Description
The ASN1_STRING_print_ex function in OpenSSL before 0.9.8k allows remote attackers to cause a denial of service (invalid memory access and application crash) via vectors that trigger printing of a (1) BMPString or (2) UniversalString with an invalid encoded length.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | openssl | 0.9.8g-16 | — |
| Debian 13 | openssl | 0.9.8g-16 | — |
| Debian 12 | openssl | 0.9.8g-16 | — |
| Debian 5.0 | openssl | 0.9.8g-15+lenny1 | DSA-1763-1 |
| Debian 4.0 | openssl | 0.9.8c-4etch5 | DSA-1763-1 |
| Debian 4.0 | openssl097 | 0.9.7k-3.1etch3 | DSA-1763-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | openssl +2 | 0.9.8e-12.el5 | RHSA-2009:1335 |
| RHEL 4 | openssl +2 | 0.9.7a-43.17.el4_8.5 | RHSA-2010:0163 |
| RHEL 3 | openssl +2 | 0.9.7a-33.26 | RHSA-2010:0163 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | openssl-1_1 | 1.1.1l-1.2 | openSUSE-SU-2024:11127-1 |
Advisories 4
- RHSA-2009:1335 Red Hat Security Advisory: openssl security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2010:0163 Red Hat Security Advisory: openssl security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- DSA-1763-1 openssl openssl097 - denial of service Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:11127-1 libopenssl-1_1-devel-1.1.1l-1.2 on GA media SUSE / openSUSE Security Updates · May 7, 2025
References
- SSRT090059 vendor-advisory
- ADV-2009-0850 vdb-entry
- 1021905 vdb-entry
- 34896 third-party-advisory
- MDVSA-2009:087 vendor-advisory
- ADV-2009-1175 vdb-entry
- 42724 third-party-advisory
- 20090403 rPSA-2009-0057-1 m2crypto openssl openssl-scripts mailing-list
- SUSE-SU-2011:0847 vendor-advisory
- http://wiki.rpath.com/Advisories:rPSA-2009-0057
- DSA-1763 vendor-advisory
- 38794 third-party-advisory
- [security-announce] 20100303 VMSA-2010-0004 ESX Service Console and vMA third party updates mailing-list
- http://sourceforge.net/project/shownotes.php?release_id=671059&group_id=116847
- 34960 third-party-advisory
- openSUSE-SU-2011:0845 vendor-advisory
- http://wiki.rpath.com/wiki/Advisories:rPSA-2009-0057
- 34666 third-party-advisory
- USN-750-1 vendor-advisory
- FreeBSD-SA-09:08 vendor-advisory
- ADV-2009-1020 vdb-entry
- 35729 third-party-advisory
- RHSA-2009:1335 vendor-advisory
- 52864 vdb-entry
- 34561 third-party-advisory
- 35380 third-party-advisory
- HPSBOV02540 vendor-advisory
- 42467 third-party-advisory
- APPLE-SA-2009-09-10-2 vendor-advisory
- 35065 third-party-advisory
- [syslog-ng-announce] 20110110 syslog-ng Premium Edition 3.0.6a has been released mailing-list
- oval:org.mitre.oval:def:10198 vdb-entry signature
- 36533 third-party-advisory
- http://www.php.net/archive/2009.php#id2009-04-08-1
- 34411 third-party-advisory
- 20101207 VMSA-2010-0019 VMware ESX third party updates for Service Console mailing-list
- 34509 third-party-advisory
- openssl-asn1-stringprintex-dos(49431) vdb-entry
- 35181 third-party-advisory
- 258048 vendor-advisory
- 38834 third-party-advisory
- SUSE-SR:2009:010 vendor-advisory
- oval:org.mitre.oval:def:6996 vdb-entry signature
- [syslog-ng-announce] 20110110 syslog-ng Premium Edition 3.2.1a has been released mailing-list
- ADV-2010-3126 vdb-entry
- http://voodoo-circle.sourceforge.net/sa/sa-20090326-01.html
- http://support.apple.com/kb/HT3865
- ADV-2009-1220 vdb-entry
- http://www.openssl.org/news/secadv_20090325.txt
- ADV-2009-1548 vdb-entry
- 36701 third-party-advisory
- http://support.avaya.com/elmodocs2/security/ASA-2009-172.htm
- http://www.vmware.com/security/advisories/VMSA-2010-0019.html
- HPSBMA02447 vendor-advisory
- https://kb.bluecoat.com/index?page=content&id=SA50
- 34460 third-party-advisory
- 34256 vdb-entry
- 42733 third-party-advisory
- ADV-2010-0528 vdb-entry