CVE-2011-4354
crypto/bn/bn_nist.c in OpenSSL before 0.9.8h on 32-bit platforms, as used in stunnel and other...
crypto/bn/bn_nist.c in OpenSSL before 0.9.8h on 32-bit platforms, as used in stunnel and other products, in certain circumstances involving ECDH or ECDHE cipher suites, uses an incorrect modular reduction algorithm in its implementation of the P-256 and P-384 NIST elliptic curves, which allows remote attackers to obtain the private key of a TLS server via multiple handshake attempts.
Exploit likelihood
What each source reports
NVD Score used
crypto/bn/bn_nist.c in OpenSSL before 0.9.8h on 32-bit platforms, as used in stunnel and other products, in certain circumstances involving ECDH or ECDHE cipher suites, uses an incorrect modular reduction algorithm in its implementation of the P-256 and P-384 NIST elliptic curves, which allows remote attackers to obtain the private key of a TLS server via multiple handshake attempts.
- Record
CVE-2011-4354- CVSS 2.0
- 5.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:N - Weakness
- CWE-310
- Updated
- 2026-11-02
CVE List No score
crypto/bn/bn_nist.c in OpenSSL before 0.9.8h on 32-bit platforms, as used in stunnel and other products, in certain circumstances involving ECDH or ECDHE cipher suites, uses an incorrect modular reduction algorithm in its implementation of the P-256 and P-384 NIST elliptic curves, which allows remote attackers to obtain the private key of a TLS server via multiple handshake attempts.
- Record
CVE-2011-4354- Updated
- 2026-11-02
EUVDEUVD-2011-4285 No score
crypto/bn/bn_nist.c in OpenSSL before 0.9.8h on 32-bit platforms, as used in stunnel and other products, in certain circumstances involving ECDH or ECDHE cipher suites, uses an incorrect modular reduction algorithm in its implementation of the P-256 and P-384 NIST elliptic curves, which allows remote attackers to obtain the private key of a TLS server via multiple handshake attempts.
- Record
EUVD-2011-4285- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-wph7-m6hx-9r8m No score
crypto/bn/bn_nist.c in OpenSSL before 0.9.8h on 32-bit platforms, as used in stunnel and other...
crypto/bn/bn_nist.c in OpenSSL before 0.9.8h on 32-bit platforms, as used in stunnel and other products, in certain circumstances involving ECDH or ECDHE cipher suites, uses an incorrect modular reduction algorithm in its implementation of the P-256 and P-384 NIST elliptic curves, which allows remote attackers to obtain the private key of a TLS server via multiple handshake attempts.
- Record
GHSA-wph7-m6hx-9r8m- Updated
- 2026-11-02
OSV No score
crypto/bn/bn_nist.c in OpenSSL before 0.9.8h on 32-bit platforms, as used in stunnel and other products, in certain circumstances involving ECDH or ECDHE cipher suites, uses an incorrect modular reduction algorithm in its implementation of the P-256 and P-384 NIST elliptic curves, which allows remote attackers to obtain the private key of a TLS server via multiple handshake attempts.
- Record
CVE-2011-4354- Updated
- 2026-11-02
OSVDEBIAN-CVE-2011-4354 No score
crypto/bn/bn_nist.c in OpenSSL before 0.9.8h on 32-bit platforms, as used in stunnel and other products, in certain circumstances involving ECDH or ECDHE cipher suites, uses an incorrect modular reduction algorithm in its implementation of the P-256 and P-384 NIST elliptic curves, which allows remote attackers to obtain the private key of a TLS server via multiple handshake attempts.
- Record
DEBIAN-CVE-2011-4354- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
opensslDebian:12 |
before 0.9.8o-4squeeze3 | 0.9.8o-4squeeze3 |
opensslDebian:13 |
before 0.9.8o-4squeeze3 | 0.9.8o-4squeeze3 |
opensslDebian:14 |
before 0.9.8o-4squeeze3 | 0.9.8o-4squeeze3 |
opensslDebian:5.0 From an advisory covering 5 CVEs |
before 0.9.8g-15+lenny15, plus listed versions 0.9.8g-150.9.8g-15+lenny10.9.8g-15+lenny110.9.8g-15+lenny120.9.8g-15+lenny13 Show 7 moreShow less0.9.8g-15+lenny140.9.8g-15+lenny30.9.8g-15+lenny50.9.8g-15+lenny60.9.8g-15+lenny70.9.8g-15+lenny80.9.8g-15+lenny9 |
0.9.8g-15+lenny15 |
opensslDebian:6.0 From an advisory covering 5 CVEs |
before 0.9.8o-4squeeze5, plus listed versions 0.9.8o-40.9.8o-4squeeze10.9.8o-4squeeze20.9.8o-4squeeze30.9.8o-4squeeze40.9.8o-4squeeze4~bpo50+1 |
0.9.8o-4squeeze5 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2011-4354 is a medium vulnerability (CVSS 5.8) in Openssl, published January 15, 2012. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.99%, the 87th percentile. Fixed in openssl 0.9.8o-4squeeze3.