CVE-2011-4108
The DTLS implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f performs a MAC check only...
4.3 MediumFix available
CVE-2011-4108 is a medium vulnerability (CVSS 4.3) in Openssl, published January 6, 2012. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 16.1%, the 96th percentile. Fixed in openssl 1.0.0f-1.
- Severity
- 4.3 MediumCVSS 2.0, NVD
- Exploit chance
- 16.1%EPSS, 96th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
1.0.0f-1openssl +61 more
Description
The DTLS implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f performs a MAC check only if certain padding is valid, which makes it easier for remote attackers to recover plaintext via a padding oracle attack.
Exploit likelihood
16.1%Up 8.5 points since Feb 4, 2022
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
opensslDebian:12 | before 1.0.0f-1 | 1.0.0f-1 |
opensslDebian:13 | before 1.0.0f-1 | 1.0.0f-1 |
opensslDebian:14 | before 1.0.0f-1 | 1.0.0f-1 |
opensslDebian:5.0 From an advisory covering 5 CVEs | before 0.9.8g-15+lenny15, plus listed versions 0.9.8g-150.9.8g-15+lenny10.9.8g-15+lenny110.9.8g-15+lenny120.9.8g-15+lenny13 Show 7 moreShow less0.9.8g-15+lenny140.9.8g-15+lenny30.9.8g-15+lenny50.9.8g-15+lenny60.9.8g-15+lenny70.9.8g-15+lenny80.9.8g-15+lenny9 | 0.9.8g-15+lenny15 |
opensslDebian:6.0 From an advisory covering 5 CVEs | before 0.9.8o-4squeeze5, plus listed versions 0.9.8o-40.9.8o-4squeeze10.9.8o-4squeeze20.9.8o-4squeeze30.9.8o-4squeeze40.9.8o-4squeeze4~bpo50+1 | 0.9.8o-4squeeze5 |
opensslRed Hat:enterprise_linux:6::client From an advisory covering 4 CVEs | before 0:1.0.0-20.el6_2.1 | 0:1.0.0-20.el6_2.1 |
openssl-debuginfoRed Hat:enterprise_linux:6::client From an advisory covering 4 CVEs | before 0:1.0.0-20.el6_2.1 | 0:1.0.0-20.el6_2.1 |
openssl-develRed Hat:enterprise_linux:6::client From an advisory covering 4 CVEs | before 0:1.0.0-20.el6_2.1 | 0:1.0.0-20.el6_2.1 |
openssl-perlRed Hat:enterprise_linux:6::client From an advisory covering 4 CVEs | before 0:1.0.0-20.el6_2.1 | 0:1.0.0-20.el6_2.1 |
openssl-staticRed Hat:enterprise_linux:6::client From an advisory covering 4 CVEs | before 0:1.0.0-20.el6_2.1 | 0:1.0.0-20.el6_2.1 |
Show 52 moreShow less
| Package | Affected | Fixed |
|---|---|---|
opensslRed Hat:enterprise_linux:6::computenode From an advisory covering 4 CVEs | before 0:1.0.0-20.el6_2.1 | 0:1.0.0-20.el6_2.1 |
openssl-debuginfoRed Hat:enterprise_linux:6::computenode From an advisory covering 4 CVEs | before 0:1.0.0-20.el6_2.1 | 0:1.0.0-20.el6_2.1 |
openssl-develRed Hat:enterprise_linux:6::computenode From an advisory covering 4 CVEs | before 0:1.0.0-20.el6_2.1 | 0:1.0.0-20.el6_2.1 |
openssl-perlRed Hat:enterprise_linux:6::computenode From an advisory covering 4 CVEs | before 0:1.0.0-20.el6_2.1 | 0:1.0.0-20.el6_2.1 |
openssl-staticRed Hat:enterprise_linux:6::computenode From an advisory covering 4 CVEs | before 0:1.0.0-20.el6_2.1 | 0:1.0.0-20.el6_2.1 |
opensslRed Hat:enterprise_linux:6::server From an advisory covering 4 CVEs | before 0:1.0.0-20.el6_2.1 | 0:1.0.0-20.el6_2.1 |
openssl-debuginfoRed Hat:enterprise_linux:6::server From an advisory covering 4 CVEs | before 0:1.0.0-20.el6_2.1 | 0:1.0.0-20.el6_2.1 |
openssl-develRed Hat:enterprise_linux:6::server From an advisory covering 4 CVEs | before 0:1.0.0-20.el6_2.1 | 0:1.0.0-20.el6_2.1 |
openssl-perlRed Hat:enterprise_linux:6::server From an advisory covering 4 CVEs | before 0:1.0.0-20.el6_2.1 | 0:1.0.0-20.el6_2.1 |
openssl-staticRed Hat:enterprise_linux:6::server From an advisory covering 4 CVEs | before 0:1.0.0-20.el6_2.1 | 0:1.0.0-20.el6_2.1 |
opensslRed Hat:enterprise_linux:6::workstation From an advisory covering 4 CVEs | before 0:1.0.0-20.el6_2.1 | 0:1.0.0-20.el6_2.1 |
openssl-debuginfoRed Hat:enterprise_linux:6::workstation From an advisory covering 4 CVEs | before 0:1.0.0-20.el6_2.1 | 0:1.0.0-20.el6_2.1 |
openssl-develRed Hat:enterprise_linux:6::workstation From an advisory covering 4 CVEs | before 0:1.0.0-20.el6_2.1 | 0:1.0.0-20.el6_2.1 |
openssl-perlRed Hat:enterprise_linux:6::workstation From an advisory covering 4 CVEs | before 0:1.0.0-20.el6_2.1 | 0:1.0.0-20.el6_2.1 |
openssl-staticRed Hat:enterprise_linux:6::workstation From an advisory covering 4 CVEs | before 0:1.0.0-20.el6_2.1 | 0:1.0.0-20.el6_2.1 |
opensslRed Hat:enterprise_linux:5::client From an advisory covering 4 CVEs | before 0:0.9.8e-20.el5_7.1 | 0:0.9.8e-20.el5_7.1 |
openssl-debuginfoRed Hat:enterprise_linux:5::client From an advisory covering 4 CVEs | before 0:0.9.8e-20.el5_7.1 | 0:0.9.8e-20.el5_7.1 |
openssl-perlRed Hat:enterprise_linux:5::client From an advisory covering 4 CVEs | before 0:0.9.8e-20.el5_7.1 | 0:0.9.8e-20.el5_7.1 |
opensslRed Hat:enterprise_linux:5::client_workstation From an advisory covering 4 CVEs | before 0:0.9.8e-20.el5_7.1 | 0:0.9.8e-20.el5_7.1 |
openssl-debuginfoRed Hat:enterprise_linux:5::client_workstation From an advisory covering 4 CVEs | before 0:0.9.8e-20.el5_7.1 | 0:0.9.8e-20.el5_7.1 |
openssl-develRed Hat:enterprise_linux:5::client_workstation From an advisory covering 4 CVEs | before 0:0.9.8e-20.el5_7.1 | 0:0.9.8e-20.el5_7.1 |
opensslRed Hat:enterprise_linux:5::server From an advisory covering 4 CVEs | before 0:0.9.8e-20.el5_7.1 | 0:0.9.8e-20.el5_7.1 |
openssl-debuginfoRed Hat:enterprise_linux:5::server From an advisory covering 4 CVEs | before 0:0.9.8e-20.el5_7.1 | 0:0.9.8e-20.el5_7.1 |
openssl-develRed Hat:enterprise_linux:5::server From an advisory covering 4 CVEs | before 0:0.9.8e-20.el5_7.1 | 0:0.9.8e-20.el5_7.1 |
openssl-perlRed Hat:enterprise_linux:5::server From an advisory covering 4 CVEs | before 0:0.9.8e-20.el5_7.1 | 0:0.9.8e-20.el5_7.1 |
libqt4SUSE:Linux Enterprise Desktop 12 From an advisory covering 54 CVEs | before 4.8.6-7.1 | 4.8.6-7.1 |
libqt4-sql-pluginsSUSE:Linux Enterprise Desktop 12 From an advisory covering 54 CVEs | before 4.8.6-7.1 | 4.8.6-7.1 |
libqt4SUSE:Linux Enterprise Desktop 12 SP1 From an advisory covering 54 CVEs | before 4.8.6-7.1 | 4.8.6-7.1 |
libqt4-sql-pluginsSUSE:Linux Enterprise Desktop 12 SP1 From an advisory covering 54 CVEs | before 4.8.6-7.1 | 4.8.6-7.1 |
libqt4SUSE:Linux Enterprise Software Development Kit 12 From an advisory covering 54 CVEs | before 4.8.6-7.1 | 4.8.6-7.1 |
libqt4-devel-docSUSE:Linux Enterprise Software Development Kit 12 From an advisory covering 54 CVEs | before 4.8.6-7.3 | 4.8.6-7.3 |
libqt4-sql-pluginsSUSE:Linux Enterprise Software Development Kit 12 From an advisory covering 54 CVEs | before 4.8.6-7.1 | 4.8.6-7.1 |
libqt4SUSE:Linux Enterprise Software Development Kit 12 SP1 From an advisory covering 54 CVEs | before 4.8.6-7.1 | 4.8.6-7.1 |
libqt4-devel-docSUSE:Linux Enterprise Software Development Kit 12 SP1 From an advisory covering 54 CVEs | before 4.8.6-7.3 | 4.8.6-7.3 |
libqt4-sql-pluginsSUSE:Linux Enterprise Software Development Kit 12 SP1 From an advisory covering 54 CVEs | before 4.8.6-7.1 | 4.8.6-7.1 |
libqt4SUSE:Linux Enterprise Server 12 From an advisory covering 54 CVEs | before 4.8.6-7.1 | 4.8.6-7.1 |
libqt4-devel-docSUSE:Linux Enterprise Server 12 From an advisory covering 54 CVEs | before 4.8.6-7.3 | 4.8.6-7.3 |
libqt4-sql-pluginsSUSE:Linux Enterprise Server 12 From an advisory covering 54 CVEs | before 4.8.6-7.1 | 4.8.6-7.1 |
libqt4SUSE:Linux Enterprise Server for SAP Applications 12 From an advisory covering 54 CVEs | before 4.8.6-7.1 | 4.8.6-7.1 |
libqt4-devel-docSUSE:Linux Enterprise Server for SAP Applications 12 From an advisory covering 54 CVEs | before 4.8.6-7.3 | 4.8.6-7.3 |
libqt4-sql-pluginsSUSE:Linux Enterprise Server for SAP Applications 12 From an advisory covering 54 CVEs | before 4.8.6-7.1 | 4.8.6-7.1 |
libqt4SUSE:Linux Enterprise Server 12 SP1 From an advisory covering 54 CVEs | before 4.8.6-7.1 | 4.8.6-7.1 |
libqt4-devel-docSUSE:Linux Enterprise Server 12 SP1 From an advisory covering 54 CVEs | before 4.8.6-7.3 | 4.8.6-7.3 |
libqt4-sql-pluginsSUSE:Linux Enterprise Server 12 SP1 From an advisory covering 54 CVEs | before 4.8.6-7.1 | 4.8.6-7.1 |
libqt4SUSE:Linux Enterprise Server for SAP Applications 12 SP1 From an advisory covering 54 CVEs | before 4.8.6-7.1 | 4.8.6-7.1 |
libqt4-devel-docSUSE:Linux Enterprise Server for SAP Applications 12 SP1 From an advisory covering 54 CVEs | before 4.8.6-7.3 | 4.8.6-7.3 |
libqt4-sql-pluginsSUSE:Linux Enterprise Server for SAP Applications 12 SP1 From an advisory covering 54 CVEs | before 4.8.6-7.1 | 4.8.6-7.1 |
libqt4SUSE:Linux Enterprise Workstation Extension 12 From an advisory covering 54 CVEs | before 4.8.6-7.1 | 4.8.6-7.1 |
libqt4-sql-pluginsSUSE:Linux Enterprise Workstation Extension 12 From an advisory covering 54 CVEs | before 4.8.6-7.1 | 4.8.6-7.1 |
libqt4SUSE:Linux Enterprise Workstation Extension 12 SP1 From an advisory covering 54 CVEs | before 4.8.6-7.1 | 4.8.6-7.1 |
libqt4-sql-pluginsSUSE:Linux Enterprise Workstation Extension 12 SP1 From an advisory covering 54 CVEs | before 4.8.6-7.1 | 4.8.6-7.1 |
openssl-1_1openSUSE:Tumbleweed From an advisory covering 136 CVEs | before 1.1.1l-1.2 | 1.1.1l-1.2 |
What each source reports
NVD Score used
The DTLS implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f performs a MAC check only if certain padding is valid, which makes it easier for remote attackers to recover plaintext via a padding oracle attack.
- Record
CVE-2011-4108- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:P/I:N/A:N - Weakness
- CWE-310
- Updated
- 2026-11-02
CVE ListNo score
The DTLS implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f performs a MAC check only if certain padding is valid, which makes it easier for remote attackers to recover plaintext via a padding oracle attack.
- Record
CVE-2011-4108- Updated
- 2026-11-02
EUVDEUVD-2011-4056No score
The DTLS implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f performs a MAC check only if certain padding is valid, which makes it easier for remote attackers to recover plaintext via a padding oracle attack.
- Record
EUVD-2011-4056- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-g8h7-34h7-3c73No score
The DTLS implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f performs a MAC check only...
The DTLS implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f performs a MAC check only if certain padding is valid, which makes it easier for remote attackers to recover plaintext via a padding oracle attack.
- Record
GHSA-g8h7-34h7-3c73- Updated
- 2026-11-02
OSVNo score
The DTLS implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f performs a MAC check only if certain padding is valid, which makes it easier for remote attackers to recover plaintext via a padding oracle attack.
- Record
CVE-2011-4108- Updated
- 2026-11-02
OSVDEBIAN-CVE-2011-4108No score
The DTLS implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f performs a MAC check only if certain padding is valid, which makes it easier for remote attackers to recover plaintext via a padding oracle attack.
- Record
DEBIAN-CVE-2011-4108- Updated
- 2026-11-02
Show 7 moreShow less
OSVopenSUSE-SU-2024:10271-1No score
libopenssl-devel-1.0.2j-2.2 on GA media
These are all security issues fixed in the libopenssl-devel-1.0.2j-2.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10271-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10529-1No score
libopenssl1_0_0-steam-1.0.2h-4.1 on GA media
These are all security issues fixed in the libopenssl1_0_0-steam-1.0.2h-4.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10529-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11127-1No score
libopenssl-1_1-devel-1.1.1l-1.2 on GA media
These are all security issues fixed in the libopenssl-1_1-devel-1.1.1l-1.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11127-1- Updated
- 2026-11-02
OSVSUSE-FU-2022:0445-1No score
Feature update for venv-salt-minion
This feature update for venv-salt-minion provides the following changes:
- Introduce
venv-salt-minion. - Mention fixed issues provided with the bundle.
- Record
SUSE-FU-2022:0445-1- Updated
- 2026-11-02
OSVSUSE-SU-2015:1184-1No score
Security update for OpenSSL
This OpenSSL update fixes the following issues:
* Session Ticket Memory Leak (CVE-2014-3567)
* Build option no-ssl3 is incomplete (CVE-2014-3568)
* Add support for TLS_FALLBACK_SCSV to mitigate CVE-2014-3566 (POODLE)
Security Issues:
* CVE-2014-3567
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3567>
* CVE-2014-3566
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3566>
* CVE-2014-3568
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3568>
- Record
SUSE-SU-2015:1184-1- Updated
- 2026-11-02
OSVSUSE-SU-403No score
Security update for OpenSSL
This OpenSSL update fixes the following issues:
* Session Ticket Memory Leak (CVE-2014-3567)
* Build option no-ssl3 is incomplete (CVE-2014-3568)
* Add support for TLS_FALLBACK_SCSV to mitigate CVE-2014-3566 (POODLE)
Security Issues:
* CVE-2014-3567
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3567>
* CVE-2014-3566
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3566>
* CVE-2014-3568
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3568>
- Record
SUSE-SU-403- Updated
- 2026-11-02
OSVSUSE-SU-403 Forbidden-1No score
Security update for OpenSSL
This OpenSSL update fixes the following issues:
* Session Ticket Memory Leak (CVE-2014-3567)
* Build option no-ssl3 is incomplete (CVE-2014-3568)
* Add support for TLS_FALLBACK_SCSV to mitigate CVE-2014-3566 (POODLE)
Security Issues:
* CVE-2014-3567
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3567>
* CVE-2014-3566
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3566>
* CVE-2014-3568
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3568>
- Record
SUSE-SU-403 Forbidden-1- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
secunia.com/advisories/48528
h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03360041
www-01.ibm.com/support/docview.wss?uid=ssg1S1004564
lists.opensuse.org/opensuse-security-announce/2012-01/msg00017.html
mandriva.com/security/advisories?name=MDVSA-2012:006
Show 194 moreShow less
lists.fedoraproject.org/pipermail/package-announce/2012-November/092905.html
openssl.org/news/secadv_20120104.txt
rhn.redhat.com/errata/RHSA-2012-1308.html
isg.rhul.ac.uk/~kp/dtls.pdf
support.apple.com/kb/HT5784
lists.apple.com/archives/security-announce/2013/Jun/msg00000.html
kb.cert.org/vuls/id/737740
marc.info?l=bugtraq&m=132750648501816&w=2
debian.org/security/2012/dsa-2390
aix.software.ibm.com/aix/efixes/security/openssl_advisory3.asc
security.paloaltonetworks.com/CVE-2011-4108
nvd.nist.gov/vuln/detail/CVE-2011-4108
github.com/advisories/GHSA-g8h7-34h7-3c73
security-tracker.debian.org/tracker/CVE-2011-4108
access.redhat.com/errata/RHSA-2012:0059
bugzilla.redhat.com/show_bug.cgi?id=771770
security.access.redhat.com/data/csaf/v2/advisories/2012/rhsa-2012_0059.json
cve.org/CVERecord?id=CVE-2011-4108
suse.com/support/update/announcement/-2022-445/suse-fu-20220445-1
bugzilla.suse.com/1000080
This page doesn't list everything
Left out here: 570 references. The JSON record has them.