« Volver al listado

CVE-2026-42770

Estado: ModificadaBaja (3.7)—

Issue summary: When EVP_PKEY_derive_set_peer() is called with a DHX (X9.42) peer key, the peer key is not properly checked for the subgroup membership.

Impact summary: A malicious peer which presents an X9.42 key carrying the victim's p and g parameters, a forged q = r (a small prime factor of the cofactor (p−1)/q_local), and a public value Y of order r can recover the victim's private key after a small number of key exchange attempts.

When EVP_PKEY_derive_set_peer() is called with a DHX (X9.42) peer key, the subgroup membership check Y^q ≡ 1 (mod p) is performed using the peer's own q parameter, not the local key's q. The peer's domain parameters are then matched against the domain parameters of the private key, but the value of q is not compared.

Leer descripción completaMostrar menos

A malicious peer who presents an X9.42 key carrying the victim's p, g, a forged q = r (a small prime factor of the cofactor), and a public value Y of order r passes all checks. The shared secret then takes only r distinct values, leaking priv mod r. Repeating for each small-prime factor of the cofactor and combining via CRT recovers the full private key (Lim–Lee / small-subgroup-confinement attack).

The realistic attack surface is narrow: principally CMP deployments with long-lived RA/CA DHX keys and bespoke enterprise or government applications using X9.42 DHX static keys with interactive protocols and therefore this issue was assigned Low severity.

The FIPS modules in 4.0, 3.6, 3.5, 3.4, 3.1.2 and 3.0 are affected by this issue.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Openssl — Openssl

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-42770",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-42770",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-06-09T19:34:57.693097Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 3.7,
          "attackVector": "NETWORK",
          "baseSeverity": "LOW",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 2.2
      }
    ]
  },
  "affected": [
    {
      "source": "openssl-security@openssl.org",
      "affectedData": [
        {
          "vendor": "OpenSSL",
          "product": "OpenSSL",
          "versions": [
            {
              "status": "affected",
              "version": "4.0.0",
              "lessThan": "4.0.1",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "3.6.0",
              "lessThan": "3.6.3",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "3.5.0",
              "lessThan": "3.5.7",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "3.4.0",
              "lessThan": "3.4.6",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "3.0.0",
              "lessThan": "3.0.21",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-06-09T17:17:08.523",
  "references": [
    {
      "url": "https://github.com/openssl/openssl/commit/3da5a516cd2635a320ff748503db2cef7c4b0f02",
      "tags": [
        "Patch"
      ],
      "source": "openssl-security@openssl.org"
    },
    {
      "url": "https://github.com/openssl/openssl/commit/3ddbb7ab50bd93dfc59cbe08e269a67605aeebdb",
      "tags": [
        "Patch"
      ],
      "source": "openssl-security@openssl.org"
    },
    {
      "url": "https://github.com/openssl/openssl/commit/5f452bba2c681423d8fcffd120a19b757ee42e3c",
      "tags": [
        "Patch"
      ],
      "source": "openssl-security@openssl.org"
    },
    {
      "url": "https://github.com/openssl/openssl/commit/7fbfde7677ed8808828bf00ff01c937ca04bdda2",
      "tags": [
        "Patch"
      ],
      "source": "openssl-security@openssl.org"
    },
    {
      "url": "https://github.com/openssl/openssl/commit/ca2237ab5615641b662183b077f62c08d75e8070",
      "tags": [
        "Patch"
      ],
      "source": "openssl-security@openssl.org"
    },
    {
      "url": "https://openssl-library.org/news/secadv/20260609.txt",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "openssl-security@openssl.org"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "openssl-security@openssl.org",
      "description": [
        {
          "lang": "en",
          "value": "CWE-325"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Issue summary: When EVP_PKEY_derive_set_peer() is called with a DHX (X9.42)\npeer key, the peer key is not properly checked for the subgroup membership.\n\nImpact summary: A malicious peer which presents an X9.42 key carrying the\nvictim's p and g parameters, a forged q = r (a small prime factor of the\ncofactor (p−1)/q_local), and a public value Y of order r can recover the\nvictim's private key after a small number of key exchange attempts.\n\nWhen EVP_PKEY_derive_set_peer() is called with a DHX (X9.42) peer key, the\nsubgroup membership check Y^q ≡ 1 (mod p) is performed using the peer's\nown q parameter, not the local key's q. The peer's domain parameters are\nthen matched against the domain parameters of the private key, but the value\nof q is not compared.\n\nA malicious peer who presents an X9.42 key carrying the victim's p, g,\na forged q = r (a small prime factor of the cofactor), and a public\nvalue Y of order r passes all checks. The shared secret then takes only\nr distinct values, leaking priv mod r. Repeating for each small-prime\nfactor of the cofactor and combining via CRT recovers the full private\nkey (Lim–Lee / small-subgroup-confinement attack).\n\nThe realistic attack surface is narrow: principally CMP deployments with\nlong-lived RA/CA DHX keys and bespoke enterprise or government applications\nusing X9.42 DHX static keys with interactive protocols and therefore this\nissue was assigned Low severity.\n\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4, 3.1.2 and 3.0 are affected by this\nissue."
    },
    {
      "lang": "es",
      "value": "Resumen del problema: Cuando se llama a EVP_PKEY_derive_set_peer() con una clave de par DHX (X9.42), la clave de par no se verifica correctamente para la pertenencia al subgrupo.\n\nResumen del impacto: Un par malicioso que presenta una clave X9.42 que contiene los parámetros p y g de la víctima, una q forjada = r (un pequeño factor primo del cofactor (p?1)/q_local), y un valor público Y de orden r puede recuperar la clave privada de la víctima después de un pequeño número de intentos de intercambio de claves.\n\nCuando se llama a EVP_PKEY_derive_set_peer() con una clave de par DHX (X9.42), la verificación de pertenencia al subgrupo Y^q ? 1 (mod p) se realiza utilizando el propio parámetro q del par, no la q de la clave local. Los parámetros de dominio del par se comparan entonces con los parámetros de dominio de la clave privada, pero el valor de q no se compara.\n\nUn par malicioso que presenta una clave X9.42 que contiene la p, g de la víctima, una q forjada = r (un pequeño factor primo del cofactor), y un valor público Y de orden r pasa todas las verificaciones. El secreto compartido toma entonces solo r valores distintos, filtrando priv mod r. Repitiendo para cada factor primo pequeño del cofactor y combinando mediante CRT se recupera la clave privada completa (ataque Lim-Lee / de confinamiento de subgrupo pequeño).\n\nLa superficie de ataque realista es estrecha: principalmente despliegues de CMP con claves DHX de RA/CA de larga duración y aplicaciones empresariales o gubernamentales a medida que utilizan claves estáticas DHX X9.42 con protocolos interactivos y, por lo tanto, a este problema se le asignó una severidad Baja.\n\nLos módulos FIPS en 4.0, 3.6, 3.5, 3.4 y 3.0 se ven afectados por este problema."
    }
  ],
  "lastModified": "2026-07-23T08:10:00.137",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EDB88756-EDFE-4886-A267-3F19342A6042",
              "versionEndExcluding": "3.0.21",
              "versionStartIncluding": "3.0.0"
            },
            {
              "criteria": "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BF7E21E7-AEC0-4882-B1F1-2D056B506F22",
              "versionEndExcluding": "3.4.6",
              "versionStartIncluding": "3.4.0"
            },
            {
              "criteria": "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6B6B9930-C549-4D88-9784-AF32CCDDB87A",
              "versionEndExcluding": "3.5.7",
              "versionStartIncluding": "3.5.0"
            },
            {
              "criteria": "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D41B3C45-EC73-4DC8-989D-B2E2792E102F",
              "versionEndExcluding": "3.6.3",
              "versionStartIncluding": "3.6.0"
            },
            {
              "criteria": "cpe:2.3:a:openssl:openssl:4.0.0:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6E881B9A-1A0A-4BC0-8160-20C00561167D"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "openssl-security@openssl.org"
}