CVE-2014-0221 — Uncontrolled Resource Consumption in Openssl

CWE-400 — Uncontrolled Resource Consumption18 documents10 sources
Severity
4.3MEDIUMNVD
EPSS
82.1%
top 0.79%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
11
OpensslMariadbFedoraproject Fedora+8 more
Timeline
PublishedJun 5
Latest updateMay 14

Description

The dtls1_get_message_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h allows remote attackers to cause a denial of service (recursion and client crash) via a DTLS hello message in an invalid DTLS handshake.

CVSS vector

AV:N/AC:M/C:N/I:N/A:PExploitability: 8.6 | Impact: 2.9

Affected Packages10 packages

▶NVDopenssl/openssl0.9.8 — 0.9.8za+2
▶Debianopenssl/openssl< 1.0.1h-1+3
▶NVDmariadb/mariadb10.0.0 — 10.0.13
▶NVDopensuse/leap42.1

Also affects: Fedora 19, 20, Enterprise Linux 5, 6.0

Patches

Patch: www.oracle.com ↗Patch: bugzilla.redhat.com ↗Patch: www.oracle.com ↗

🔴Vulnerability Details

6
GHSA
GHSA-72w7-m73m-gc5c: The dtls1_get_message_fragment function in d1_both↗2022-05-14
▶
OSV
openssl regression↗2014-06-23
▶
OSV
openssl regression↗2014-06-12
▶
CVEList
CVE-2014-0221: The dtls1_get_message_fragment function in d1_both↗2014-06-05
▶
OSV
CVE-2014-0221: The dtls1_get_message_fragment function in d1_both↗2014-06-05
▶

📋Vendor Advisories

5
Ubuntu
OpenSSL vulnerabilities↗2014-06-05
▶
Cisco
Multiple Vulnerabilities in OpenSSL Affecting Cisco Products↗2014-06-05
▶
Red Hat
openssl: DoS when sending invalid DTLS handshake↗2014-06-05
▶
BSD
FreeBSD-SA-14:14.openssl: OpenSSL multiple vulnerabilities↗2014-06-05
▶
Debian
CVE-2014-0221: openssl - The dtls1_get_message_fragment function in d1_both.c in OpenSSL before 0.9.8za, ...↗2014
▶

💬Community

6
Bugzilla
CVE-2014-0221 CVE-2014-0198 CVE-2014-0224 CVE-2014-0195 CVE-2010-5298 CVE-2014-3470 mingw-openssl: various flaws [epel-7]↗2014-08-07
▶
Bugzilla
CVE-2014-3470 CVE-2014-0221 CVE-2014-0224 CVE-2014-0195 mingw32-openssl: various flaws [epel-5]↗2014-08-07
▶
Bugzilla
CVE-2014-0221 openssl: DoS when sending invalid DTLS handshake↗2014-06-02
▶
Bugzilla
CVE-2014-0221 CVE-2014-0198 CVE-2014-0224 CVE-2014-0195 CVE-2010-5298 CVE-2014-3470 openssl: various flaws [fedora-all]↗2014-05-09
▶
Bugzilla
CVE-2014-0221 CVE-2014-0198 CVE-2014-0224 CVE-2014-0195 CVE-2010-5298 CVE-2014-3470 mingw-openssl: various flaws [fedora-all]↗2014-05-09
▶
CVE-2014-0221 — Uncontrolled Resource Consumption | cvebase