{"id":"CVE-2011-4354","aliases":["DEBIAN-CVE-2011-4354","DSA-2390-1","EUVD-2011-4285","GHSA-wph7-m6hx-9r8m"],"status":"published","title":"crypto/bn/bn_nist.c in OpenSSL before 0.9.8h on 32-bit platforms, as used in stunnel and other...","description":"crypto/bn/bn_nist.c in OpenSSL before 0.9.8h on 32-bit platforms, as used in stunnel and other products, in certain circumstances involving ECDH or ECDHE cipher suites, uses an incorrect modular reduction algorithm in its implementation of the P-256 and P-384 NIST elliptic curves, which allows remote attackers to obtain the private key of a TLS server via multiple handshake attempts.","severity":{"version":"2.0","score":5.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.0299,"percentile":0.8741,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-310"],"published":"2012-01-15T00:00:00Z","modified":"2026-10-23T17:47:34Z","fixes":[{"ecosystem":"Debian:12","package":"openssl","fixed_in":["0.9.8o-4squeeze3"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"openssl","fixed_in":["0.9.8o-4squeeze3"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"openssl","fixed_in":["0.9.8o-4squeeze3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.8o-4squeeze3"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.8o-4squeeze3"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.8o-4squeeze3"}]}]},{"source":"osv","ecosystem":"Debian:5.0","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.8g-15+lenny15"}]}],"versions":["0.9.8g-15","0.9.8g-15+lenny1","0.9.8g-15+lenny11","0.9.8g-15+lenny12","0.9.8g-15+lenny13","0.9.8g-15+lenny14","0.9.8g-15+lenny3","0.9.8g-15+lenny5","0.9.8g-15+lenny6","0.9.8g-15+lenny7","0.9.8g-15+lenny8","0.9.8g-15+lenny9"],"bundled":5},{"source":"osv","ecosystem":"Debian:6.0","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.8o-4squeeze5"}]}],"versions":["0.9.8o-4","0.9.8o-4squeeze1","0.9.8o-4squeeze2","0.9.8o-4squeeze3","0.9.8o-4squeeze4","0.9.8o-4squeeze4~bpo50+1"],"bundled":5}],"products":[{"vendor":"openssl","product":"openssl"}],"references":[{"url":"http://crypto.di.uminho.pt/CACE/CT-RSA2012-openssl-src.zip","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=757909","tags":["x_refsource_CONFIRM","x_transferred","report"]},{"url":"http://openwall.com/lists/oss-security/2011/12/01/6","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"http://eprint.iacr.org/2011/633","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"http://rt.openssl.org/Ticket/Display.html?id=1593\u0026user=guest\u0026pass=guest","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://cvs.openssl.org/filediff?f=openssl/crypto/bn/bn_nist.c\u0026v1=1.14\u0026v2=1.21","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www.debian.org/security/2012/dsa-2390","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory"]},{"url":"http://marc.info/?t=119271238800004","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2011-4354"},{"url":"https://github.com/advisories/GHSA-wph7-m6hx-9r8m"},{"url":"https://security-tracker.debian.org/tracker/CVE-2011-4354","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2011-4354","description":"crypto/bn/bn_nist.c in OpenSSL before 0.9.8h on 32-bit platforms, as used in stunnel and other products, in certain circumstances involving ECDH or ECDHE cipher suites, uses an incorrect modular reduction algorithm in its implementation of the P-256 and P-384 NIST elliptic curves, which allows remote attackers to obtain the private key of a TLS server via multiple handshake attempts.","status":"published","published":"2012-01-27T00:00:00Z","modified":"2024-08-07T00:01:51.637Z","updated_at":"2026-11-02T14:35:37.989579Z"}],"euvd":[{"id":"EUVD-2011-4285","description":"crypto/bn/bn_nist.c in OpenSSL before 0.9.8h on 32-bit platforms, as used in stunnel and other products, in certain circumstances involving ECDH or ECDHE cipher suites, uses an incorrect modular reduction algorithm in its implementation of the P-256 and P-384 NIST elliptic curves, which allows remote attackers to obtain the private key of a TLS server via multiple handshake attempts.","status":"published","published":"2012-01-27T00:00:00Z","modified":"2024-08-07T00:01:51Z","updated_at":"2026-11-03T01:39:48.961231Z"}],"ghsa":[{"id":"GHSA-wph7-m6hx-9r8m","title":"crypto/bn/bn_nist.c in OpenSSL before 0.9.8h on 32-bit platforms, as used in stunnel and other...","description":"crypto/bn/bn_nist.c in OpenSSL before 0.9.8h on 32-bit platforms, as used in stunnel and other products, in certain circumstances involving ECDH or ECDHE cipher suites, uses an incorrect modular reduction algorithm in its implementation of the P-256 and P-384 NIST elliptic curves, which allows remote attackers to obtain the private key of a TLS server via multiple handshake attempts.","status":"published","published":"2022-05-17T05:19:14Z","modified":"2023-01-28T05:03:31Z","updated_at":"2026-11-02T14:43:59.810751Z"}],"nvd":[{"id":"CVE-2011-4354","description":"crypto/bn/bn_nist.c in OpenSSL before 0.9.8h on 32-bit platforms, as used in stunnel and other products, in certain circumstances involving ECDH or ECDHE cipher suites, uses an incorrect modular reduction algorithm in its implementation of the P-256 and P-384 NIST elliptic curves, which allows remote attackers to obtain the private key of a TLS server via multiple handshake attempts.","status":"published","published":"2012-01-27T00:55:01.033Z","modified":"2026-06-16T23:34:49.963Z","cvss":[{"version":"2.0","score":5.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-310"],"updated_at":"2026-11-02T14:02:12.272092Z"}],"osv":[{"id":"CVE-2011-4354","description":"crypto/bn/bn_nist.c in OpenSSL before 0.9.8h on 32-bit platforms, as used in stunnel and other products, in certain circumstances involving ECDH or ECDHE cipher suites, uses an incorrect modular reduction algorithm in its implementation of the P-256 and P-384 NIST elliptic curves, which allows remote attackers to obtain the private key of a TLS server via multiple handshake attempts.","status":"published","published":"2012-01-27T00:55:01Z","modified":"2026-04-10T03:42:04.552233Z","updated_at":"2026-11-02T15:43:58.279353Z"},{"id":"DEBIAN-CVE-2011-4354","description":"crypto/bn/bn_nist.c in OpenSSL before 0.9.8h on 32-bit platforms, as used in stunnel and other products, in certain circumstances involving ECDH or ECDHE cipher suites, uses an incorrect modular reduction algorithm in its implementation of the P-256 and P-384 NIST elliptic curves, which allows remote attackers to obtain the private key of a TLS server via multiple handshake attempts.","status":"published","published":"2012-01-27T00:55:01.033Z","modified":"2026-10-23T17:47:34.739594121Z","updated_at":"2026-11-02T15:45:24.612044Z"},{"id":"DSA-2390-1","title":"openssl - several","status":"published","published":"2012-01-15T00:00:00Z","modified":"2026-03-09T01:20:14.073582Z","updated_at":"2026-11-02T15:46:15.489951Z"}]}}