MEDIUM
openssl: race condition in ssl_parse_serverhello_tlsext
Published Aug 13, 2014
6.8
MEDIUMCVSS 2.0
EPSS 13.42%
Description
Race condition in the ssl_parse_serverhello_tlsext function in t1_lib.c in OpenSSL 1.0.0 before 1.0.0n and 1.0.1 before 1.0.1i, when multithreading and session resumption are used, allows remote SSL servers to cause a denial of service (memory overwrite and client application crash) or possibly have unspecified other impact by sending Elliptic Curve (EC) Supported Point Formats Extension data.
Affected products
No data.
OR
- 1.0.0
- 1.0.0
- 1.0.0
- 1.0.0
- 1.0.0
- 1.0.0
- 1.0.0a
- 1.0.0b
- 1.0.0c
- 1.0.0d
- 1.0.0e
- 1.0.0f
- 1.0.0g
- 1.0.0h
- 1.0.0i
- 1.0.0j
- 1.0.0k
- 1.0.0l
- 1.0.0m
- 1.0.1
- 1.0.1
- 1.0.1
- 1.0.1
- 1.0.1a
- 1.0.1b
- 1.0.1c
- 1.0.1d
- 1.0.1e
- 1.0.1f
- 1.0.1g
- 1.0.1h
No data.
RHEV Manager version 3.5
spice-client-msi-0:3.5-2
Fixed · RHSA-2015:0197
Red Hat Enterprise Linux 6
openssl-0:1.0.1e-16.el6_5.15
Fixed · RHSA-2014:1052
Red Hat Enterprise Linux 7
openssl-1:1.0.1e-34.el7_0.4
Fixed · RHSA-2014:1052
Red Hat Storage 2.1
openssl-0:1.0.1e-16.el6_5.15
Fixed · RHSA-2014:1054
Red Hat Enterprise Linux 5
openssl
Not affected
Red Hat Enterprise Linux 5
openssl097a
Not affected
Red Hat Enterprise Linux 6
openssl098e
Not affected
Red Hat Enterprise Linux 7
openssl098e
Not affected
Red Hat JBoss Enterprise Application Platform 5
openssl
Not affected
Red Hat JBoss Enterprise Application Platform 6
openssl
Not affected
Red Hat JBoss Enterprise Web Server 1
openssl
Not affected
Red Hat JBoss Enterprise Web Server 2
openssl
Not affected
| Product | Package | State | Advisory |
|---|---|---|---|
| RHEV Manager version 3.5 | spice-client-msi-0:3.5-2 | Fixed | RHSA-2015:0197 |
| Red Hat Enterprise Linux 6 | openssl-0:1.0.1e-16.el6_5.15 | Fixed | RHSA-2014:1052 |
| Red Hat Enterprise Linux 7 | openssl-1:1.0.1e-34.el7_0.4 | Fixed | RHSA-2014:1052 |
| Red Hat Storage 2.1 | openssl-0:1.0.1e-16.el6_5.15 | Fixed | RHSA-2014:1054 |
| Red Hat Enterprise Linux 5 | openssl | Not affected | n/a |
| Red Hat Enterprise Linux 5 | openssl097a | Not affected | n/a |
| Red Hat Enterprise Linux 6 | openssl098e | Not affected | n/a |
| Red Hat Enterprise Linux 7 | openssl098e | Not affected | n/a |
| Red Hat JBoss Enterprise Application Platform 5 | openssl | Not affected | n/a |
| Red Hat JBoss Enterprise Application Platform 6 | openssl | Not affected | n/a |
| Red Hat JBoss Enterprise Web Server 1 | openssl | Not affected | n/a |
| Red Hat JBoss Enterprise Web Server 2 | openssl | Not affected | n/a |
No package ranges for this CVE.
Remediation
No remediation recorded yet.
Weaknesses (1)
References (55)
- ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2014-008.txt.asc vendor-advisoryx_refsource_NETBSD
- http://aix.software.ibm.com/aix/efixes/security/openssl_advisory10.asc x_refsource_CONFIRM
- http://linux.oracle.com/errata/ELSA-2014-1052.html x_refsource_CONFIRM
- http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136470.html vendor-advisoryx_refsource_FEDORA
- http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136473.html vendor-advisoryx_refsource_FEDORA
- http://lists.opensuse.org/opensuse-updates/2014-08/msg00036.html vendor-advisoryx_refsource_SUSE
- http://marc.info/?l=bugtraq&m=142350350616251&w=2 vendor-advisoryx_refsource_HP
- http://marc.info/?l=bugtraq&m=142495837901899&w=2 vendor-advisoryx_refsource_HP
- http://marc.info/?l=bugtraq&m=142624590206005&w=2 vendor-advisoryx_refsource_HP
- http://marc.info/?l=bugtraq&m=142660345230545&w=2 vendor-advisoryx_refsource_HP
- http://marc.info/?l=bugtraq&m=142791032306609&w=2 vendor-advisoryx_refsource_HP
- http://marc.info/?l=bugtraq&m=143290437727362&w=2 vendor-advisoryx_refsource_HP
- http://marc.info/?l=bugtraq&m=143290522027658&w=2 vendor-advisoryx_refsource_HP
- http://rhn.redhat.com/errata/RHSA-2015-0197.html vendor-advisoryx_refsource_REDHAT
- http://secunia.com/advisories/58962 third-party-advisoryx_refsource_SECUNIA
- http://secunia.com/advisories/59700 third-party-advisoryx_refsource_SECUNIA
- http://secunia.com/advisories/59710 third-party-advisoryx_refsource_SECUNIA
- http://secunia.com/advisories/59756 third-party-advisoryx_refsource_SECUNIA
- http://secunia.com/advisories/60022 third-party-advisoryx_refsource_SECUNIA
- http://secunia.com/advisories/60221 third-party-advisoryx_refsource_SECUNIA
- http://secunia.com/advisories/60493 third-party-advisoryx_refsource_SECUNIA
- http://secunia.com/advisories/60684 third-party-advisoryx_refsource_SECUNIA
- http://secunia.com/advisories/60803 third-party-advisoryx_refsource_SECUNIA
- http://secunia.com/advisories/60917 third-party-advisoryx_refsource_SECUNIA
- http://secunia.com/advisories/60921 third-party-advisoryx_refsource_SECUNIA
- http://secunia.com/advisories/60938 third-party-advisoryx_refsource_SECUNIA
- http://secunia.com/advisories/61017 third-party-advisoryx_refsource_SECUNIA
- http://secunia.com/advisories/61100 third-party-advisoryx_refsource_SECUNIA
- http://secunia.com/advisories/61139 third-party-advisoryx_refsource_SECUNIA
- http://secunia.com/advisories/61184 third-party-advisoryx_refsource_SECUNIA
- http://secunia.com/advisories/61775 third-party-advisoryx_refsource_SECUNIA
- http://secunia.com/advisories/61959 third-party-advisoryx_refsource_SECUNIA
- http://security.gentoo.org/glsa/glsa-201412-39.xml vendor-advisoryx_refsource_GENTOO
- http://www-01.ibm.com/support/docview.wss?uid=nas8N1020240 x_refsource_CONFIRM
- http://www-01.ibm.com/support/docview.wss?uid=swg21682293 x_refsource_CONFIRM
- http://www-01.ibm.com/support/docview.wss?uid=swg21683389 x_refsource_CONFIRM
- http://www-01.ibm.com/support/docview.wss?uid=swg21686997 x_refsource_CONFIRM
- http://www.debian.org/security/2014/dsa-2998 vendor-advisoryx_refsource_DEBIAN
- http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-372998.htm x_refsource_CONFIRM
- http://www.mandriva.com/security/advisories?name=MDVSA-2014:158 vendor-advisoryx_refsource_MANDRIVA
- http://www.securityfocus.com/bid/69084 vdb-entryx_refsource_BID
- http://www.securitytracker.com/id/1030693 vdb-entryx_refsource_SECTRACK
- https://access.redhat.com/security/cve/CVE-2014-3509 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1127498 x_refsource_CONFIRMIssue Tracking
- https://exchange.xforce.ibmcloud.com/vulnerabilities/95159 vdb-entryx_refsource_XF
- https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commit%3Bh=fb0bc2b273bcc2d5401dd883fe869af4fc74bb21 x_refsource_CONFIRM
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150888 x_refsource_CONFIRM
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05158380 x_refsource_CONFIRM
- https://lists.balabit.hu/pipermail/syslog-ng-announce/2014-September/000196.html mailing-listx_refsource_MLIST
- https://nvd.nist.gov/vuln/detail/CVE-2014-3509
- https://support.citrix.com/article/CTX216642 x_refsource_CONFIRM
- https://techzone.ergon.ch/CVE-2014-3511 x_refsource_CONFIRM
- https://www.cve.org/CVERecord?id=CVE-2014-3509
- https://www.freebsd.org/security/advisories/FreeBSD-SA-14:18.openssl.asc vendor-advisoryx_refsource_FREEBSD
- https://www.openssl.org/news/secadv_20140806.txt x_refsource_CONFIRMVendor Advisory
Change history (0)
No recorded changes yet.
Sources
CVE.org / MITRE
Status PUBLISHED
Assigner redhat
Published Aug 13, 2014
Updated Aug 6, 2024
Reserved May 14, 2014
Link CVE-2014-3509
CISA Vulnrichment
Updated n/a