Changes between Version 1 and Version 2 of VulnerabilitiesFixedInOpenSSL1.0.1i


Ignore:
Timestamp:
08/07/14 17:55:07 (10 years ago)
Author:
Samuli Seppänen
Comment:

--

Legend:

Unmodified
Added
Removed
Modified

  • VulnerabilitiesFixedInOpenSSL1.0.1i

    v1 v2  
    66
    77||'''Vulnerability name'''||'''ID'''||'''Affects OpenVPN?'''||
    8 ||Information leak in pretty printing functions||CVE-2014-3508||Possibly[1]||
    9 ||Crash with SRP ciphersuite in Server Hello message||CVE-2014-5139||No. OpenVPN does not use SRP||
    10 ||Race condition in ssl_parse_serverhello_tlsext||CVE-2014-3509||No||
    11 ||Double Free when processing DTLS packets||CVE-2014-3505||No. OpenVPN does not use DTLS||
    12 ||DTLS memory exhaustion||CVE-2014-3506||No. OpenVPN does not use DTLS||
    13 ||DTLS memory leak from zero-length fragments||CVE-2014-3507||No. OpenVPN does not use DTLS||
    14 ||OpenSSL DTLS anonymous EC(DH) denial of service||CVE-2014-3510||No. OpenVPN does not use DTLS||
    15 ||OpenSSL TLS protocol downgrade attack||CVE-2014-3511||No. OpenVPN already defaults to TLS 1.0||
    16 ||SRP buffer overrun||CVE-2014-3512||No. OpenVPN does not use SRP||
     8||Information leak in pretty printing functions||CVE-2014-3508||Possibly[1].||
     9||Crash with SRP ciphersuite in Server Hello message||CVE-2014-5139||No. OpenVPN does not use SRP.||
     10||Race condition in ssl_parse_serverhello_tlsext||CVE-2014-3509||No.||
     11||Double Free when processing DTLS packets||CVE-2014-3505||No. OpenVPN does not use DTLS.||
     12||DTLS memory exhaustion||CVE-2014-3506||No. OpenVPN does not use DTLS.||
     13||DTLS memory leak from zero-length fragments||CVE-2014-3507||No. OpenVPN does not use DTLS.||
     14||OpenSSL DTLS anonymous EC(DH) denial of service||CVE-2014-3510||No. OpenVPN does not use DTLS.||
     15||OpenSSL TLS protocol downgrade attack||CVE-2014-3511||No. OpenVPN already defaults to TLS 1.0.||
     16||SRP buffer overrun||CVE-2014-3512||No. OpenVPN does not use SRP.||
    1717
    1818[1] This one triggers direct vulnerability in OpenVPN. Stack information is not leaked to the peer. It might be possible that the leaked information is passed on to a client script / plugin (not sure what form the leaked information has, if it's the leaked information is after a NUL-byte, it's probably not exported). Such a plugin/script could then leak the information to the attacker.