{"id":"CVE-2022-29242","summary":"Buffer Overflow on creating key transport blob in GOST Engine","details":"GOST engine is a reference implementation of the Russian GOST crypto algorithms for OpenSSL. TLS clients using GOST engine when ciphersuite `TLS_GOSTR341112_256_WITH_KUZNYECHIK_CTR_OMAC` is agreed and the server uses 512 bit GOST secret keys are vulnerable to buffer overflow. GOST engine version 3.0.1 contains a patch for this issue. Disabling ciphersuite `TLS_GOSTR341112_256_WITH_KUZNYECHIK_CTR_OMAC` is a possible workaround.","aliases":["GHSA-2rmw-8wpg-vgw5"],"modified":"2026-08-18T17:26:17.478607Z","published":"2022-05-24T14:55:13Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-120"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/29xxx/CVE-2022-29242.json"},"references":[{"type":"WEB","url":"https://github.com/gost-engine/engine/releases/tag/v3.0.1"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/29xxx/CVE-2022-29242.json"},{"type":"ADVISORY","url":"https://github.com/gost-engine/engine/security/advisories/GHSA-2rmw-8wpg-vgw5"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-29242"},{"type":"FIX","url":"https://github.com/gost-engine/engine/commit/7df766124f87768b43b9e8947c5a01e17545772c"},{"type":"FIX","url":"https://github.com/gost-engine/engine/commit/b2b4d629f100eaee9f5942a106b1ccefe85b8808"},{"type":"FIX","url":"https://github.com/gost-engine/engine/commit/c6655a0b620a3e31f085cc906f8073fe81b2fad3"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/gost-engine/engine","events":[{"introduced":"0"},{"fixed":"b2b4d629f100eaee9f5942a106b1ccefe85b8808"},{"fixed":"7df766124f87768b43b9e8947c5a01e17545772c"},{"fixed":"c6655a0b620a3e31f085cc906f8073fe81b2fad3"}],"database_specific":{"cpe":"cpe:2.3:a:gost_engine_project:gost_engine:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"fixed":"3.0.1"}],"source":["CPE_RANGE","REFERENCES"]}}],"versions":["v3.0.0"],"database_specific":{"vanir_signatures_modified":"2026-08-18T17:26:17Z","vanir_signatures":[{"deprecated":false,"digest":{"line_hashes":["181079042129152464932669655050909846368","158295315304811067947470668990101074335","239758865765949342379508158066880226757","7856286627472673225455720181777985340"],"threshold":0.9},"id":"CVE-2022-29242-518bdba1","signature_type":"Line","signature_version":"v1","source":"https://github.com/gost-engine/engine/commit/c6655a0b620a3e31f085cc906f8073fe81b2fad3","target":{"file":"e_gost_err.c"}},{"source":"https://github.com/gost-engine/engine/commit/c6655a0b620a3e31f085cc906f8073fe81b2fad3","target":{"file":"gost_ec_keyx.c"},"deprecated":false,"digest":{"line_hashes":["65030514501109260630237999873123317328","118759800526282905302103490401707480352","25217270377180783317180417274478535203","82835145014064360693273568063469535198","190573629692466551360361712816298746329","270785022693191878437097098274107173792","59505043026629093783673545315870750222","66807662697499471765169844625495725539","259928869894521617717612055134712520778"],"threshold":0.9},"id":"CVE-2022-29242-7c5971bf","signature_type":"Line","signature_version":"v1"},{"source":"https://github.com/gost-engine/engine/commit/c6655a0b620a3e31f085cc906f8073fe81b2fad3","target":{"file":"e_gost_err.h"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["225974880740951108040578185193683290431","83795847996781818239151978839630099984","92443563628866274598904886782383012572","271866978301397155848059525930755811876"]},"id":"CVE-2022-29242-8a1db8d3","signature_type":"Line","signature_version":"v1"},{"target":{"file":"gost_ec_keyx.c","function":"pkey_gost2018_encrypt"},"deprecated":false,"digest":{"function_hash":"88359506090462606094284207342429409843","length":2773},"id":"CVE-2022-29242-fc24cf99","signature_type":"Function","signature_version":"v1","source":"https://github.com/gost-engine/engine/commit/c6655a0b620a3e31f085cc906f8073fe81b2fad3"}],"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-29242.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}