CVE-2022-2097

Highest-risk unexploited with PoCs

Exploit code exists, no confirmed in-the-wild activity, ranked by EPSS

Actively Exploited

Confirmed exploited in the wild, sorted by most recently updated

EPSS 5%

Published 2022-07-05Updated 2025-04-28

Vulnerability details

AES OCB mode for 32-bit x86 platforms using the AES-NI assembly optimised implementation will not encrypt the entirety of the data under some circumstances. This could reveal sixteen bytes of data that was preexisting in the memory that wasn't written. In the special case of "in place" encryption, sixteen bytes of the plaintext would be revealed. Since OpenSSL does not support OCB based cipher suites for TLS and DTLS, they are both unaffected. Fixed in OpenSSL 3.0.5 (Affected 3.0.0-3.0.4). Fixed in OpenSSL 1.1.1q (Affected 1.1.1-1.1.1p).

CNAopenssl

EPSS score history

Sources

1 links

PoC links are not available for guest users. Login to view them.

CVE Organization

Profile

CVSS

EPSS

Published

2022-07-05

Updated

2025-04-28

CNA

openssl

Vendors

OpenSSL

1 product

CPEs

cpe:2.3:a:openssl:openssl:1.1.1:*:*:*:*:*:*:*

cpe:2.3:a:openssl:openssl:3.0.0:*:*:*:*:*:*:*

cpe:2.3:a:netapp:ontap_antivirus_connector:*:*:*:*:*:*:*:*

cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:*:*:*:*:*:*:*:*

cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*

cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*

cpe:2.3:a:netapp:active_iq_unified_manager_for_vmware_vsphere:*:*:*:*:*:*:*:*

cpe:2.3:a:netapp:hci_baseboard_management_controller:h300s:*:*:*:*:*:*:*

cpe:2.3:a:netapp:hci_baseboard_management_controller:h410c:*:*:*:*:*:*:*

cpe:2.3:a:netapp:hci_baseboard_management_controller:h410s:*:*:*:*:*:*:*

cpe:2.3:a:netapp:hci_baseboard_management_controller:h500s:*:*:*:*:*:*:*

cpe:2.3:a:netapp:hci_baseboard_management_controller:h700s:*:*:*:*:*:*:*

cpe:2.3:o:netapp:brocade_fabric_operating_system_firmware:*:*:*:*:*:*:*:*

cpe:2.3:a:netapp:snapcenter:*:*:*:*:*:*:*:*

cpe:2.3:a:netapp:oncommand_insight:*:*:*:*:*:*:*:*

cpe:2.3:a:netapp:smi-s_provider:*:*:*:*:*:*:*:*

cpe:2.3:a:siemens:sinec_ins:*:*:*:*:*:*:*:*

cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*

cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*

Vulnerability dashboard

Highest-risk unexploited with PoCs

Actively Exploited

Recently Updated