OpenSSL - Multiple Vulnerabilities
Summary
DSA-3287-1: openssl - security update. Affects openssl versions < 1.0.1e-2+deb7u17. Fixed in 1.0.1e-2+deb7u17. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
OpenSSL is a Secure Sockets Layer toolkit that provides support for secure communication over networks. It is widely used in various applications, including web servers, email servers, and VPNs. OpenSSL is vulnerable to multiple security issues that could potentially lead to denial of service attacks or remote code execution.
Vulnerability Detail
The vulnerabilities in OpenSSL include:
-
CVE-2014-8176: An invalid memory free could be triggered when buffering DTLS data, potentially allowing remote attackers to crash the system or execute arbitrary code.
-
CVE-2015-1788: An infinite loop could be triggered due to incorrect handling of malformed ECParameters structures, leading to a denial of service.
-
CVE-2015-1789: The X509_cmp_time function could read a few bytes out of bounds, potentially causing a crash via crafted certificates and CRLs.
-
CVE-2015-1790: The PKCS#7 parsing code did not properly handle missing content, leading to a NULL pointer dereference and a denial of service via crafted ASN.1-encoded PKCS#7 blobs.
-
CVE-2015-1791: A race condition could occur due to incorrect handling of NewSessionTicket in a multi-threaded client, leading to a double free and a denial of service.
-
CVE-2015-1792: The CMS code could enter an infinite loop when verifying a signedData message if presented with an unknown hash function OID, resulting in a denial of service.
Additionally, OpenSSL now rejects handshakes using DH parameters shorter than 768 bits as a countermeasure against the Logjam attack (CVE-2015-4000).
How To Fix
Minimum fixed version
1.0.1e-2+deb7u17
This is the first release that contains the fix.
sudo apt-get install --only-upgrade opensslTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no specific workarounds mentioned for these vulnerabilities.
Conclusion
OpenSSL is vulnerable to multiple security issues that could potentially lead to denial of service attacks or remote code execution. It is crucial to upgrade your OpenSSL packages to the latest versions to mitigate these vulnerabilities. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for openssl →
FAQ
OpenSSL is a Secure Sockets Layer toolkit that provides support for secure communication over networks.
The vulnerabilities in OpenSSL include memory corruption, infinite loop, out-of-bounds read, NULL pointer dereference, race condition, and infinite loop issues.
These vulnerabilities could potentially lead to denial of service attacks or remote code execution.
To fix these vulnerabilities, it is recommended to upgrade your OpenSSL packages to the latest versions.
There are no specific workarounds mentioned for these vulnerabilities.
Related vulnerabilities
Recent vulnerabilities recorded for openssl.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
