CVE-2014-3569 — Improper Input Validation in Openssl
CWE-20 — Improper Input ValidationCWE-310CWE-399CWE-476 — NULL Pointer Dereference20 documents11 sources
Severity
5.0MEDIUMNVD
OSV4.3
EPSS
7.6%
top 8.15%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedDec 24
Latest updateJan 11
Description
The ssl23_get_client_hello function in s23_srvr.c in OpenSSL 0.9.8zc, 1.0.0o, and 1.0.1j does not properly handle attempts to use unsupported protocols, which allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via an unexpected handshake, as demonstrated by an SSLv3 handshake to a no-ssl3 application with certain error handling. NOTE: this issue became relevant after the CVE-2014-3568 fix.
CVSS vector
AV:N/AC:L/C:N/I:N/A:PExploitability: 10.0 | Impact: 2.9
Affected Packages5 packages
🔴Vulnerability Details
2📋Vendor Advisories
13Debian▶
CVE-2014-3569: openssl - The ssl23_get_client_hello function in s23_srvr.c in OpenSSL 0.9.8zc, 1.0.0o, an...↗2014