AV:N/AC:H/Au:N/C:P/I:N/A:N - Weakness
- CWE-310
- Updated
- 2026-11-02
CVE List No score
The elliptic curve cryptography (ECC) subsystem in OpenSSL 1.0.0d and earlier, when the Elliptic Curve Digital Signature Algorithm (ECDSA) is used for the ECDHE_ECDSA cipher suite, does not properly implement curves over binary fields, which makes it easier for context-dependent attackers to determine private keys via a timing attack and a lattice calculation.
- Record
CVE-2011-1945- Updated
- 2026-11-02
EUVDEUVD-2011-1942 No score
The elliptic curve cryptography (ECC) subsystem in OpenSSL 1.0.0d and earlier, when the Elliptic Curve Digital Signature Algorithm (ECDSA) is used for the ECDHE_ECDSA cipher suite, does not properly implement curves over binary fields, which makes it easier for context-dependent attackers to determine private keys via a timing attack and a lattice calculation.
- Record
EUVD-2011-1942- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-r4rf-h58w-4p76 No score
The elliptic curve cryptography (ECC) subsystem in OpenSSL 1.0.0d and earlier, when the Elliptic...
The elliptic curve cryptography (ECC) subsystem in OpenSSL 1.0.0d and earlier, when the Elliptic Curve Digital Signature Algorithm (ECDSA) is used for the ECDHE_ECDSA cipher suite, does not properly implement curves over binary fields, which makes it easier for context-dependent attackers to determine private keys via a timing attack and a lattice calculation.
- Record
GHSA-r4rf-h58w-4p76- Updated
- 2026-11-02
OSV No score
The elliptic curve cryptography (ECC) subsystem in OpenSSL 1.0.0d and earlier, when the Elliptic Curve Digital Signature Algorithm (ECDSA) is used for the ECDHE_ECDSA cipher suite, does not properly implement curves over binary fields, which makes it easier for context-dependent attackers to determine private keys via a timing attack and a lattice calculation.
- Record
CVE-2011-1945- Updated
- 2026-11-02
OSVDEBIAN-CVE-2011-1945 No score
The elliptic curve cryptography (ECC) subsystem in OpenSSL 1.0.0d and earlier, when the Elliptic Curve Digital Signature Algorithm (ECDSA) is used for the ECDHE_ECDSA cipher suite, does not properly implement curves over binary fields, which makes it easier for context-dependent attackers to determine private keys via a timing attack and a lattice calculation.
- Record
DEBIAN-CVE-2011-1945- Updated
- 2026-11-02
OSVSUSE-SU-2015:1184-1 No score
Security update for OpenSSL
This OpenSSL update fixes the following issues:
* Session Ticket Memory Leak (CVE-2014-3567)
* Build option no-ssl3 is incomplete (CVE-2014-3568)
* Add support for TLS_FALLBACK_SCSV to mitigate CVE-2014-3566 (POODLE)
Security Issues:
* CVE-2014-3567
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3567>
* CVE-2014-3566
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3566>
* CVE-2014-3568
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3568>
- Record
SUSE-SU-2015:1184-1- Updated
- 2026-11-02
OSVSUSE-SU-403 No score
Security update for OpenSSL
This OpenSSL update fixes the following issues:
* Session Ticket Memory Leak (CVE-2014-3567)
* Build option no-ssl3 is incomplete (CVE-2014-3568)
* Add support for TLS_FALLBACK_SCSV to mitigate CVE-2014-3566 (POODLE)
Security Issues:
* CVE-2014-3567
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3567>
* CVE-2014-3566
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3566>
* CVE-2014-3568
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3568>
- Record
SUSE-SU-403- Updated
- 2026-11-02
OSVSUSE-SU-403 Forbidden-1 No score
Security update for OpenSSL
This OpenSSL update fixes the following issues:
* Session Ticket Memory Leak (CVE-2014-3567)
* Build option no-ssl3 is incomplete (CVE-2014-3568)
* Add support for TLS_FALLBACK_SCSV to mitigate CVE-2014-3566 (POODLE)
Security Issues:
* CVE-2014-3567
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3567>
* CVE-2014-3566
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3566>
* CVE-2014-3568
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3568>
- Record
SUSE-SU-403 Forbidden-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
opensslDebian:12 |
before 1.0.0e-1 | 1.0.0e-1 |
opensslDebian:13 |
before 1.0.0e-1 | 1.0.0e-1 |
opensslDebian:14 |
before 1.0.0e-1 | 1.0.0e-1 |
opensslDebian:5.0 |
before 0.9.8g-15+lenny12, plus listed versions 0.9.8g-150.9.8g-15+lenny10.9.8g-15+lenny110.9.8g-15+lenny30.9.8g-15+lenny5 Show 4 moreShow less0.9.8g-15+lenny60.9.8g-15+lenny70.9.8g-15+lenny80.9.8g-15+lenny9 |
0.9.8g-15+lenny12 |
opensslDebian:6.0 |
before 0.9.8o-4squeeze2, plus listed versions 0.9.8o-40.9.8o-4squeeze1 |
0.9.8o-4squeeze2 |
libqt4SUSE:Linux Enterprise Desktop 12 |
before 4.8.6-7.1 | 4.8.6-7.1 |
libqt4-sql-pluginsSUSE:Linux Enterprise Desktop 12 |
before 4.8.6-7.1 | 4.8.6-7.1 |
libqt4SUSE:Linux Enterprise Desktop 12 SP1 |
before 4.8.6-7.1 | 4.8.6-7.1 |
libqt4-sql-pluginsSUSE:Linux Enterprise Desktop 12 SP1 |
before 4.8.6-7.1 | 4.8.6-7.1 |
libqt4SUSE:Linux Enterprise Software Development Kit 12 |
before 4.8.6-7.1 | 4.8.6-7.1 |
Show 21 moreShow less
| Package | Affected | Fixed |
|---|---|---|
libqt4-devel-docSUSE:Linux Enterprise Software Development Kit 12 |
before 4.8.6-7.3 | 4.8.6-7.3 |
libqt4-sql-pluginsSUSE:Linux Enterprise Software Development Kit 12 |
before 4.8.6-7.1 | 4.8.6-7.1 |
libqt4SUSE:Linux Enterprise Software Development Kit 12 SP1 |
before 4.8.6-7.1 | 4.8.6-7.1 |
libqt4-devel-docSUSE:Linux Enterprise Software Development Kit 12 SP1 |
before 4.8.6-7.3 | 4.8.6-7.3 |
libqt4-sql-pluginsSUSE:Linux Enterprise Software Development Kit 12 SP1 |
before 4.8.6-7.1 | 4.8.6-7.1 |
libqt4SUSE:Linux Enterprise Server 12 |
before 4.8.6-7.1 | 4.8.6-7.1 |
libqt4-devel-docSUSE:Linux Enterprise Server 12 |
before 4.8.6-7.3 | 4.8.6-7.3 |
libqt4-sql-pluginsSUSE:Linux Enterprise Server 12 |
before 4.8.6-7.1 | 4.8.6-7.1 |
libqt4SUSE:Linux Enterprise Server for SAP Applications 12 |
before 4.8.6-7.1 | 4.8.6-7.1 |
libqt4-devel-docSUSE:Linux Enterprise Server for SAP Applications 12 |
before 4.8.6-7.3 | 4.8.6-7.3 |
libqt4-sql-pluginsSUSE:Linux Enterprise Server for SAP Applications 12 |
before 4.8.6-7.1 | 4.8.6-7.1 |
libqt4SUSE:Linux Enterprise Server 12 SP1 |
before 4.8.6-7.1 | 4.8.6-7.1 |
libqt4-devel-docSUSE:Linux Enterprise Server 12 SP1 |
before 4.8.6-7.3 | 4.8.6-7.3 |
libqt4-sql-pluginsSUSE:Linux Enterprise Server 12 SP1 |
before 4.8.6-7.1 | 4.8.6-7.1 |
libqt4SUSE:Linux Enterprise Server for SAP Applications 12 SP1 |
before 4.8.6-7.1 | 4.8.6-7.1 |
libqt4-devel-docSUSE:Linux Enterprise Server for SAP Applications 12 SP1 |
before 4.8.6-7.3 | 4.8.6-7.3 |
libqt4-sql-pluginsSUSE:Linux Enterprise Server for SAP Applications 12 SP1 |
before 4.8.6-7.1 | 4.8.6-7.1 |
libqt4SUSE:Linux Enterprise Workstation Extension 12 |
before 4.8.6-7.1 | 4.8.6-7.1 |
libqt4-sql-pluginsSUSE:Linux Enterprise Workstation Extension 12 |
before 4.8.6-7.1 | 4.8.6-7.1 |
libqt4SUSE:Linux Enterprise Workstation Extension 12 SP1 |
before 4.8.6-7.1 | 4.8.6-7.1 |
libqt4-sql-pluginsSUSE:Linux Enterprise Workstation Extension 12 SP1 |
before 4.8.6-7.1 | 4.8.6-7.1 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
mandriva.com/security/advisories?name=MDVSA-2011:136
kb.cert.org/vuls/id/MAPG-8FENZ3
debian.org/security/2011/dsa-2309
support.apple.com/kb/HT5784
lists.apple.com/archives/security-announce/2013/Jun/msg00000.html
Show 128 moreShow less
hermes.opensuse.org/messages/8760466
secunia.com/advisories/44935
eprint.iacr.org/2011/232.pdf
nvd.nist.gov/vuln/detail/CVE-2011-1945
github.com/advisories/GHSA-r4rf-h58w-4p76
security-tracker.debian.org/tracker/CVE-2011-1945
suse.com/support/update/announcement/2015/suse-su-20151184-1
bugzilla.suse.com/608666