Skip to content
OpenAdvisories
Unscored CVE-2011-3210 EUVD-2011-3174GHSA-q2wp-8mh7-q533

The ephemeral ECDH ciphersuite functionality in OpenSSL 0.9.8 through 0.9.8r and 1.0.x before 1.0.0e does not ensure thread safety during p…

Published Sep 22, 2011 · Updated Aug 6, 2024 · Assigned by redhat

Package: openssl Ecosystem: Debian

Description

The ephemeral ECDH ciphersuite functionality in OpenSSL 0.9.8 through 0.9.8r and 1.0.x before 1.0.0e does not ensure thread safety during processing of handshake messages from clients, which allows remote attackers to cause a denial of service (daemon crash) via out-of-order messages that violate the TLS protocol.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 openssl 1.0.0e-1 —
Debian 13 openssl 1.0.0e-1 —
Debian 12 openssl 1.0.0e-1 —

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 12 SP1 libqt4 +1 4.8.6-7.1 SUSE-SU-403 Forbidden-1, SUSE-SU-403
SLES 12 SP1 libqt4-devel-doc 4.8.6-7.3 SUSE-SU-403 Forbidden-1, SUSE-SU-403
SLES 12 libqt4 +1 4.8.6-7.1 SUSE-SU-403 Forbidden-1, SUSE-SU-403
SLES 12 libqt4-devel-doc 4.8.6-7.3 SUSE-SU-403 Forbidden-1, SUSE-SU-403
Show 2 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 12 SP1 libqt4 +1 4.8.6-7.1 SUSE-SU-403 Forbidden-1, SUSE-SU-403
SLES for SAP 12 SP1 libqt4-devel-doc 4.8.6-7.3 SUSE-SU-403 Forbidden-1, SUSE-SU-403
SLES for SAP 12 libqt4 +1 4.8.6-7.1 SUSE-SU-403 Forbidden-1, SUSE-SU-403
SLES for SAP 12 libqt4-devel-doc 4.8.6-7.3 SUSE-SU-403 Forbidden-1, SUSE-SU-403

Advisories 2

References