Description
OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k does not enforce certain constraints on certificate data, which allows remote attackers to defeat a fingerprint-based certificate-blacklist protection mechanism by including crafted data within a certificate's unsigned portion, related to crypto/asn1/a_verify.c, crypto/dsa/dsa_asn1.c, crypto/ecdsa/ecs_vrf.c, and crypto/x509/x_all.c.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | openssl | 1.0.1k-1 | — |
| Debian 13 | openssl | 1.0.1k-1 | — |
| Debian 12 | openssl | 1.0.1k-1 | — |
| Debian 7 | openssl | 1.0.1e-2+deb7u14 | DSA-3125-1 |
| Debian 6.0 | openssl | 0.9.8o-4squeeze19 | DLA-132-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 14.04 LTS | openssl | 1.0.1f-1ubuntu2.8 | USN-2459-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7 | openssl +4 | 1:1.0.1e-34.el7_0.7 | RHSA-2015:0066 |
| RHEL 6 | openssl +3 | 1.0.1e-30.el6_6.5 | RHSA-2015:0066 |
| RHEL 5 | openssl +2 | 0.9.8e-33.el5_11 | RHSA-2015:0800 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 SP1 | libqt4 +1 | 4.8.6-7.1 | SUSE-SU-403 Forbidden-1, SUSE-SU-403 |
| SLES 12 SP1 | libqt4-devel-doc | 4.8.6-7.3 | SUSE-SU-403 Forbidden-1, SUSE-SU-403 |
| SLES 12 | compat-openssl098 | 0.9.8j-70.2 | SUSE-SU-2015:0305-1 |
| SLES 12 | libqt4 +1 | 4.8.6-7.1 | SUSE-SU-403 Forbidden-1, SUSE-SU-403 |
| SLES 12 | libqt4-devel-doc | 4.8.6-7.3 | SUSE-SU-403 Forbidden-1, SUSE-SU-403 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 12 SP1 | libqt4 +1 | 4.8.6-7.1 | SUSE-SU-403 Forbidden-1, SUSE-SU-403 |
| SLES for SAP 12 SP1 | libqt4-devel-doc | 4.8.6-7.3 | SUSE-SU-403 Forbidden-1, SUSE-SU-403 |
| SLES for SAP 12 | libqt4 +1 | 4.8.6-7.1 | SUSE-SU-403 Forbidden-1, SUSE-SU-403 |
| SLES for SAP 12 | libqt4-devel-doc | 4.8.6-7.3 | SUSE-SU-403 Forbidden-1, SUSE-SU-403 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | libressl | 2.5.0-1.1 | openSUSE-SU-2024:10309-1 |
| openSUSE Tumbleweed | openssl-1_1 | 1.1.1l-1.2 | openSUSE-SU-2024:11127-1 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 7 | openssl +4 | 1:1.0.1e-34.el7_0.7 | ELSA-2015-0066 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
GitHub 2 repositories
-
uthrasri/CVE-2014-8275_openssl_g2.5 ★ 0 · Nov 7, 2023
-
uthrasri/Openssl_G2.5_CVE-2014-8275 ★ 0 · Nov 7, 2023
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 12
- RHSA-2015:0800 Red Hat Security Advisory: openssl security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2015:0066 Red Hat Security Advisory: openssl security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- USN-2459-1 openssl vulnerabilities Ubuntu Security Notices (USN) · Apr 22, 2026
- DSA-3125-1 openssl - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-132-1 openssl - security update Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:10309-1 libcrypto38-2.5.0-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-403 Forbidden-1 Security update for OpenSSL SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-403 Security update for OpenSSL SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2015:0305-1 Security update for compat-openssl098 SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2026-0180 Dell Data Protection Advisor: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 20, 2026
- openSUSE-SU-2024:11127-1 libopenssl-1_1-devel-1.1.1l-1.2 on GA media SUSE / openSUSE Security Updates · May 7, 2025
- ELSA-2015-0066 Moderate: openssl security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Jan 20, 2015
References
- HPSBOV03318 vendor-advisory
- http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html
- openSUSE-SU-2015:0130 vendor-advisory
- 20150310 Multiple Vulnerabilities in OpenSSL (January 2015) Affecting Cisco Products vendor-advisory
- HPSBGN03299 vendor-advisory
- HPSBMU03409 vendor-advisory
- https://support.apple.com/HT204659
- http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html
- http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html
- HPSBMU03380 vendor-advisory
- FEDORA-2015-0601 vendor-advisory
- 1033378 vdb-entry
- HPSBHF03289 vendor-advisory
- openSUSE-SU-2016:0640 vendor-advisory
- https://www.openssl.org/news/secadv_20150108.txt
- MDVSA-2015:019 vendor-advisory
- http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html
- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10679
- http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
- openSUSE-SU-2015:1277 vendor-advisory
- https://github.com/openssl/openssl/commit/cb62ab4b17818fe66d2fed0a7fe71969131c811b
- RHSA-2015:0066 vendor-advisory
- HPSBUX03244 vendor-advisory
- APPLE-SA-2015-04-08-2 vendor-advisory
- https://kc.mcafee.com/corporate/index?page=content&id=SB10108
- SUSE-SU-2015:0578 vendor-advisory
- https://kc.mcafee.com/corporate/index?page=content&id=SB10102
- SUSE-SU-2015:0946 vendor-advisory
- HPSBMU03397 vendor-advisory
- http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html
- 71935 vdb-entry
- RHSA-2015:0800 vendor-advisory
- HPSBMU03396 vendor-advisory
- HPSBUX03162 vendor-advisory
- MDVSA-2015:062 vendor-advisory
- https://support.citrix.com/article/CTX216642
- HPSBMU03413 vendor-advisory
- https://bto.bluecoat.com/security-advisory/sa88
- DSA-3125 vendor-advisory
- https://github.com/openssl/openssl/commit/684400ce192dac51df3d3e92b61830a6ef90be3e