Oqs Provider
Approved changes feed: RSS · Atom
cpe:2.3:a:open_quantum_safe:oqs_provider:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Open Quantum Safe (f4a77833-77bb-53c1-9bb9-abae3081847f) |
|---|---|
| Product | Oqs Provider (81e89234-d1e6-5780-a35b-d364584bcdcb) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2024-37305 |
vulnerable | 2026-06-08 06:39:47.090126 |
Buffer overflow in deserialization in oqs-provider
HIGH (8.2)
oqs-provider is a provider for the OpenSSL 3 cryptography library that adds support for post-quantum cryptography in TLS, X.509, and S/MIME using post-quantum algorithms from liboqs. Flaws have been identified in the way oqs-provider handles lengths decoded with DECODE_UINT32 at the start of serialized hybrid (traditional + post-quantum) keys and signatures. Unchecked length values are later used for memory reads and writes; malformed input can lead to crashes or information leakage. Handling of plain/non-hybrid PQ key operation is not affected. This issue has been patched in in v0.6.1. All users are advised to upgrade. There are no workarounds for this issue.
Published: 2024-06-17T19:42:22.091Z
Updated: 2024-08-02T03:50:56.102Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.