{"id":"CVE-2024-4603","aliases":["ALPINE-CVE-2024-4603","ALSA-2024:9333","AZL-42049","AZL-42058","AZL-42063","AZL-42694","AZL-42766","AZL-47684","AZL-78534","BELL-CVE-2024-4603","CLSA-2024-1735121358","CLSA-2026-1779782518","DEBIAN-CVE-2024-4603","EUVD-2024-44212","GHSA-85xr-ghj6-6m46","JLSEC-2026-250","MGASA-2024-0200","MGASA-2024-0281","OESA-2025-1326","OESA-2025-1327","RHSA-2024:9333","RLSA-2024:9333","SUSE-SU-2024:1789-1","SUSE-SU-2024:1947-1","SUSE-SU-2024:2066-1","SUSE-SU-2025:20014-1","UBUNTU-CVE-2024-4603","USN-6937-1","openSUSE-SU-2024:13992-1"],"status":"published","title":"Excessive time spent checking DSA keys and parameters","description":"Issue summary: Checking excessively long DSA keys or parameters may be very\nslow.\n\nImpact summary: Applications that use the functions EVP_PKEY_param_check()\nor EVP_PKEY_public_check() to check a DSA public key or DSA parameters may\nexperience long delays. Where the key or parameters that are being checked\nhave been obtained from an untrusted source this may lead to a Denial of\nService.\n\nThe functions EVP_PKEY_param_check() or EVP_PKEY_public_check() perform\nvarious checks on DSA parameters. Some of those computations take a long time\nif the modulus (`p` parameter) is too large.\n\nTrying to use a very large modulus is slow and OpenSSL will not allow using\npublic keys with a modulus which is over 10,000 bits in length for signature\nverification. However the key and parameter check functions do not limit\nthe modulus size when performing the checks.\n\nAn application that calls EVP_PKEY_param_check() or EVP_PKEY_public_check()\nand supplies a key or parameters obtained from an untrusted source could be\nvulnerable to a Denial of Service attack.\n\nThese functions are not called by OpenSSL itself on untrusted DSA keys so\nonly applications that directly call these functions may be vulnerable.\n\nAlso vulnerable are the OpenSSL pkey and pkeyparam command line applications\nwhen using the `-check` option.\n\nThe OpenSSL SSL/TLS implementation is not affected by this issue.\n\nThe OpenSSL 3.0 and 3.1 FIPS providers are affected by this issue.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.01131,"percentile":0.66653,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-606","CWE-834"],"published":"2024-05-16T15:21:20Z","modified":"2026-11-09T16:20:11Z","fixes":[{"ecosystem":"Alpine:v3.17","package":"openssl","fixed_in":["3.0.13-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"openssl","fixed_in":["3.1.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"openssl","fixed_in":["3.1.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"openssl","fixed_in":["3.3.0-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"openssl","fixed_in":["3.3.0-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"openssl","fixed_in":["3.3.0-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"openssl","fixed_in":["3.3.0-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"openssl","fixed_in":["3.3.0-r2"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"openssl","fixed_in":["3.3.2-1"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"nodejs","fixed_in":["20.14.0-1"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"edk2","fixed_in":["20240524git3e722403cd16-8"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"cloud-hypervisor-cvm","fixed_in":["38.0.72.2-1"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"cloud-hypervisor-cvm","fixed_in":["38.0.72.2-1"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"hvloader","fixed_in":["1.0.1-6"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"openssl","fixed_in":["3.0.13-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"openssl","fixed_in":["3.3.0-r2"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:23","package":"openssl","fixed_in":["3.0.13-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:stream","package":"openssl","fixed_in":["3.3.0-r2"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"openssl","fixed_in":["1:3.0.7-17.el9_2.tuxcare.els5"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"openssl-devel","fixed_in":["1:3.0.7-17.el9_2.tuxcare.els5"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"openssl-libs","fixed_in":["1:3.0.7-17.el9_2.tuxcare.els5"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"openssl-perl","fixed_in":["1:3.0.7-17.el9_2.tuxcare.els5"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"openssl","fixed_in":["3.0.14-1~deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"openssl","fixed_in":["3.2.2-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"openssl","fixed_in":["3.2.2-1"],"sources":["osv"]},{"ecosystem":"Julia","package":"OpenSSL_jll","fixed_in":["3.0.14+0"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS","package":"edk2","fixed_in":["202308-21.oe2403"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"edk2","fixed_in":["202308-20.oe2403sp1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"openssl-3","fixed_in":["3.0.8-150500.5.33.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.5","package":"openssl-3","fixed_in":["3.0.8-150500.5.33.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"openssl","fixed_in":["3.0.2-0ubuntu1.17"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:FIPS-updates:22.04:LTS","package":"openssl","fixed_in":["3.0.2-0ubuntu1.17+Fips1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"openssl","fixed_in":["3.0.13-0ubuntu3.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:FIPS-updates:24.04:LTS","package":"openssl-fips","fixed_in":["3.0.13-0ubuntu3.6+Fips1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"openssl-3","fixed_in":["3.1.4-8.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.17","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.13-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.0-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.0-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.0-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.0-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.0-r2"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.2.2-6.el9_5"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"openssl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.2.2-6.el9_5"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"openssl-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.2.2-6.el9_5"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"openssl-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.2.2-6.el9_5"}]}],"bundled":4},{"source":"osv","ecosystem":"Azure Linux:3","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.2-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.14.0-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20240524git3e722403cd16-8"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"cloud-hypervisor-cvm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"38.0.72.2-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"cloud-hypervisor-cvm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"38.0.72.2-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"hvloader","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.1-6"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"openssl-fips-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.1.2-2"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.8-r4"},{"fixed":"3.0.13-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.1-r1"},{"fixed":"3.3.0-r2"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:23","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.8-r4"},{"fixed":"3.0.13-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:stream","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.1-r1"},{"fixed":"3.3.0-r2"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.0.7-17.el9_2.tuxcare.els5"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"openssl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.0.7-17.el9_2.tuxcare.els5"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"openssl-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.0.7-17.el9_2.tuxcare.els5"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"openssl-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.0.7-17.el9_2.tuxcare.els5"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.0.7-20.el9_2.tuxcare.1.els13"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"openssl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.0.7-20.el9_2.tuxcare.1.els13"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"openssl-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.0.7-20.el9_2.tuxcare.1.els13"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"openssl-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.0.7-20.el9_2.tuxcare.1.els13"}]}],"bundled":3},{"source":"osv","ecosystem":"Debian:12","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.14-1~deb12u1"}]}],"versions":["3.0.10-1","3.0.10-1~deb12u1","3.0.11-1","3.0.11-1~deb12u1","3.0.11-1~deb12u2","3.0.12-1","3.0.12-2","3.0.13-1~deb12u1","3.0.13-1~deb12u2","3.0.9-1"]},{"source":"osv","ecosystem":"Debian:13","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.2-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.2-1"}]}]},{"source":"osv","ecosystem":"Julia","package":"OpenSSL_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"3.0.8+0"},{"fixed":"3.0.14+0"}]}]},{"source":"osv","ecosystem":"Mageia:9","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.13-1.1.mga9"}]}],"bundled":2},{"source":"osv","ecosystem":"Mageia:9","package":"quictls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.14-1.1.mga9"}]}],"bundled":8},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"202308-21.oe2403"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"202308-20.oe2403sp1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"openssl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.2.2-6.el9_5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"openssl-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.2.2-6.el9_5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"openssl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.2.2-6.el9_5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"openssl-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.2.2-6.el9_5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"openssl-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.2.2-6.el9_5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.2.2-6.el9_5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"openssl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.2.2-6.el9_5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"openssl-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.2.2-6.el9_5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"openssl-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.2.2-6.el9_5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"openssl-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.2.2-6.el9_5"}]}],"bundled":4},{"source":"osv","ecosystem":"Rocky Linux:9","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.2.2-6.el9_5.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Rocky Linux:9","package":"openssl-fips-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.7-6.el9_5"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.8-150500.5.33.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.8-150500.5.33.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.8-150400.4.54.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.8-150400.4.54.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.8-150400.4.54.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.8-150400.4.54.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.8-150400.4.54.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.8-150400.4.54.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.3","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.8-150400.4.54.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 4.3","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.8-150400.4.54.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap Micro 5.3","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.8-150400.4.54.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap Micro 5.4","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.8-150400.4.54.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.4-150600.5.7.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.4-150600.5.7.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"jitterentropy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.1-3.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"libpulp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.5-1.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.4-6.1"}]}],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.10.25~dfsg2-2ubuntu1","4.2.2~dfsg-1","4.2.3~dfsg-1","4.2.4~dfsg-1ubuntu1","4.2.4~dfsg-2","4.2.6~dfsg-1ubuntu1","4.2.6~dfsg-1ubuntu4","4.2.6~dfsg-1ubuntu4.1","4.2.6~dfsg-1ubuntu4.2","4.2.6~dfsg-1ubuntu4.2+esm1","4.2.6~dfsg-1ubuntu4.2+esm2","4.2.6~dfsg-1ubuntu4.2+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.11.4~dfsg-1ubuntu1","6.11.4~dfsg-1ubuntu2","6.12.0~dfsg-1ubuntu1","6.12.0~dfsg-2ubuntu1","6.12.0~dfsg-2ubuntu2","8.10.0~dfsg-2","8.10.0~dfsg-2ubuntu0.2","8.10.0~dfsg-2ubuntu0.3","8.10.0~dfsg-2ubuntu0.4","8.10.0~dfsg-2ubuntu0.4+esm1","8.10.0~dfsg-2ubuntu0.4+esm2","8.10.0~dfsg-2ubuntu0.4+esm3","8.10.0~dfsg-2ubuntu0.4+esm4","8.10.0~dfsg-2ubuntu0.4+esm5","8.10.0~dfsg-2ubuntu0.4+esm6"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.2-0ubuntu1.17"}]}],"versions":["1.1.1l-1ubuntu1","3.0.0-1ubuntu1","3.0.1-0ubuntu1","3.0.2-0ubuntu1","3.0.2-0ubuntu1.1","3.0.2-0ubuntu1.2","3.0.2-0ubuntu1.4","3.0.2-0ubuntu1.5","3.0.2-0ubuntu1.6","3.0.2-0ubuntu1.7","3.0.2-0ubuntu1.8","3.0.2-0ubuntu1.9","3.0.2-0ubuntu1.10","3.0.2-0ubuntu1.12","3.0.2-0ubuntu1.13","3.0.2-0ubuntu1.14","3.0.2-0ubuntu1.15","3.0.2-0ubuntu1.16"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["12.22.5~dfsg-5ubuntu1","12.22.7~dfsg-2ubuntu1","12.22.7~dfsg-2ubuntu3","12.22.9~dfsg-1ubuntu2","12.22.9~dfsg-1ubuntu3","12.22.9~dfsg-1ubuntu3.1","12.22.9~dfsg-1ubuntu3.2","12.22.9~dfsg-1ubuntu3.3","12.22.9~dfsg-1ubuntu3.4","12.22.9~dfsg-1ubuntu3.5","12.22.9~dfsg-1ubuntu3.6","12.22.9~dfsg-1ubuntu3.6+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-preview:22.04:LTS","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0.2-0ubuntu1.10+Fips1","3.0.2-0ubuntu1.12+Fips1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-preview:22.04:LTS","package":"openssl-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0.5-0ubuntu0.1+Fips2.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:22.04:LTS","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.2-0ubuntu1.17+Fips1"}]}],"versions":["3.0.2-0ubuntu1.10+Fips1","3.0.2-0ubuntu1.12+Fips1","3.0.2-0ubuntu1.14+Fips1","3.0.2-0ubuntu1.15+Fips1","3.0.2-0ubuntu1.16+Fips1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:22.04:LTS","package":"openssl-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0.5-0ubuntu0.1+Fips2.1","3.0.5-0ubuntu0.2+Fips1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.13-0ubuntu3.2"}]}],"versions":["3.0.10-1ubuntu2","3.0.10-1ubuntu2.1","3.0.10-1ubuntu3","3.0.10-1ubuntu4","3.0.13-0ubuntu2","3.0.13-0ubuntu3","3.0.13-0ubuntu3.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:24.04:LTS","package":"openssl-fips","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.13-0ubuntu3.6+Fips1"}]}],"versions":["3.0.13-0ubuntu3+Fips1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1f-1ubuntu2.23"}]}],"versions":["1.1.1c-1ubuntu4","1.1.1d-2ubuntu3","1.1.1d-2ubuntu6","1.1.1f-1ubuntu1","1.1.1f-1ubuntu2","1.1.1f-1ubuntu2.1","1.1.1f-1ubuntu2.2","1.1.1f-1ubuntu2.3","1.1.1f-1ubuntu2.4","1.1.1f-1ubuntu2.5","1.1.1f-1ubuntu2.8","1.1.1f-1ubuntu2.9","1.1.1f-1ubuntu2.10","1.1.1f-1ubuntu2.11","1.1.1f-1ubuntu2.12","1.1.1f-1ubuntu2.13","1.1.1f-1ubuntu2.15","1.1.1f-1ubuntu2.16","1.1.1f-1ubuntu2.17","1.1.1f-1ubuntu2.18","1.1.1f-1ubuntu2.19","1.1.1f-1ubuntu2.20","1.1.1f-1ubuntu2.21","1.1.1f-1ubuntu2.22"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.2-0ubuntu1.17"}]}],"versions":["1.1.1l-1ubuntu1","3.0.0-1ubuntu1","3.0.1-0ubuntu1","3.0.2-0ubuntu1","3.0.2-0ubuntu1.1","3.0.2-0ubuntu1.2","3.0.2-0ubuntu1.4","3.0.2-0ubuntu1.5","3.0.2-0ubuntu1.6","3.0.2-0ubuntu1.7","3.0.2-0ubuntu1.8","3.0.2-0ubuntu1.9","3.0.2-0ubuntu1.10","3.0.2-0ubuntu1.12","3.0.2-0ubuntu1.13","3.0.2-0ubuntu1.14","3.0.2-0ubuntu1.15","3.0.2-0ubuntu1.16"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.13-0ubuntu3.2"}]}],"versions":["3.0.10-1ubuntu2","3.0.10-1ubuntu2.1","3.0.10-1ubuntu3","3.0.10-1ubuntu4","3.0.13-0ubuntu2","3.0.13-0ubuntu3","3.0.13-0ubuntu3.1"],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.4-8.1"}]}]}],"products":[{"vendor":"netapp","product":"500f_firmware"},{"vendor":"netapp","product":"8300_firmware"},{"vendor":"netapp","product":"8700_firmware"},{"vendor":"netapp","product":"a250_firmware"},{"vendor":"netapp","product":"a400_firmware"},{"vendor":"netapp","product":"a700s_firmware"},{"vendor":"netapp","product":"bootstrap_os"},{"vendor":"netapp","product":"brocade_fabric_operating_system"},{"vendor":"netapp","product":"c250_firmware"},{"vendor":"netapp","product":"c400_firmware"},{"vendor":"netapp","product":"h300s_firmware"},{"vendor":"netapp","product":"h410c_firmware"},{"vendor":"netapp","product":"h410s_firmware"},{"vendor":"netapp","product":"h500s_firmware"},{"vendor":"netapp","product":"h610c_firmware"},{"vendor":"netapp","product":"h610s_firmware"},{"vendor":"netapp","product":"h615c_firmware"},{"vendor":"netapp","product":"h700s_firmware"},{"vendor":"netapp","product":"management_services_for_element_software_and_netapp_hci"},{"vendor":"netapp","product":"ontap_select_deploy_administration_utility"},{"vendor":"netapp","product":"snapmanager"},{"vendor":"openssl","product":"openssl"}],"references":[{"url":"https://www.openssl.org/news/secadv/20240516.txt","tags":["vendor-advisory","x_transferred","Vendor Advisory","advisory","web","article","report"]},{"url":"https://github.com/openssl/openssl/commit/3559e868e58005d15c6013a0c1fd832e51c73397","tags":["patch","x_transferred","Patch","fix","web"]},{"url":"https://github.com/openssl/openssl/commit/9c39b3858091c152f52513c066ff2c5a47969f0d","tags":["patch","x_transferred","Patch","fix","web"]},{"url":"https://github.com/openssl/openssl/commit/da343d0605c826ef197aceedc67e8e04f065f740","tags":["patch","x_transferred","Patch","fix","web"]},{"url":"https://github.com/openssl/openssl/commit/53ea06486d296b890d565fb971b2764fcd826e7e","tags":["patch","x_transferred","Patch","fix","web"]},{"url":"http://www.openwall.com/lists/oss-security/2024/05/16/2","tags":["x_transferred","Mailing List","Third Party Advisory","web"]},{"url":"https://security.netapp.com/advisory/ntap-20240621-0001/","tags":["x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-4603","tags":["web","advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20240621-0001","tags":["web"]},{"url":"https://github.com/advisories/GHSA-85xr-ghj6-6m46","tags":["web"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2024-4603","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:9333","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-2511","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-4603","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-4741","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-5535","tags":["report"]},{"url":"https://bugzilla.redhat.com/2274020","tags":["report"]},{"url":"https://bugzilla.redhat.com/2281029","tags":["report"]},{"url":"https://bugzilla.redhat.com/2283757","tags":["report"]},{"url":"https://bugzilla.redhat.com/2294581","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2024-9333.html","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2024-4603","tags":["advisory"]},{"url":"https://errata.tuxcare.com/almalinux9.2-esu/CLSA-2024-1735121358.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1779782518.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/4xxx/CVE-2024-4603.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-4603","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2024-0200.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=33224","tags":["report"]},{"url":"https://www.openssl.org/news/secadv/20240528.txt","tags":["web","article"]},{"url":"https://advisories.mageia.org/MGASA-2024-0281.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=33468","tags":["report"]},{"url":"https://openssl-library.org/news/vulnerabilities-3.0/","tags":["web"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1326","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1327","tags":["advisory"]},{"url":"https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/9/html/9.5_release_notes/index","tags":["article"]},{"url":"https://access.redhat.com/security/updates/classification/#low","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2274020","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2281029","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2283757","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2294581","tags":["report"]},{"url":"https://issues.redhat.com/browse/RHEL-26271","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-32123","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-38514","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-40723","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-58662","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_9333.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-2511","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-2511","tags":["advisory"]},{"url":"https://www.openssl.org/news/vulnerabilities.html","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-4603","tags":["advisory","report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-4741","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-4741","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-5535","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-5535","tags":["advisory"]},{"url":"https://www.oracle.com/security-alerts/cpuoct2024.html#AppendixMSQL","tags":["article"]},{"url":"https://errata.rockylinux.org/RLSA-2024:9333","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20241789-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1224388","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-4603","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20241947-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1222548","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-2511","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20242066-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1223428","tags":["report"]},{"url":"https://bugzilla.suse.com/1225291","tags":["report"]},{"url":"https://bugzilla.suse.com/1225551","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-4741","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202520014-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1220523","tags":["report"]},{"url":"https://bugzilla.suse.com/1220690","tags":["report"]},{"url":"https://bugzilla.suse.com/1220693","tags":["report"]},{"url":"https://bugzilla.suse.com/1220696","tags":["report"]},{"url":"https://bugzilla.suse.com/1221365","tags":["report"]},{"url":"https://bugzilla.suse.com/1221751","tags":["report"]},{"url":"https://bugzilla.suse.com/1221752","tags":["report"]},{"url":"https://bugzilla.suse.com/1221753","tags":["report"]},{"url":"https://bugzilla.suse.com/1221760","tags":["report"]},{"url":"https://bugzilla.suse.com/1221763","tags":["report"]},{"url":"https://bugzilla.suse.com/1221786","tags":["report"]},{"url":"https://bugzilla.suse.com/1221787","tags":["report"]},{"url":"https://bugzilla.suse.com/1221821","tags":["report"]},{"url":"https://bugzilla.suse.com/1221822","tags":["report"]},{"url":"https://bugzilla.suse.com/1221824","tags":["report"]},{"url":"https://bugzilla.suse.com/1221827","tags":["report"]},{"url":"https://bugzilla.suse.com/1222899","tags":["report"]},{"url":"https://bugzilla.suse.com/1223306","tags":["report"]},{"url":"https://bugzilla.suse.com/1223336","tags":["report"]},{"url":"https://bugzilla.suse.com/1226463","tags":["report"]},{"url":"https://bugzilla.suse.com/1227138","tags":["report"]},{"url":"https://bugzilla.suse.com/1229465","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-5535","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-6119","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2024-4603","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6937-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-2511","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-4741","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-5535","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2024-4603","title":"Excessive time spent checking DSA keys and parameters","description":"Issue summary: Checking excessively long DSA keys or parameters may be very\nslow.\n\nImpact summary: Applications that use the functions EVP_PKEY_param_check()\nor EVP_PKEY_public_check() to check a DSA public key or DSA parameters may\nexperience long delays. Where the key or parameters that are being checked\nhave been obtained from an untrusted source this may lead to a Denial of\nService.\n\nThe functions EVP_PKEY_param_check() or EVP_PKEY_public_check() perform\nvarious checks on DSA parameters. Some of those computations take a long time\nif the modulus (`p` parameter) is too large.\n\nTrying to use a very large modulus is slow and OpenSSL will not allow using\npublic keys with a modulus which is over 10,000 bits in length for signature\nverification. However the key and parameter check functions do not limit\nthe modulus size when performing the checks.\n\nAn application that calls EVP_PKEY_param_check() or EVP_PKEY_public_check()\nand supplies a key or parameters obtained from an untrusted source could be\nvulnerable to a Denial of Service attack.\n\nThese functions are not called by OpenSSL itself on untrusted DSA keys so\nonly applications that directly call these functions may be vulnerable.\n\nAlso vulnerable are the OpenSSL pkey and pkeyparam command line applications\nwhen using the `-check` option.\n\nThe OpenSSL SSL/TLS implementation is not affected by this issue.\n\nThe OpenSSL 3.0 and 3.1 FIPS providers are affected by this issue.","status":"published","published":"2024-05-16T15:21:20.05Z","modified":"2024-10-14T14:56:01.784Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"adp"}],"cwes":["CWE-606","CWE-834"],"updated_at":"2026-11-02T14:34:16.78507Z"}],"euvd":[{"id":"EUVD-2024-44212","description":"Issue summary: Checking excessively long DSA keys or parameters may be very\nslow.\n\nImpact summary: Applications that use the functions EVP_PKEY_param_check()\nor EVP_PKEY_public_check() to check a DSA public key or DSA parameters may\nexperience long delays. Where the key or parameters that are being checked\nhave been obtained from an untrusted source this may lead to a Denial of\nService.\n\nThe functions EVP_PKEY_param_check() or EVP_PKEY_public_check() perform\nvarious checks on DSA parameters. Some of those computations take a long time\nif the modulus (`p` parameter) is too large.\n\nTrying to use a very large modulus is slow and OpenSSL will not allow using\npublic keys with a modulus which is over 10,000 bits in length for signature\nverification. However the key and parameter check functions do not limit\nthe modulus size when performing the checks.\n\nAn application that calls EVP_PKEY_param_check() or EVP_PKEY_public_check()\nand supplies a key or parameters obtained from an untrusted source could be\nvulnerable to a Denial of Service attack.\n\nThese functions are not called by OpenSSL itself on untrusted DSA keys so\nonly applications that directly call these functions may be vulnerable.\n\nAlso vulnerable are the OpenSSL pkey and pkeyparam command line applications\nwhen using the `-check` option.\n\nThe OpenSSL SSL/TLS implementation is not affected by this issue.\n\nThe OpenSSL 3.0 and 3.1 FIPS providers are affected by this issue.","status":"published","published":"2024-05-16T15:21:20Z","modified":"2024-10-14T14:56:01Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-03T00:27:37.685207Z"}],"ghsa":[{"id":"GHSA-85xr-ghj6-6m46","title":"Issue summary: Checking excessively long DSA keys or parameters may be very\nslow.\n\nImpact summary...","description":"Issue summary: Checking excessively long DSA keys or parameters may be very\nslow.\n\nImpact summary: Applications that use the functions EVP_PKEY_param_check()\nor EVP_PKEY_public_check() to check a DSA public key or DSA parameters may\nexperience long delays. Where the key or parameters that are being checked\nhave been obtained from an untrusted source this may lead to a Denial of\nService.\n\nThe functions EVP_PKEY_param_check() or EVP_PKEY_public_check() perform\nvarious checks on DSA parameters. Some of those computations take a long time\nif the modulus (`p` parameter) is too large.\n\nTrying to use a very large modulus is slow and OpenSSL will not allow using\npublic keys with a modulus which is over 10,000 bits in length for signature\nverification. However the key and parameter check functions do not limit\nthe modulus size when performing the checks.\n\nAn application that calls EVP_PKEY_param_check() or EVP_PKEY_public_check()\nand supplies a key or parameters obtained from an untrusted source could be\nvulnerable to a Denial of Service attack.\n\nThese functions are not called by OpenSSL itself on untrusted DSA keys so\nonly applications that directly call these functions may be vulnerable.\n\nAlso vulnerable are the OpenSSL pkey and pkeyparam command line applications\nwhen using the `-check` option.\n\nThe OpenSSL SSL/TLS implementation is not affected by this issue.\n\nThe OpenSSL 3.0 and 3.1 FIPS providers are affected by this issue.","status":"published","published":"2024-05-16T18:30:32Z","modified":"2024-10-14T15:31:49Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-606","CWE-834"],"updated_at":"2026-11-02T14:58:29.701719Z"}],"nvd":[{"id":"CVE-2024-4603","description":"Issue summary: Checking excessively long DSA keys or parameters may be very\nslow.\n\nImpact summary: Applications that use the functions EVP_PKEY_param_check()\nor EVP_PKEY_public_check() to check a DSA public key or DSA parameters may\nexperience long delays. Where the key or parameters that are being checked\nhave been obtained from an untrusted source this may lead to a Denial of\nService.\n\nThe functions EVP_PKEY_param_check() or EVP_PKEY_public_check() perform\nvarious checks on DSA parameters. Some of those computations take a long time\nif the modulus (`p` parameter) is too large.\n\nTrying to use a very large modulus is slow and OpenSSL will not allow using\npublic keys with a modulus which is over 10,000 bits in length for signature\nverification. However the key and parameter check functions do not limit\nthe modulus size when performing the checks.\n\nAn application that calls EVP_PKEY_param_check() or EVP_PKEY_public_check()\nand supplies a key or parameters obtained from an untrusted source could be\nvulnerable to a Denial of Service attack.\n\nThese functions are not called by OpenSSL itself on untrusted DSA keys so\nonly applications that directly call these functions may be vulnerable.\n\nAlso vulnerable are the OpenSSL pkey and pkeyparam command line applications\nwhen using the `-check` option.\n\nThe OpenSSL SSL/TLS implementation is not affected by this issue.\n\nThe OpenSSL 3.0 and 3.1 FIPS providers are affected by this issue.","status":"published","published":"2024-05-16T16:15:10.643Z","modified":"2026-11-09T16:20:11.16Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-606","CWE-834"],"updated_at":"2026-11-09T18:15:08.30751Z"}],"osv":[{"id":"ALPINE-CVE-2024-4603","description":"Issue summary: Checking excessively long DSA keys or parameters may be very\nslow.\n\nImpact summary: Applications that use the functions EVP_PKEY_param_check()\nor EVP_PKEY_public_check() to check a DSA public key or DSA parameters may\nexperience long delays. Where the key or parameters that are being checked\nhave been obtained from an untrusted source this may lead to a Denial of\nService.\n\nThe functions EVP_PKEY_param_check() or EVP_PKEY_public_check() perform\nvarious checks on DSA parameters. Some of those computations take a long time\nif the modulus (`p` parameter) is too large.\n\nTrying to use a very large modulus is slow and OpenSSL will not allow using\npublic keys with a modulus which is over 10,000 bits in length for signature\nverification. However the key and parameter check functions do not limit\nthe modulus size when performing the checks.\n\nAn application that calls EVP_PKEY_param_check() or EVP_PKEY_public_check()\nand supplies a key or parameters obtained from an untrusted source could be\nvulnerable to a Denial of Service attack.\n\nThese functions are not called by OpenSSL itself on untrusted DSA keys so\nonly applications that directly call these functions may be vulnerable.\n\nAlso vulnerable are the OpenSSL pkey and pkeyparam command line applications\nwhen using the `-check` option.\n\nThe OpenSSL SSL/TLS implementation is not affected by this issue.\n\nThe OpenSSL 3.0 and 3.1 FIPS providers are affected by this issue.","status":"published","published":"2024-05-16T16:15:10.643Z","modified":"2026-11-02T11:17:50.114193393Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:27:49.709457Z"},{"id":"BELL-CVE-2024-4603","status":"published","published":"2024-05-17T13:34:30.452846Z","modified":"2026-01-26T09:37:58.340264Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:28:20.452786Z"},{"id":"CVE-2024-4603","title":"Excessive time spent checking DSA keys and parameters","description":"Issue summary: Checking excessively long DSA keys or parameters may be very\nslow.\n\nImpact summary: Applications that use the functions EVP_PKEY_param_check()\nor EVP_PKEY_public_check() to check a DSA public key or DSA parameters may\nexperience long delays. Where the key or parameters that are being checked\nhave been obtained from an untrusted source this may lead to a Denial of\nService.\n\nThe functions EVP_PKEY_param_check() or EVP_PKEY_public_check() perform\nvarious checks on DSA parameters. Some of those computations take a long time\nif the modulus (`p` parameter) is too large.\n\nTrying to use a very large modulus is slow and OpenSSL will not allow using\npublic keys with a modulus which is over 10,000 bits in length for signature\nverification. However the key and parameter check functions do not limit\nthe modulus size when performing the checks.\n\nAn application that calls EVP_PKEY_param_check() or EVP_PKEY_public_check()\nand supplies a key or parameters obtained from an untrusted source could be\nvulnerable to a Denial of Service attack.\n\nThese functions are not called by OpenSSL itself on untrusted DSA keys so\nonly applications that directly call these functions may be vulnerable.\n\nAlso vulnerable are the OpenSSL pkey and pkeyparam command line applications\nwhen using the `-check` option.\n\nThe OpenSSL SSL/TLS implementation is not affected by this issue.\n\nThe OpenSSL 3.0 and 3.1 FIPS providers are affected by this issue.","status":"published","published":"2024-05-16T15:21:20.05Z","modified":"2026-11-08T07:05:53.417909066Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-606"],"updated_at":"2026-11-08T07:31:57.993959Z"},{"id":"DEBIAN-CVE-2024-4603","description":"Issue summary: Checking excessively long DSA keys or parameters may be very slow.  Impact summary: Applications that use the functions EVP_PKEY_param_check() or EVP_PKEY_public_check() to check a DSA public key or DSA parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service.  The functions EVP_PKEY_param_check() or EVP_PKEY_public_check() perform various checks on DSA parameters. Some of those computations take a long time if the modulus (`p` parameter) is too large.  Trying to use a very large modulus is slow and OpenSSL will not allow using public keys with a modulus which is over 10,000 bits in length for signature verification. However the key and parameter check functions do not limit the modulus size when performing the checks.  An application that calls EVP_PKEY_param_check() or EVP_PKEY_public_check() and supplies a key or parameters obtained from an untrusted source could be vulnerable to a Denial of Service attack.  These functions are not called by OpenSSL itself on untrusted DSA keys so only applications that directly call these functions may be vulnerable.  Also vulnerable are the OpenSSL pkey and pkeyparam command line applications when using the `-check` option.  The OpenSSL SSL/TLS implementation is not affected by this issue.  The OpenSSL 3.0 and 3.1 FIPS providers are affected by this issue.","status":"published","published":"2024-05-16T16:15:10.643Z","modified":"2026-11-07T09:47:22.919308931Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-07T10:14:39.995311Z"},{"id":"JLSEC-2026-250","title":"Issue summary: Checking excessively long DSA keys or parameters may be very slow.","description":"Issue summary: Checking excessively long DSA keys or parameters may be very\nslow.\n\nImpact summary: Applications that use the functions `EVP_PKEY_param_check()`\nor `EVP_PKEY_public_check()` to check a DSA public key or DSA parameters may\nexperience long delays. Where the key or parameters that are being checked\nhave been obtained from an untrusted source this may lead to a Denial of\nService.\n\nThe functions `EVP_PKEY_param_check()` or `EVP_PKEY_public_check()` perform\nvarious checks on DSA parameters. Some of those computations take a long time\nif the modulus (`p` parameter) is too large.\n\nTrying to use a very large modulus is slow and OpenSSL will not allow using\npublic keys with a modulus which is over 10,000 bits in length for signature\nverification. However the key and parameter check functions do not limit\nthe modulus size when performing the checks.\n\nAn application that calls `EVP_PKEY_param_check()` or `EVP_PKEY_public_check()`\nand supplies a key or parameters obtained from an untrusted source could be\nvulnerable to a Denial of Service attack.\n\nThese functions are not called by OpenSSL itself on untrusted DSA keys so\nonly applications that directly call these functions may be vulnerable.\n\nAlso vulnerable are the OpenSSL pkey and pkeyparam command line applications\nwhen using the `-check` option.\n\nThe OpenSSL SSL/TLS implementation is not affected by this issue.\n\nThe OpenSSL 3.0 and 3.1 FIPS providers are affected by this issue.","status":"published","published":"2026-04-27T18:33:55.942Z","modified":"2026-07-25T18:23:50.115663748Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:47:18.573531Z"},{"id":"OESA-2025-1326","title":"edk2 security update","description":"EDK II is a modern, feature-rich, cross-platform firmware development environment for the UEFI and PI specifications.\r\n\r\nSecurity Fix(es):\n\nIssue summary: Checking excessively long DSA keys or parameters may be very\nslow.\n\nImpact summary: Applications that use the functions EVP_PKEY_param_check()\nor EVP_PKEY_public_check() to check a DSA public key or DSA parameters may\nexperience long delays. Where the key or parameters that are being checked\nhave been obtained from an untrusted source this may lead to a Denial of\nService.\n\nThe functions EVP_PKEY_param_check() or EVP_PKEY_public_check() perform\nvarious checks on DSA parameters. Some of those computations take a long time\nif the modulus (`p` parameter) is too large.\n\nTrying to use a very large modulus is slow and OpenSSL will not allow using\npublic keys with a modulus which is over 10,000 bits in length for signature\nverification. However the key and parameter check functions do not limit\nthe modulus size when performing the checks.\n\nAn application that calls EVP_PKEY_param_check() or EVP_PKEY_public_check()\nand supplies a key or parameters obtained from an untrusted source could be\nvulnerable to a Denial of Service attack.\n\nThese functions are not called by OpenSSL itself on untrusted DSA keys so\nonly applications that directly call these functions may be vulnerable.\n\nAlso vulnerable are the OpenSSL pkey and pkeyparam command line applications\nwhen using the `-check` option.\n\nThe OpenSSL SSL/TLS implementation is not affected by this issue.\n\nThe OpenSSL 3.0 and 3.1 FIPS providers are affected by this issue.(CVE-2024-4603)","status":"published","published":"2025-03-21T11:08:25Z","modified":"2026-08-18T01:18:50.079127165Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:42.714349Z"},{"id":"OESA-2025-1327","title":"edk2 security update","description":"EDK II is a modern, feature-rich, cross-platform firmware development environment for the UEFI and PI specifications.\r\n\r\nSecurity Fix(es):\n\nIssue summary: Checking excessively long DSA keys or parameters may be very\nslow.\n\nImpact summary: Applications that use the functions EVP_PKEY_param_check()\nor EVP_PKEY_public_check() to check a DSA public key or DSA parameters may\nexperience long delays. Where the key or parameters that are being checked\nhave been obtained from an untrusted source this may lead to a Denial of\nService.\n\nThe functions EVP_PKEY_param_check() or EVP_PKEY_public_check() perform\nvarious checks on DSA parameters. Some of those computations take a long time\nif the modulus (`p` parameter) is too large.\n\nTrying to use a very large modulus is slow and OpenSSL will not allow using\npublic keys with a modulus which is over 10,000 bits in length for signature\nverification. However the key and parameter check functions do not limit\nthe modulus size when performing the checks.\n\nAn application that calls EVP_PKEY_param_check() or EVP_PKEY_public_check()\nand supplies a key or parameters obtained from an untrusted source could be\nvulnerable to a Denial of Service attack.\n\nThese functions are not called by OpenSSL itself on untrusted DSA keys so\nonly applications that directly call these functions may be vulnerable.\n\nAlso vulnerable are the OpenSSL pkey and pkeyparam command line applications\nwhen using the `-check` option.\n\nThe OpenSSL SSL/TLS implementation is not affected by this issue.\n\nThe OpenSSL 3.0 and 3.1 FIPS providers are affected by this issue.(CVE-2024-4603)","status":"published","published":"2025-03-21T11:08:25Z","modified":"2026-08-18T01:18:49.769630246Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:42.714349Z"},{"id":"RHSA-2024:9333","title":"Red Hat Security Advisory: openssl and openssl-fips-provider security update","status":"published","published":"2024-11-12T17:57:00Z","modified":"2026-10-09T10:12:54Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:14.610978Z"},{"id":"UBUNTU-CVE-2024-4603","description":"Issue summary: Checking excessively long DSA keys or parameters may be very slow. Impact summary: Applications that use the functions EVP_PKEY_param_check() or EVP_PKEY_public_check() to check a DSA public key or DSA parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. The functions EVP_PKEY_param_check() or EVP_PKEY_public_check() perform various checks on DSA parameters. Some of those computations take a long time if the modulus (`p` parameter) is too large. Trying to use a very large modulus is slow and OpenSSL will not allow using public keys with a modulus which is over 10,000 bits in length for signature verification. However the key and parameter check functions do not limit the modulus size when performing the checks. An application that calls EVP_PKEY_param_check() or EVP_PKEY_public_check() and supplies a key or parameters obtained from an untrusted source could be vulnerable to a Denial of Service attack. These functions are not called by OpenSSL itself on untrusted DSA keys so only applications that directly call these functions may be vulnerable. Also vulnerable are the OpenSSL pkey and pkeyparam command line applications when using the `-check` option. The OpenSSL SSL/TLS implementation is not affected by this issue. The OpenSSL 3.0 and 3.1 FIPS providers are affected by this issue.","status":"published","published":"2024-05-16T16:15:00Z","modified":"2026-04-22T15:08:09.747963Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T16:55:02.636559Z"},{"id":"ALSA-2024:9333","title":"Low: openssl security update","description":"OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library.  \n\nSecurity Fix(es):  \n\n  * openssl: Unbounded memory growth with session handling in TLSv1.3 (CVE-2024-2511)\n  * openssl: Excessive time spent checking DSA keys and parameters (CVE-2024-4603)\n  * openssl: Use After Free with SSL_free_buffers (CVE-2024-4741)\n  * openssl: SSL_select_next_proto buffer overread (CVE-2024-5535)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.  \n\nAdditional Changes:  \n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.\n","status":"published","published":"2024-11-12T00:00:00Z","modified":"2026-10-29T11:31:27.28460828Z","updated_at":"2026-11-02T15:27:53.030731Z"},{"id":"AZL-42049","title":"CVE-2024-4603 affecting package openssl for versions less than 3.3.2-1","description":"Issue summary: Checking excessively long DSA keys or parameters may be very\nslow.\n\nImpact summary: Applications that use the functions EVP_PKEY_param_check()\nor EVP_PKEY_public_check() to check a DSA public key or DSA parameters may\nexperience long delays. Where the key or parameters that are being checked\nhave been obtained from an untrusted source this may lead to a Denial of\nService.\n\nThe functions EVP_PKEY_param_check() or EVP_PKEY_public_check() perform\nvarious checks on DSA parameters. Some of those computations take a long time\nif the modulus (`p` parameter) is too large.\n\nTrying to use a very large modulus is slow and OpenSSL will not allow using\npublic keys with a modulus which is over 10,000 bits in length for signature\nverification. However the key and parameter check functions do not limit\nthe modulus size when performing the checks.\n\nAn application that calls EVP_PKEY_param_check() or EVP_PKEY_public_check()\nand supplies a key or parameters obtained from an untrusted source could be\nvulnerable to a Denial of Service attack.\n\nThese functions are not called by OpenSSL itself on untrusted DSA keys so\nonly applications that directly call these functions may be vulnerable.\n\nAlso vulnerable are the OpenSSL pkey and pkeyparam command line applications\nwhen using the `-check` option.\n\nThe OpenSSL SSL/TLS implementation is not affected by this issue.\n\nThe OpenSSL 3.0 and 3.1 FIPS providers are affected by this issue.","status":"published","published":"2024-05-16T16:15:10Z","modified":"2026-04-21T04:54:54.425281Z","updated_at":"2026-11-02T15:28:04.893995Z"},{"id":"AZL-42058","title":"CVE-2024-4603 affecting package nodejs for versions less than 20.14.0-1","description":"Issue summary: Checking excessively long DSA keys or parameters may be very\nslow.\n\nImpact summary: Applications that use the functions EVP_PKEY_param_check()\nor EVP_PKEY_public_check() to check a DSA public key or DSA parameters may\nexperience long delays. Where the key or parameters that are being checked\nhave been obtained from an untrusted source this may lead to a Denial of\nService.\n\nThe functions EVP_PKEY_param_check() or EVP_PKEY_public_check() perform\nvarious checks on DSA parameters. Some of those computations take a long time\nif the modulus (`p` parameter) is too large.\n\nTrying to use a very large modulus is slow and OpenSSL will not allow using\npublic keys with a modulus which is over 10,000 bits in length for signature\nverification. However the key and parameter check functions do not limit\nthe modulus size when performing the checks.\n\nAn application that calls EVP_PKEY_param_check() or EVP_PKEY_public_check()\nand supplies a key or parameters obtained from an untrusted source could be\nvulnerable to a Denial of Service attack.\n\nThese functions are not called by OpenSSL itself on untrusted DSA keys so\nonly applications that directly call these functions may be vulnerable.\n\nAlso vulnerable are the OpenSSL pkey and pkeyparam command line applications\nwhen using the `-check` option.\n\nThe OpenSSL SSL/TLS implementation is not affected by this issue.\n\nThe OpenSSL 3.0 and 3.1 FIPS providers are affected by this issue.","status":"published","published":"2024-05-16T16:15:10Z","modified":"2026-04-21T04:52:43.214984Z","updated_at":"2026-11-02T15:28:04.893995Z"},{"id":"AZL-42063","title":"CVE-2024-4603 affecting package edk2 for versions less than 20240524git3e722403cd16-8","description":"Issue summary: Checking excessively long DSA keys or parameters may be very\nslow.\n\nImpact summary: Applications that use the functions EVP_PKEY_param_check()\nor EVP_PKEY_public_check() to check a DSA public key or DSA parameters may\nexperience long delays. Where the key or parameters that are being checked\nhave been obtained from an untrusted source this may lead to a Denial of\nService.\n\nThe functions EVP_PKEY_param_check() or EVP_PKEY_public_check() perform\nvarious checks on DSA parameters. Some of those computations take a long time\nif the modulus (`p` parameter) is too large.\n\nTrying to use a very large modulus is slow and OpenSSL will not allow using\npublic keys with a modulus which is over 10,000 bits in length for signature\nverification. However the key and parameter check functions do not limit\nthe modulus size when performing the checks.\n\nAn application that calls EVP_PKEY_param_check() or EVP_PKEY_public_check()\nand supplies a key or parameters obtained from an untrusted source could be\nvulnerable to a Denial of Service attack.\n\nThese functions are not called by OpenSSL itself on untrusted DSA keys so\nonly applications that directly call these functions may be vulnerable.\n\nAlso vulnerable are the OpenSSL pkey and pkeyparam command line applications\nwhen using the `-check` option.\n\nThe OpenSSL SSL/TLS implementation is not affected by this issue.\n\nThe OpenSSL 3.0 and 3.1 FIPS providers are affected by this issue.","status":"published","published":"2024-05-16T16:15:10Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:19.893001Z"},{"id":"AZL-42694","title":"CVE-2024-4603 affecting package cloud-hypervisor-cvm for versions less than 38.0.72.2-1","description":"Issue summary: Checking excessively long DSA keys or parameters may be very\nslow.\n\nImpact summary: Applications that use the functions EVP_PKEY_param_check()\nor EVP_PKEY_public_check() to check a DSA public key or DSA parameters may\nexperience long delays. Where the key or parameters that are being checked\nhave been obtained from an untrusted source this may lead to a Denial of\nService.\n\nThe functions EVP_PKEY_param_check() or EVP_PKEY_public_check() perform\nvarious checks on DSA parameters. Some of those computations take a long time\nif the modulus (`p` parameter) is too large.\n\nTrying to use a very large modulus is slow and OpenSSL will not allow using\npublic keys with a modulus which is over 10,000 bits in length for signature\nverification. However the key and parameter check functions do not limit\nthe modulus size when performing the checks.\n\nAn application that calls EVP_PKEY_param_check() or EVP_PKEY_public_check()\nand supplies a key or parameters obtained from an untrusted source could be\nvulnerable to a Denial of Service attack.\n\nThese functions are not called by OpenSSL itself on untrusted DSA keys so\nonly applications that directly call these functions may be vulnerable.\n\nAlso vulnerable are the OpenSSL pkey and pkeyparam command line applications\nwhen using the `-check` option.\n\nThe OpenSSL SSL/TLS implementation is not affected by this issue.\n\nThe OpenSSL 3.0 and 3.1 FIPS providers are affected by this issue.","status":"published","published":"2024-05-16T16:15:10Z","modified":"2026-04-21T04:30:41.971112Z","updated_at":"2026-11-02T15:28:04.893995Z"},{"id":"AZL-42766","title":"CVE-2024-4603 affecting package cloud-hypervisor-cvm for versions less than 38.0.72.2-1","description":"Issue summary: Checking excessively long DSA keys or parameters may be very\nslow.\n\nImpact summary: Applications that use the functions EVP_PKEY_param_check()\nor EVP_PKEY_public_check() to check a DSA public key or DSA parameters may\nexperience long delays. Where the key or parameters that are being checked\nhave been obtained from an untrusted source this may lead to a Denial of\nService.\n\nThe functions EVP_PKEY_param_check() or EVP_PKEY_public_check() perform\nvarious checks on DSA parameters. Some of those computations take a long time\nif the modulus (`p` parameter) is too large.\n\nTrying to use a very large modulus is slow and OpenSSL will not allow using\npublic keys with a modulus which is over 10,000 bits in length for signature\nverification. However the key and parameter check functions do not limit\nthe modulus size when performing the checks.\n\nAn application that calls EVP_PKEY_param_check() or EVP_PKEY_public_check()\nand supplies a key or parameters obtained from an untrusted source could be\nvulnerable to a Denial of Service attack.\n\nThese functions are not called by OpenSSL itself on untrusted DSA keys so\nonly applications that directly call these functions may be vulnerable.\n\nAlso vulnerable are the OpenSSL pkey and pkeyparam command line applications\nwhen using the `-check` option.\n\nThe OpenSSL SSL/TLS implementation is not affected by this issue.\n\nThe OpenSSL 3.0 and 3.1 FIPS providers are affected by this issue.","status":"published","published":"2024-05-16T16:15:10Z","modified":"2026-04-21T04:50:30.113716Z","updated_at":"2026-11-02T15:28:04.893995Z"},{"id":"AZL-47684","title":"CVE-2024-4603 affecting package hvloader for versions less than 1.0.1-6","description":"Issue summary: Checking excessively long DSA keys or parameters may be very\nslow.\n\nImpact summary: Applications that use the functions EVP_PKEY_param_check()\nor EVP_PKEY_public_check() to check a DSA public key or DSA parameters may\nexperience long delays. Where the key or parameters that are being checked\nhave been obtained from an untrusted source this may lead to a Denial of\nService.\n\nThe functions EVP_PKEY_param_check() or EVP_PKEY_public_check() perform\nvarious checks on DSA parameters. Some of those computations take a long time\nif the modulus (`p` parameter) is too large.\n\nTrying to use a very large modulus is slow and OpenSSL will not allow using\npublic keys with a modulus which is over 10,000 bits in length for signature\nverification. However the key and parameter check functions do not limit\nthe modulus size when performing the checks.\n\nAn application that calls EVP_PKEY_param_check() or EVP_PKEY_public_check()\nand supplies a key or parameters obtained from an untrusted source could be\nvulnerable to a Denial of Service attack.\n\nThese functions are not called by OpenSSL itself on untrusted DSA keys so\nonly applications that directly call these functions may be vulnerable.\n\nAlso vulnerable are the OpenSSL pkey and pkeyparam command line applications\nwhen using the `-check` option.\n\nThe OpenSSL SSL/TLS implementation is not affected by this issue.\n\nThe OpenSSL 3.0 and 3.1 FIPS providers are affected by this issue.","status":"published","published":"2024-05-16T16:15:10Z","modified":"2026-04-21T04:32:58.197503Z","updated_at":"2026-11-02T15:28:05.694722Z"},{"id":"AZL-78534","title":"CVE-2024-4603 affecting package openssl-fips-provider 3.1.2-2","description":"Issue summary: Checking excessively long DSA keys or parameters may be very\nslow.\n\nImpact summary: Applications that use the functions EVP_PKEY_param_check()\nor EVP_PKEY_public_check() to check a DSA public key or DSA parameters may\nexperience long delays. Where the key or parameters that are being checked\nhave been obtained from an untrusted source this may lead to a Denial of\nService.\n\nThe functions EVP_PKEY_param_check() or EVP_PKEY_public_check() perform\nvarious checks on DSA parameters. Some of those computations take a long time\nif the modulus (`p` parameter) is too large.\n\nTrying to use a very large modulus is slow and OpenSSL will not allow using\npublic keys with a modulus which is over 10,000 bits in length for signature\nverification. However the key and parameter check functions do not limit\nthe modulus size when performing the checks.\n\nAn application that calls EVP_PKEY_param_check() or EVP_PKEY_public_check()\nand supplies a key or parameters obtained from an untrusted source could be\nvulnerable to a Denial of Service attack.\n\nThese functions are not called by OpenSSL itself on untrusted DSA keys so\nonly applications that directly call these functions may be vulnerable.\n\nAlso vulnerable are the OpenSSL pkey and pkeyparam command line applications\nwhen using the `-check` option.\n\nThe OpenSSL SSL/TLS implementation is not affected by this issue.\n\nThe OpenSSL 3.0 and 3.1 FIPS providers are affected by this issue.","status":"published","published":"2024-05-16T16:15:10Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:24.626116Z"},{"id":"CLSA-2024-1735121358","title":"openssl: Fix of CVE-2024-4603","description":"- CVE-2024-4603: Check DSA parameters for excessive sizes before validating","status":"published","published":"2024-12-25T10:09:26Z","modified":"2026-06-01T00:30:25.921954893Z","updated_at":"2026-11-02T15:43:41.281406Z"},{"id":"CLSA-2026-1779782518","title":"openssl: Fix of 3 CVEs","description":"- CVE-2023-3446: fix DH_check() excessive time with over sized modulus\n- CVE-2024-4603: fix DSA parameter check excessive time with very large keys\n- CVE-2024-4741: fix use-after-free in SSL_free_buffers","status":"published","published":"2026-05-26T08:02:07Z","modified":"2026-10-26T09:30:04.870201596Z","updated_at":"2026-11-02T15:43:45.090939Z"},{"id":"MGASA-2024-0200","title":"Updated openssl packages fix security vulnerabilities","description":"The updated packages fix security vulnerabilities:\nExcessive time spent checking DSA keys and parameters. (CVE-2024-4603)\nUse After Free with SSL_free_buffers. (CVE-2024-4741)\n","status":"published","published":"2024-05-31T15:15:28Z","modified":"2026-04-16T04:43:08.608469075Z","updated_at":"2026-11-02T15:49:42.684501Z"},{"id":"MGASA-2024-0281","title":"Updated quictls packages fix security vulnerabilities","description":"The updated packages fix security vulnerabilities\n","status":"published","published":"2024-08-19T19:12:14Z","modified":"2026-04-16T04:44:06.33061675Z","updated_at":"2026-11-02T15:49:42.684501Z"},{"id":"openSUSE-SU-2024:13992-1","title":"libopenssl-3-devel-3.1.4-8.1 on GA media","description":"These are all security issues fixed in the libopenssl-3-devel-3.1.4-8.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:55:38.148832Z","updated_at":"2026-11-02T16:58:36.662953Z"},{"id":"RLSA-2024:9333","title":"Low: openssl and openssl-fips-provider security update","description":"OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library.\n\nSecurity Fix(es):\n\n* openssl: Unbounded memory growth with session handling in TLSv1.3 (CVE-2024-2511)\n\n* openssl: Excessive time spent checking DSA keys and parameters (CVE-2024-4603)\n\n* openssl: Use After Free with SSL_free_buffers (CVE-2024-4741)\n\n* openssl: SSL_select_next_proto buffer overread (CVE-2024-5535)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Rocky Linux 9.5 Release Notes linked from the References section.","status":"published","published":"2025-03-17T20:16:43.608626Z","modified":"2026-02-04T14:00:10.592775Z","updated_at":"2026-11-02T15:53:24.923365Z"},{"id":"SUSE-SU-2024:1789-1","title":"Security update for openssl-3","description":"This update for openssl-3 fixes the following issues:\n\n- CVE-2024-4603: Fixed DSA parameter checks for excessive sizes before validating (bsc#1224388).\n","status":"published","published":"2024-05-27T13:27:28Z","modified":"2026-02-04T03:45:50.381898Z","updated_at":"2026-11-02T15:53:54.652421Z"},{"id":"SUSE-SU-2024:1947-1","title":"Security update for openssl-3","description":"This update for openssl-3 fixes the following issues:\n\n- CVE-2024-2511: Fixed unconstrained session cache growth in TLSv1.3 (bsc#1222548).\n- CVE-2024-4603: Fixed DSA parameter checks for excessive sizes before validating (bsc#1224388).\n","status":"published","published":"2024-06-07T15:06:16Z","modified":"2026-02-04T02:33:26.730238Z","updated_at":"2026-11-02T15:53:54.652421Z"},{"id":"SUSE-SU-2024:2066-1","title":"Security update for openssl-3","description":"This update for openssl-3 fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2024-4603: Check DSA parameters for excessive sizes before validating (bsc#1224388)\n- CVE-2024-4741: Fixed a use-after-free with SSL_free_buffers. (bsc#1225551)\n\nOther issues fixed:\n\n- Enable livepatching support (bsc#1223428)\n- Fix HDKF key derivation (bsc#1225291, gh#openssl/openssl#23448, +  gh#openssl/openssl#23456)\n","status":"published","published":"2024-06-18T11:16:10Z","modified":"2026-02-04T02:51:40.149097Z","updated_at":"2026-11-02T15:53:54.652421Z"},{"id":"SUSE-SU-2025:20014-1","title":"Security update for openssl-3, libpulp, ulp-macros","description":"This update for openssl-3, libpulp, ulp-macros fixes the following issues:\n\nopenssl-3:\n  - CVE-2024-6119: possible denial of service in X.509 name checks (bsc#1229465)\n  - CVE-2024-5535: SSL_select_next_proto buffer overread (bsc#1227138)\n  - CVE-2024-4741: Fixed a use-after-free with SSL_free_buffers (bsc#1225551)\n  - CVE-2024-4603: Check DSA parameters for excessive sizes before validating (bsc#1224388)\n  - CVE-2024-2511: Fix unconstrained session cache growth in TLSv1.3 (bsc#1222548)\n  - FIPS: Deny SHA-1 signature verification in FIPS provider (bsc#1221365)\n  - FIPS: RSA keygen PCT requirements. (bsc#1221760, bsc#1221753)\n  - FIPS: Check that the fips provider is available before setting it as the default provider in FIPS mode. (bsc#1220523)\n  - FIPS: Port openssl to use jitterentropy (bsc#1220523)\n  - FIPS: Block non-Approved Elliptic Curves (bsc#1221786)\n  - FIPS: Service Level Indicator (bsc#1221365)\n  - FIPS: Output the FIPS-validation name and module version which uniquely identify the FIPS validated module. (bsc#1221751)\n  - FIPS: Add required selftests (bsc#1221760)\n  - FIPS: DH: Disable FIPS 186-4 Domain Parameters (bsc#1221821)\n  - FIPS: Recommendation for Password-Based Key Derivation (bsc#1221827)\n  - FIPS: Zeroization is required (bsc#1221752)\n  - FIPS: Reseed DRBG (bsc#1220690, bsc#1220693, bsc#1220696)\n  - FIPS: NIST SP 800-56Brev2 (bsc#1221824)\n  - FIPS: Approved Modulus Sizes for RSA Digital Signature for FIPS 186-4 (bsc#1221787)\n  - FIPS: Port openssl to use jitterentropy (bsc#1220523)\n  - FIPS: NIST SP 800-56Arev3 (bsc#1221822)\n  - FIPS: Error state has to be enforced (bsc#1221753)\n  - Build with enabled sm2 and sm4 support (bsc#1222899)\n  - fix non-reproducible build issue\n  - Fix HDKF key derivation (bsc#1225291)\n  - Enable livepatching support (bsc#1223428)\n\nlibpulp:\n  - Update package with libpulp-0.3.5\n    * Change .so load policy from lazy to eager.\n    * Fix patch of references when mprotect is enabled.\n    * Fix tramposed calloc arguments.\n    * Fix crash of ulp packer on empty lines.\n\n  - Disabled ptrace_scope through aaa_base-enable-ptrace package (bsc#1221763).\n  - Update package with libpulp-0.3.4:\n    * Add debuginfo into ulp extract.\n\n  - Disabled ptrace_scope when building the package (bsc#1221763).\n  - Update package with libpulp-0.3.3:\n    * Fixed a race condition when process list is empty.\n    * Removed \"Unable to get section data\" error message (bsc#1223306).\n    * Bumped asunsafe_conversion attempts from 100 to 2000.\n    * Fixed banner test on clang-18.\n    * Check if ptrace_scope is enabled when attempting a ptrace operation (bsc#1221763).\n\n  - Update package with libpulp-0.3.1:\n    * Add timestamp information on `ulp patches`.\n\nulp-macros:\n  - Initial release.\n","status":"published","published":"2025-02-03T08:48:16Z","modified":"2026-03-23T04:50:02.311763Z","updated_at":"2026-11-02T15:53:59.381172Z"},{"id":"USN-6937-1","title":"openssl vulnerabilities","description":"It was discovered that OpenSSL incorrectly handled TLSv1.3 sessions when\ncertain non-default TLS server configurations were in use. A remote\nattacker could possibly use this issue to cause OpenSSL to consume\nresources, leading to a denial of service. (CVE-2024-2511)\n\nIt was discovered that OpenSSL incorrectly handled checking excessively\nlong DSA keys or parameters. A remote attacker could possibly use this\nissue to cause OpenSSL to consume resources, leading to a denial of\nservice. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS.\n(CVE-2024-4603)\n\nWilliam Ahern discovered that OpenSSL incorrectly handled certain memory\noperations in a rarely-used API. A remote attacker could use this issue to\ncause OpenSSL to crash, resulting in a denial of service, or possibly\nexecute arbitrary code. (CVE-2024-4741)\n\nJoseph Birr-Pixton discovered that OpenSSL incorrectly handled calling a\ncertain API with an empty supported client protocols buffer. A remote\nattacker could possibly use this issue to obtain sensitive information, or\ncause OpenSSL to crash, resulting in a denial of service. (CVE-2024-5535)\n","status":"published","published":"2024-07-31T15:46:50Z","modified":"2026-11-09T12:46:31.51934829Z","updated_at":"2026-11-09T12:55:09.79476Z"}]}}