Homepage

Cryptographic Issues The advisory has been revoked - it doesn't affect any version of package openssl098  (opens in a new tab)

Threat Intelligence

EPSS
85.78% (100th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-UBUNTU1204-OPENSSL098-631434
  • published5 Jun 2014
  • disclosed5 Jun 2014
Report a new vulnerability Found a mistake?

Introduced: 5 Jun 2014

CVE-2014-3470  (opens in a new tab)
CWE-310  (opens in a new tab)

Amendment

The Ubuntu security team deemed this advisory irrelevant for Ubuntu:12.04.

NVD Description

Note: Versions mentioned in the description apply only to the upstream openssl098 package and not the openssl098 package as distributed by Ubuntu.

The ssl3_send_client_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h, when an anonymous ECDH cipher suite is used, allows remote attackers to cause a denial of service (NULL pointer dereference and client crash) by triggering a NULL certificate value.

References