4.3

CVE-2013-4353

The ssl3_take_mac function in ssl/s3_both.c in OpenSSL 1.0.1 before 1.0.1f allows remote TLS servers to cause a denial of service (NULL pointer dereference and application crash) via a crafted Next Protocol Negotiation record in a TLS handshake.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
OpenSSL ≫ OpenSSL Version1.0.1
OpenSSL ≫ OpenSSL Version1.0.1 Updatebeta1
OpenSSL ≫ OpenSSL Version1.0.1 Updatebeta2
OpenSSL ≫ OpenSSL Version1.0.1 Updatebeta3
OpenSSL ≫ OpenSSL Version1.0.1a
OpenSSL ≫ OpenSSL Version1.0.1b
OpenSSL ≫ OpenSSL Version1.0.1c
OpenSSL ≫ OpenSSL Version1.0.1d
OpenSSL ≫ OpenSSL Version1.0.1e
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 11.85% 0.956
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 4.3 8.6 2.9
AV:N/AC:M/Au:N/C:N/I:N/A:P
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

http://rhn.redhat.com/errata/RHSA-2014-0041.html
http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136470.html
http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136473.html
http://rhn.redhat.com/errata/RHSA-2014-0015.html
http://www-01.ibm.com/support/docview.wss?uid=isg400001841
http://www-01.ibm.com/support/docview.wss?uid=isg400001843
http://www.ubuntu.com/usn/USN-2079-1
http://www.openssl.org/news/vulnerabilities.html
Vendor Advisory
http://git.openssl.org/gitweb/?p=openssl.git%3Ba=blob_plain%3Bf=CHANGES%3Bhb=refs/heads/OpenSSL_1_0_1-stable
http://git.openssl.org/gitweb/?p=openssl.git%3Ba=commit%3Bh=197e0ea817ad64820789d86711d55ff50d71f631
http://lists.opensuse.org/opensuse-updates/2014-01/msg00065.html
http://lists.opensuse.org/opensuse-updates/2014-01/msg00067.html
http://lists.opensuse.org/opensuse-updates/2014-01/msg00070.html
http://www.debian.org/security/2014/dsa-2837
http://www.splunk.com/view/SP-CAAAMB3
https://bugzilla.redhat.com/show_bug.cgi?id=1049058