Description
The ssl3_send_client_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h, when an anonymous ECDH cipher suite is used, allows remote attackers to cause a denial of service (NULL pointer dereference and client crash) by triggering a NULL certificate value.
Analysis and contextual insights are available on OpenCVE Cloud.
Remediation
No vendor fix or workaround currently provided.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
Advisories
| Source | ID | Title |
|---|---|---|
Debian DSA |
DSA-2950-1 | openssl security update |
Debian DSA |
DSA-2950-2 | openssl update |
Ubuntu USN |
USN-2232-1 | OpenSSL vulnerabilities |
References
History
No history.
Subscriptions
Fedoraproject
Subscribe
Fedora
Subscribe
Mariadb
Subscribe
Mariadb
Subscribe
Openssl
Subscribe
Openssl
Subscribe
Opensuse
Subscribe
Leap
Subscribe
Opensuse
Subscribe
Redhat
Subscribe
Enterprise Linux
Subscribe
Storage
Subscribe
Suse
Subscribe
Linux Enterprise Desktop
Subscribe
Linux Enterprise Server
Subscribe
Linux Enterprise Software Development Kit
Subscribe
Linux Enterprise Workstation Extension
Subscribe
Status: PUBLISHED
Assigner: redhat
Published:
Updated: 2024-08-06T10:43:06.356Z
Reserved: 2014-05-14T00:00:00.000Z
Link: CVE-2014-3470
No data.
Status : Modified
Published: 2014-06-05T21:55:07.880
Modified: 2026-05-06T22:30:45.220
Link: CVE-2014-3470
OpenCVE Enrichment
No data.
Weaknesses
Debian DSA
Ubuntu USN