Description
The ssl_get_algorithm2 function in ssl/s3_lib.c in OpenSSL before 1.0.2 obtains a certain version number from an incorrect data structure, which allows remote attackers to cause a denial of service (daemon crash) via crafted traffic from a TLS 1.2 client.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | openssl | 1.0.1e-5 | — |
| Debian 13 | openssl | 1.0.1e-5 | — |
| Debian 12 | openssl | 1.0.1e-5 | — |
| Debian 7 | openssl | 1.0.1e-2+deb7u1 | DSA-2833-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | openssl +3 | 1.0.1e-16.el6_5.4 | RHSA-2014:0015 |
| RHEL 6 | rhev-hypervisor6 | 6.5-20140112.0.el6ev | RHSA-2014:0041 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | openssl-1_1 | 1.1.1l-1.2 | openSUSE-SU-2024:11127-1 |
Advisories 5
- RHSA-2014:0041 Red Hat Security Advisory: rhev-hypervisor6 security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2014:0015 Red Hat Security Advisory: openssl security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- DSA-2833-1 openssl - several Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:11127-1 libopenssl-1_1-devel-1.1.1l-1.2 on GA media SUSE / openSUSE Security Updates · May 7, 2025
- WID-SEC-2023-0505 OpenSSL: Schwachstelle ermöglicht Denial of Service BSI CERT-Bund (WID) · Feb 27, 2023
References
- http://www.vmware.com/security/advisories/VMSA-2014-0012.html
- openSUSE-SU-2014:0012 vendor-advisory
- http://www-01.ibm.com/support/docview.wss?uid=isg400001843
- openSUSE-SU-2014:0018 vendor-advisory
- GLSA-201412-39 vendor-advisory
- DSA-2833 vendor-advisory
- 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities mailing-list
- FEDORA-2014-9308 vendor-advisory
- http://www-01.ibm.com/support/docview.wss?uid=isg400001841
- 64530 vdb-entry
- http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html
- openSUSE-SU-2014:0015 vendor-advisory
- openSUSE-SU-2014:0048 vendor-advisory
- USN-2079-1 vendor-advisory
- FEDORA-2013-23768 vendor-advisory
- http://rt.openssl.org/Ticket/Display.html?id=3200&user=guest&pass=guest
- FEDORA-2013-23788 vendor-advisory
- http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html
- RHSA-2014:0015 vendor-advisory
- 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities mailing-list
- https://issues.apache.org/jira/browse/TS-2355
- 1029548 vdb-entry
- FEDORA-2014-9301 vendor-advisory
- FEDORA-2013-23794 vendor-advisory
- http://git.openssl.org/gitweb/?p=openssl.git%3Ba=commit%3Bh=ca989269a2876bae79393bd54c3e72d49975fc75
- https://bugzilla.redhat.com/show_bug.cgi?id=1045363
- RHSA-2014:0041 vendor-advisory