CVE-2008-0891 — Double Free in Openssl

CWE-1898 documents7 sources
Severity
4.3MEDIUMNVD
EPSS
11.3%
top 6.45%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
OpensslDebian Openssl
Timeline
PublishedMay 29
Latest updateMay 1

Description

Double free vulnerability in OpenSSL 0.9.8f and 0.9.8g, when the TLS server name extensions are enabled, allows remote attackers to cause a denial of service (crash) via a malformed Client Hello packet. NOTE: some of these details are obtained from third party information.

CVSS vector

AV:N/AC:M/C:N/I:N/A:PExploitability: 8.6 | Impact: 2.9

Affected Packages3 packages

▶debiandebian/openssl< openssl 0.9.8g-10.1 (bookworm)
▶Debianopenssl/openssl< 0.9.8g-10.1+3
▶NVDopenssl/openssl0.9.8f, 0.9.8g+1

Patches

Patch: www.securityfocus.com ↗Patch: www.securityfocus.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-8v7x-8cw9-9c5c: Double free vulnerability in OpenSSL 0↗2022-05-01
▶
OSV
CVE-2008-0891: Double free vulnerability in OpenSSL 0↗2008-05-29
▶

📋Vendor Advisories

3
Ubuntu
OpenSSL vulnerabilities↗2008-06-26
▶
Red Hat
openssl: Server Name extension crash↗2008-05-28
▶
Debian
CVE-2008-0891: openssl - Double free vulnerability in OpenSSL 0.9.8f and 0.9.8g, when the TLS server name...↗2008
▶

💬Community

1
Bugzilla
CVE-2008-0891 openssl: Server Name extension crash↗2008-05-27
▶