Description
The ssl_set_client_disabled function in t1_lib.c in OpenSSL 1.0.1 before 1.0.1i allows remote SSL servers to cause a denial of service (NULL pointer dereference and client application crash) via a ServerHello message that includes an SRP ciphersuite without the required negotiation of that ciphersuite with the client.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | openssl | 1.0.1i-1 | — |
| Debian 13 | openssl | 1.0.1i-1 | — |
| Debian 12 | openssl | 1.0.1i-1 | — |
| Debian 7 | openssl | 1.0.1e-2+deb7u12 | DSA-2998-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 14.04 LTS | openssl | 1.0.1f-1ubuntu2.5 | USN-2308-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | libressl | 2.5.0-1.1 | openSUSE-SU-2024:10309-1 |
| openSUSE Tumbleweed | openssl-1_1 | 1.1.1l-1.2 | openSUSE-SU-2024:11127-1 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 2 repositories
-
uthrasri/G2.5_openssl_CVE-2014-5139 ★ 0 · Nov 9, 2023
-
uthrasri/CVE-2014-5139 ★ 0 · Nov 7, 2023
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 5
- USN-2308-1 openssl vulnerabilities Ubuntu Security Notices (USN) · Apr 22, 2026
- DSA-2998-1 openssl - security update Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:10309-1 libcrypto38-2.5.0-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:11127-1 libopenssl-1_1-devel-1.1.1l-1.2 on GA media SUSE / openSUSE Security Updates · May 7, 2025
- WID-SEC-2023-0498 OpenSSL: Mehrere Schwachstellen BSI CERT-Bund (WID) · Feb 27, 2023
References
- openSUSE-SU-2014:1052 vendor-advisory
- http://support.f5.com/kb/en-us/solutions/public/15000/500/sol15567.html
- 60221 third-party-advisory
- http://www-01.ibm.com/support/docview.wss?uid=swg21682293
- 61184 third-party-advisory
- SSRT101846 vendor-advisory
- 60022 third-party-advisory
- https://www.openssl.org/news/secadv_20140806.txt
- 61017 third-party-advisory
- SSRT101818 vendor-advisory
- http://www-01.ibm.com/support/docview.wss?uid=swg21683389
- HPSBMU03304 vendor-advisory
- HPSBMU03259 vendor-advisory
- http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-372998.htm
- GLSA-201412-39 vendor-advisory
- 69077 vdb-entry
- HPSBMU03260 vendor-advisory
- 60803 third-party-advisory
- https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commit%3Bh=80bd7b41b30af6ee96f519e629463583318de3b0
- 59700 third-party-advisory
- 1030693 vdb-entry
- 60917 third-party-advisory
- http://www.tenable.com/security/tns-2014-06
- 60493 third-party-advisory
- 59710 third-party-advisory
- 60921 third-party-advisory
- 60810 third-party-advisory
- HPSBMU03283 vendor-advisory
- http://www-01.ibm.com/support/docview.wss?uid=nas8N1020240
- 61100 third-party-advisory
- FreeBSD-SA-14:18 vendor-advisory
- 61775 third-party-advisory
- DSA-2998 vendor-advisory
- HPSBMU03263 vendor-advisory
- SSRT101921 vendor-advisory
- 61959 third-party-advisory
- 59756 third-party-advisory
- HPSBMU03267 vendor-advisory
- HPSBMU03261 vendor-advisory
- http://aix.software.ibm.com/aix/efixes/security/openssl_advisory10.asc
- 61392 third-party-advisory
- [syslog-ng-announce] 20140910 syslog-ng Premium Edition 5 LTS (5.0.6a) has been released mailing-list
- 61171 third-party-advisory
- https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commit%3Bh=83764a989dcc87fbea337da5f8f86806fe767b7e
- SSRT101922 vendor-advisory
- http://www-01.ibm.com/support/docview.wss?uid=swg21686997