CVEvulnerability

CVE-2014-0221

4.3 MEDIUM Published 2014-06-05 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2014-06-05
Last modified
2026-06-17
Assigner
[email protected]
CVSS 2.0 ([email protected])
4.3 MEDIUM — AV:N/AC:M/Au:N/C:N/I:N/A:P

Description

The dtls1_get_message_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h allows remote attackers to cause a denial of service (recursion and client crash) via a DTLS hello message in an invalid DTLS handshake.

Affected configurations

• openssl openssl (>= 0.9.8 < 0.9.8za) • openssl openssl (>= 1.0.0 < 1.0.0m) • openssl openssl (>= 1.0.1 < 1.0.1h) • redhat storage 2.1 • fedoraproject fedora • redhat enterprise linux 5 • redhat enterprise linux 6.0 • mariadb mariadb (>= 10.0.0 < 10.0.13) • fedoraproject fedora 19 • fedoraproject fedora 20 • opensuse leap 42.1 • opensuse opensuse 13.2 • suse linux enterprise desktop 12 • suse linux enterprise server 12 • suse linux enterprise software development kit 12 • suse linux enterprise workstation extension 12

References