Description
OpenSSL before 0.9.8s and 1.x before 1.0.0f, when RFC 3779 support is enabled, allows remote attackers to cause a denial of service (assertion failure) via an X.509 certificate containing certificate-extension data associated with (1) IP address blocks or (2) Autonomous System (AS) identifiers.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | openssl | 1.0.0f-1 | — |
| Debian 13 | openssl | 1.0.0f-1 | — |
| Debian 12 | openssl | 1.0.0f-1 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | openssl +3 | 1.0.0-20.el6_2.1 | RHSA-2012:0059 |
| RHEL 6 | rhev-hypervisor6 +1 | 6.2-20120209.0.el6_2 | RHSA-2012:0109 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 SP1 | libqt4 +1 | 4.8.6-7.1 | SUSE-SU-403 Forbidden-1, SUSE-SU-403 |
| SLES 12 SP1 | libqt4-devel-doc | 4.8.6-7.3 | SUSE-SU-403 Forbidden-1, SUSE-SU-403 |
| SLES 12 | libqt4 +1 | 4.8.6-7.1 | SUSE-SU-403 Forbidden-1, SUSE-SU-403 |
| SLES 12 | libqt4-devel-doc | 4.8.6-7.3 | SUSE-SU-403 Forbidden-1, SUSE-SU-403 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 12 SP1 | libqt4 +1 | 4.8.6-7.1 | SUSE-SU-403 Forbidden-1, SUSE-SU-403 |
| SLES for SAP 12 SP1 | libqt4-devel-doc | 4.8.6-7.3 | SUSE-SU-403 Forbidden-1, SUSE-SU-403 |
| SLES for SAP 12 | libqt4 +1 | 4.8.6-7.1 | SUSE-SU-403 Forbidden-1, SUSE-SU-403 |
| SLES for SAP 12 | libqt4-devel-doc | 4.8.6-7.3 | SUSE-SU-403 Forbidden-1, SUSE-SU-403 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | openssl-1_1 | 1.1.1l-1.2 | openSUSE-SU-2024:11127-1 |
Advisories 5
- RHSA-2012:0109 Red Hat Security Advisory: rhev-hypervisor6 security and bug fix update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- RHSA-2012:0059 Red Hat Security Advisory: openssl security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- SUSE-SU-403 Forbidden-1 Security update for OpenSSL SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-403 Security update for OpenSSL SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:11127-1 libopenssl-1_1-devel-1.1.1l-1.2 on GA media SUSE / openSUSE Security Updates · May 7, 2025
References
- HPSBMU02786 vendor-advisory
- http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004564
- openSUSE-SU-2012:0083 vendor-advisory
- FEDORA-2012-18035 vendor-advisory
- http://www.openssl.org/news/secadv_20120104.txt
- SUSE-SU-2012:0084 vendor-advisory
- http://support.apple.com/kb/HT5784
- APPLE-SA-2013-06-04-1 vendor-advisory
- VU#737740 third-party-advisory
- HPSBUX02734 vendor-advisory
- HPSBOV02793 vendor-advisory
- 57353 third-party-advisory