OpenSSL - Regression Update (DSA-3197-2)
Summary
DSA-3197-2: openssl - regression update. Affects openssl versions < 1.0.1e-2+deb7u16. Fixed in 1.0.1e-2+deb7u16. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
OpenSSL is a Secure Sockets Layer (SSL) toolkit that provides support for secure communication over networks. It is widely used in various applications, including web servers, email servers, and VPNs. OpenSSL is an open-source project that offers encryption, decryption, and cryptographic functions. However, multiple vulnerabilities have been discovered in OpenSSL, which could potentially lead to denial of service or memory corruption.
Vulnerability Detail
The following vulnerabilities have been identified in OpenSSL:
- CVE-2015-0286: The ASN1_TYPE_cmp() function can be crashed, resulting in denial of service.
- CVE-2015-0287: A memory corruption issue in ASN.1 parsing.
- CVE-2015-0289: A NULL pointer dereference in the PKCS#7 parsing code, resulting in denial of service.
- CVE-2015-0292: Missing input sanitizing in base64 decoding may lead to memory corruption.
- CVE-2015-0209: A malformed EC private key may result in memory corruption.
- CVE-2015-0288: Missing input sanitizing in the X509_to_X509_REQ() function may lead to denial of service.
These vulnerabilities can be exploited by attackers to cause service disruptions, execute arbitrary code, or gain unauthorized access to sensitive information.
How To Fix
Minimum fixed version
1.0.1e-2+deb7u16
This is the first release that contains the fix.
sudo apt-get install --only-upgrade opensslTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no specific workarounds mentioned for these vulnerabilities. It is crucial to apply the recommended fix by upgrading the OpenSSL packages.
Conclusion
OpenSSL is a widely used SSL toolkit that has been found to have multiple vulnerabilities. It is crucial to upgrade the OpenSSL packages to the recommended version to mitigate the risks associated with these vulnerabilities. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for openssl →
FAQ
OpenSSL is a Secure Sockets Layer (SSL) toolkit that provides support for secure communication over networks. It is widely used in various applications, including web servers, email servers, and VPNs.
These vulnerabilities can be exploited by attackers to cause service disruptions, execute arbitrary code, or gain unauthorized access to sensitive information.
To fix these vulnerabilities, it is recommended to upgrade the OpenSSL packages to version 1.0.1e-2+deb7u15 or later. This update includes fixes for the identified vulnerabilities and removes export ciphers from the default cipher list.
There are no specific workarounds mentioned for these vulnerabilities. It is crucial to apply the recommended fix by upgrading the OpenSSL packages.
You can find more information about these vulnerabilities in the Debian Security Advisory DSA-3197-2.
Related vulnerabilities
Recent vulnerabilities recorded for openssl.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
