GCVE - cpe:2.3:a:openbsd:libressl:2.7.0:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:openbsd:libressl:2.7.0:*:*:*:*:*:*:*

part: a version: 2.7.0 update: *

Vendor	Openbsd (`932cdfc2-94b9-5fb6-8ef3-d0b271f414b5`)
Product	Libressl (`513ce91f-ac22-56f6-beb3-ac56aac3ae95`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:github/libressl-portable/openbsd`	purl2cpe	2026-06-01 10:17:37.639159
`pkg:github/libressl-portable/portable`	purl2cpe	2026-06-01 10:17:37.639160
`pkg:rpm/opensuse/libressl`	purl2cpe	2026-06-01 10:17:37.639162
`pkg:sourceforge/libressl-3-2-0-for-windows`	purl2cpe	2026-06-01 10:17:37.639163

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2018-8970`	vulnerable	2026-06-08 05:12:06.769232	Details available The int_x509_param_set_hosts function in lib/libcrypto/x509/x509_vpm.c in LibreSSL 2.7.0 before 2.7.1 does not support a certain special case of a zero name length, which causes silent omission of hostname verification, and consequently allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. NOTE: the LibreSSL documentation indicates that this special case is supported, but the BoringSSL documentation does not. Published: 2018-03-24T21:00:00.000Z Updated: 2024-08-05T07:10:47.345Z Open on db.gcve.eu Reference links https://github.com/libressl-portable/openbsd/commit/0654414afcce51a16d35d05060190a3ec4618d42 https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-2.7.1-relnotes.txt https://boringssl.googlesource.com/boringssl/+/e759a9cd84198613199259dbed401f4951747cff	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2018-12434`	vulnerable	2026-06-08 05:10:41.559581	Details available LibreSSL before 2.6.5 and 2.7.x before 2.7.4 allows a memory-cache side-channel attack on DSA and ECDSA signatures, aka the Return Of the Hidden Number Problem or ROHNP. To discover a key, the attacker needs access to either the local machine or a different virtual machine on the same physical host. Published: 2018-06-15T02:00:00.000Z Updated: 2024-09-16T22:52:15.412Z Open on db.gcve.eu Reference links https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-2.7.4-relnotes.txt https://www.nccgroup.trust/us/our-research/technical-advisory-return-of-the-hidden-number-problem/ https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-2.6.5-relnotes.txt	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.