RSA verification recovery in the EVP_PKEY_verify_recover function in OpenSSL 1.x prior to 1.0.0a, as used by pkeyutl and possibly other applications, returns uninitialized memory upon failure, which might allow context-dependent malicious users to bypass intended key requirements or obtain sensitive information via unspecified vectors. NOTE: some of these details are obtained from third party information.
| Vulnerable Product | Search on Vulmon | Subscribe to Product |
|---|---|---|
openssl openssl 1.0.0 |
Vulmon