PatchTheCVExyssl vulnerabilities and fixes
Recent CVEs affecting xyssl, with upgrade or downgrade steps. 2 tracked.
xyssl has 2 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 2. Most recent: 2009-08-31. Highest priority: CVE-2008-7128 (score 44/100).
- CVE-2008-7129 MEDIUM 5.0 UPGRADE XySSL before 0.9 allows remote attackers to cause a denial of service (infinite loop) via an X.509 certificate
- CVE-2008-7128 HIGH 7.5 UPGRADE The ssl_parse_client_key_exchange function in XySSL before 0.9 does not protect against certain Bleichenbacher
FAQ
How do I fix xyssl vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is xyssl being exploited right now?
None of the tracked xyssl CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which xyssl CVE should I patch first?
CVE-2008-7128 currently ranks highest (44/100): The ssl_parse_client_key_exchange function in XySSL before 0.9 does not protect against certain Bleichenbacher.