cbcvebase.
CVE-2015-3194
published 2015-12-06

CVE-2015-3194: crypto/rsa/rsa_ameth.c in OpenSSL 1.0.1 before 1.0.1q and 1.0.2 before 1.0.2e allows remote attackers to cause a denial of service (NULL pointer dereference…

PriorityP346high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
44.02%
98.6th percentile
crypto/rsa/rsa_ameth.c in OpenSSL 1.0.1 before 1.0.1q and 1.0.2 before 1.0.2e allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via an RSA PSS ASN.1 signature that lacks a mask generation function parameter.

Affected

42 ranges· showing 25
VendorProductVersion rangeFixed in
applemacos_mojave
applexcode
canonicalubuntu_linux
canonicalubuntu_linux
canonicalubuntu_linux
canonicalubuntu_linux
ciscoproducts
debiandebian_linux
debiandebian_linux
debianopenssl< openssl 1.0.2e-1 (bookworm)openssl 1.0.2e-1 (bookworm)
nodejsnode.js>= 0.10.0 < 0.10.410.10.41
nodejsnode.js>= 0.12.0 < 0.12.90.12.9
nodejsnode.js>= 4.0.0 < 4.2.34.2.3
nodejsnode.js>= 5.0.0 < 5.1.15.1.1
opensslopenssl
opensslopenssl
opensslopenssl
opensslopenssl
opensslopenssl
opensslopenssl
opensslopenssl
opensslopenssl
opensslopenssl
opensslopenssl
opensslopenssl

Detection & IOCsextracted from sources · hover to see the quote

  • Crash triggered by an RSA PSS ASN.1 signature that lacks a mask generation function parameter — monitor for NULL pointer dereference crashes in OpenSSL certificate verification code paths (crypto/rsa/rsa_ameth.c)
  • Attack vector is a specially crafted certificate presented during TLS/SSL handshake; monitor for unexpected application crashes in TLS clients or servers performing certificate signature verification
  • Vulnerable code is in crypto/rsa/rsa_ameth.c; patch or audit this file in OpenSSL 1.0.1 before 1.0.1q and 1.0.2 before 1.0.2e
  • ·Only OpenSSL 1.0.1 before 1.0.1q and 1.0.2 before 1.0.2e are affected; versions outside this range are not vulnerable
  • ·The vulnerability only affects TLS/SSL servers if client authentication is enabled; servers without client auth are not exposed via the server code path
  • ·FreeBSD impact is limited by version: the CVE-2015-3194 NULL pointer dereference affects FreeBSD 10.x only
  • ·Tenable Appliance 4.0.0 is not affected; only 3.x releases are impacted
  • ·No workaround is available for this vulnerability; patching is the only mitigation

CVSS provenance

nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P
osv7.5HIGH
vendor_debian7.5HIGH
vendor_redhat7.5HIGH
vendor_ubuntu5.0MEDIUM
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.