Description
The implementation of Cryptographic Message Syntax (CMS) and PKCS #7 in OpenSSL before 0.9.8u and 1.x before 1.0.0h does not properly restrict certain oracle behavior, which makes it easier for context-dependent attackers to decrypt data via a Million Message Attack (MMA) adaptive chosen ciphertext attack.
Remediation
References
Related Vulnerabilities
WordPress Plugin Payment Form for PayPal Pro SQL Injection (1.1.64)
IBM RTC Improper Restriction of XML External Entity Reference Vulnerability (CVE-2016-0219)
WordPress 3.7.x Multiple Vulnerabilities (3.7 - 3.7.30)
Payara Files or Directories Accessible to External Parties Vulnerability (CVE-2022-45129)