CVE-2022-29242

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2022-29242
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-29242.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2022-29242
Downstream
Related
  • GHSA-2rmw-8wpg-vgw5
Published
2022-05-24T15:15:08Z
Modified
2025-09-19T13:51:45.741445Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
[none]
Details

GOST engine is a reference implementation of the Russian GOST crypto algorithms for OpenSSL. TLS clients using GOST engine when ciphersuite TLS_GOSTR341112_256_WITH_KUZNYECHIK_CTR_OMAC is agreed and the server uses 512 bit GOST secret keys are vulnerable to buffer overflow. GOST engine version 3.0.1 contains a patch for this issue. Disabling ciphersuite TLS_GOSTR341112_256_WITH_KUZNYECHIK_CTR_OMAC is a possible workaround.

References

Affected packages

Git / github.com/gost-engine/engine

Affected ranges

Type
GIT
Repo
https://github.com/gost-engine/engine
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
7df766124f87768b43b9e8947c5a01e17545772c
Fixed
b2b4d629f100eaee9f5942a106b1ccefe85b8808
Fixed
c6655a0b620a3e31f085cc906f8073fe81b2fad3

Affected versions

v3.*

v3.0.0

Database specific 

{
    "vanir_signatures": [
        {
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "181079042129152464932669655050909846368",
                    "158295315304811067947470668990101074335",
                    "239758865765949342379508158066880226757",
                    "7856286627472673225455720181777985340"
                ]
            },
            "signature_type": "Line",
            "source": "https://github.com/gost-engine/engine/commit/c6655a0b620a3e31f085cc906f8073fe81b2fad3",
            "target": {
                "file": "e_gost_err.c"
            },
            "signature_version": "v1",
            "deprecated": false,
            "id": "CVE-2022-29242-518bdba1"
        },
        {
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "65030514501109260630237999873123317328",
                    "118759800526282905302103490401707480352",
                    "25217270377180783317180417274478535203",
                    "82835145014064360693273568063469535198",
                    "190573629692466551360361712816298746329",
                    "270785022693191878437097098274107173792",
                    "59505043026629093783673545315870750222",
                    "66807662697499471765169844625495725539",
                    "259928869894521617717612055134712520778"
                ]
            },
            "signature_type": "Line",
            "source": "https://github.com/gost-engine/engine/commit/c6655a0b620a3e31f085cc906f8073fe81b2fad3",
            "target": {
                "file": "gost_ec_keyx.c"
            },
            "signature_version": "v1",
            "deprecated": false,
            "id": "CVE-2022-29242-7c5971bf"
        },
        {
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "225974880740951108040578185193683290431",
                    "83795847996781818239151978839630099984",
                    "92443563628866274598904886782383012572",
                    "271866978301397155848059525930755811876"
                ]
            },
            "signature_type": "Line",
            "source": "https://github.com/gost-engine/engine/commit/c6655a0b620a3e31f085cc906f8073fe81b2fad3",
            "target": {
                "file": "e_gost_err.h"
            },
            "signature_version": "v1",
            "deprecated": false,
            "id": "CVE-2022-29242-8a1db8d3"
        },
        {
            "digest": {
                "function_hash": "88359506090462606094284207342429409843",
                "length": 2773.0
            },
            "signature_type": "Function",
            "source": "https://github.com/gost-engine/engine/commit/c6655a0b620a3e31f085cc906f8073fe81b2fad3",
            "target": {
                "file": "gost_ec_keyx.c",
                "function": "pkey_gost2018_encrypt"
            },
            "signature_version": "v1",
            "deprecated": false,
            "id": "CVE-2022-29242-fc24cf99"
        }
    ]
}