Improper Input Validation Affecting openssl package, versions >=1.0.1
Threat Intelligence
EPSS
54.25% (98th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-COCOAPODS-OPENSSL-471268
- published 2 Oct 2019
- disclosed 6 Jan 2014
- credit Unknown
How to fix?
There is no fixed version for OpenSSL.
Overview
OpenSSL is a SSL/TLS and Crypto toolkit. Deprecated in Mac OS and gone in iOS, this spec gives your project non-deprecated OpenSSL support.
Affected versions of this package are vulnerable to Improper Input Validation. OpenSSL is vulnerable to denial of service (DoS) attacks. These attacks are possible because attackers can trigger a null pointer dereference through a Next Protocol Negotiation record in a TLS handshake.
References
- Debian Security Advisory
- Fedora Security Announcement
- Fedora Security Announcement
- http://git.openssl.org/gitweb/?p=openssl.git;a=blob_plain;f=CHANGES;hb=refs/heads/OpenSSL_1_0_1-stable
- http://git.openssl.org/gitweb/?p=openssl.git;a=commit;h=197e0ea817ad64820789d86711d55ff50d71f631
- http://www.openssl.org/news/vulnerabilities.html
- http://www.splunk.com/view/SP-CAAAMB3
- IBM Security Bulletin
- IBM Security Bulletin
- OpenSuse Security Update
- OpenSuse Security Update
- OpenSuse Security Update
- Patch
- RedHat Bugzilla Bug
- RedHat Security Advisory
- RedHat Security Advisory
- Ubuntu Security Advisory
CVSS Scores
version 3.1