CVE-2022-2097

MediumCVSS 5.3/10Last modified Oct 14, 2026

Description

AES OCB mode for 32-bit x86 platforms using the AES-NI assembly optimised implementation will not encrypt the entirety of the data under some circumstances. This could reveal sixteen bytes of data that was preexisting in the memory that wasn't written. In the special case of "in place" encryption, sixteen bytes of the plaintext would be revealed. Since OpenSSL does not support OCB based cipher suites for TLS and DTLS, they are both unaffected. Fixed in OpenSSL 3.0.5 (Affected 3.0.0-3.0.4). Fixed in OpenSSL 1.1.1q (Affected 1.1.1-1.1.1p).

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-327

Affected software

No affected versions have been published.

Timeline

Published: Jul 5, 2022
Last modified: Oct 14, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-20989.8Weak Password Requirements in GitHub repository kromitgmbh/titra prior to 0.78.1.CVE-2022-20994.8The WooCommerce WordPress plugin before 6.6.0 is vulnerable to stored HTML injection due to lack of escaping and sanitizing in the payment g CVE-2022-21004.8The Page Generator WordPress plugin before 1.6.5 does not sanitise and escape its settings, allowing high privilege users such as admin to p CVE-2022-21015.4The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `file[files][]` parameter in versions up to, CVE-2022-21027.5Controls limiting uploads to certain file extensions may be bypassed. This could allow an attacker to intercept the initial file upload page CVE-2022-21039.1An attacker with weak credentials could access the TCP port via an open FTP port, allowing an attacker to read sensitive files and write to CVE-2022-21049.8The www-data (Apache web server) account is configured to run sudo with no password for many commands (including /bin/sh and /bin/bash).CVE-2022-21059.1Client-side JavaScript controls may be bypassed to change user credentials and permissions without authentication, including a “root” user l CVE-2022-21062.7Elcomplus SmartICS v2.3.4.0 does not validate the filenames sufficiently, which enables authenticated administrator-level users to perform p CVE-2022-21079.8The MiCODUS MV720 GPS tracker API server has an authentication mechanism that allows devices to use a hard-coded master password. This may a CVE-2022-21085.3The plugin Wbcom Designs – BuddyPress Group Reviews for WordPress is vulnerable to unauthorized settings changes and review modification due CVE-2022-21118.8Unrestricted Upload of File with Dangerous Type in GitHub repository inventree/inventree prior to 0.7.2.