Description
OpenSSL before 0.9.8k on WIN64 and certain other platforms does not properly handle a malformed ASN.1 structure, which allows remote attackers to cause a denial of service (invalid memory access and application crash) by placing this structure in the public key of a certificate, as demonstrated by an RSA public key.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | openssl-1_1 | 1.1.1l-1.2 | openSUSE-SU-2024:11127-1 |
Advisories 1
- openSUSE-SU-2024:11127-1 libopenssl-1_1-devel-1.1.1l-1.2 on GA media SUSE / openSUSE Security Updates · May 7, 2025
References
- SSRT090059 vendor-advisory
- ADV-2009-0850 vdb-entry
- ADV-2009-1175 vdb-entry
- 42724 third-party-advisory
- SUSE-SU-2011:0847 vendor-advisory
- 52866 vdb-entry
- http://sourceforge.net/project/shownotes.php?release_id=671059&group_id=116847
- openSUSE-SU-2011:0845 vendor-advisory
- 34666 third-party-advisory
- ADV-2009-1020 vdb-entry
- 35729 third-party-advisory
- 35380 third-party-advisory
- HPSBOV02540 vendor-advisory
- openssl-asn1-structure-dos(49433) vdb-entry
- APPLE-SA-2009-09-10-2 vendor-advisory
- 35065 third-party-advisory
- http://www.php.net/archive/2009.php#id2009-04-08-1
- 34411 third-party-advisory
- 1021906 vdb-entry
- SUSE-SR:2009:010 vendor-advisory
- http://voodoo-circle.sourceforge.net/sa/sa-20090326-01.html
- http://support.apple.com/kb/HT3865
- http://www.openssl.org/news/secadv_20090325.txt
- ADV-2009-1548 vdb-entry
- 36701 third-party-advisory
- https://kb.bluecoat.com/index?page=content&id=SA50
- 34460 third-party-advisory
- 34256 vdb-entry
- 42733 third-party-advisory