CVE-2014-5139

Publication date 7 August 2014

Last updated 24 July 2024

Ubuntu priority

Description

The ssl_set_client_disabled function in t1_lib.c in OpenSSL 1.0.1 before 1.0.1i allows remote SSL servers to cause a denial of service (NULL pointer dereference and client application crash) via a ServerHello message that includes an SRP ciphersuite without the required negotiation of that ciphersuite with the client.

Status

Show unmaintained releases

Package	Ubuntu Release	Status
openssl	14.04 LTS trusty	Fixed 1.0.1f-1ubuntu2.5
	12.04 LTS precise	Fixed 1.0.1-4ubuntu5.17
	10.04 LTS lucid	Not affected
openssl098	14.04 LTS trusty	Not in release
	12.04 LTS precise	Not affected
	10.04 LTS lucid	Not in release

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
openssl	Upstream: https://git.openssl.org/gitweb/?p=openssl.git;a=commit;h=18c7f2fce8a82b13506cac7ca69fc333baf76408 Upstream: https://git.openssl.org/gitweb/?p=openssl.git;a=commit;h=83764a989dcc87fbea337da5f8f86806fe767b7e

References

Related Ubuntu Security Notices (USN)

USN-2308-1
OpenSSL vulnerabilities
7 August 2014