CVE-2012-0027: Medium severity OpenSSL OpenSSL vulnerability

Q: What is the severity of CVE-2012-0027?

CVE-2012-0027 has a severity rating that indicates it can lead to a denial of service due to the inability of OpenSSL to properly handle invalid parameters.

Q: How do I fix CVE-2012-0027?

To fix CVE-2012-0027, upgrade to OpenSSL version 1.0.0f or later that includes fixes for the vulnerability.

Q: Which versions of OpenSSL are affected by CVE-2012-0027?

CVE-2012-0027 affects OpenSSL versions prior to 1.0.0f, including 0.9.1c, 0.9.2b, and multiple versions up to 1.0.0e.

Q: What kind of attack does CVE-2012-0027 enable?

CVE-2012-0027 enables remote attackers to execute a denial of service attack that causes the daemon to crash.

Q: Is CVE-2012-0027 associated with TLS clients?

Yes, CVE-2012-0027 can be triggered by crafted data sent from a TLS client, exploiting the vulnerability in the GOST ENGINE.

Published Jan 6, 2012

Updated

The GOST ENGINE in OpenSSL before 1.0.0f does not properly handle invalid parameters for the GOST block cipher, which allows remote attackers to cause a denial of service (daemon crash) via crafted data from a TLS client.

Affected Software

67 affected components

OpenSSL OpenSSL<=1.0.0e

OpenSSL OpenSSL=0.9.1c

OpenSSL OpenSSL=0.9.2b

OpenSSL OpenSSL=0.9.3

OpenSSL OpenSSL=0.9.3a

OpenSSL OpenSSL=0.9.4

OpenSSL OpenSSL=0.9.5

OpenSSL OpenSSL=0.9.5a

OpenSSL OpenSSL=0.9.6

OpenSSL OpenSSL=0.9.6a

OpenSSL OpenSSL=0.9.6b

OpenSSL OpenSSL=0.9.6c

OpenSSL OpenSSL=0.9.6d

OpenSSL OpenSSL=0.9.6e

OpenSSL OpenSSL=0.9.6f

OpenSSL OpenSSL=0.9.6g

OpenSSL OpenSSL=0.9.6h

OpenSSL OpenSSL=0.9.6h-bogus

OpenSSL OpenSSL=0.9.6i

OpenSSL OpenSSL=0.9.6j

OpenSSL OpenSSL=0.9.6k

OpenSSL OpenSSL=0.9.6l

OpenSSL OpenSSL=0.9.6m

OpenSSL OpenSSL=0.9.7

OpenSSL OpenSSL=0.9.7a

OpenSSL OpenSSL=0.9.7b

OpenSSL OpenSSL=0.9.7c

OpenSSL OpenSSL=0.9.7d

OpenSSL OpenSSL=0.9.7e

OpenSSL OpenSSL=0.9.7f

OpenSSL OpenSSL=0.9.7g

OpenSSL OpenSSL=0.9.7h

OpenSSL OpenSSL=0.9.7i

OpenSSL OpenSSL=0.9.7j

OpenSSL OpenSSL=0.9.7k

OpenSSL OpenSSL=0.9.7l

OpenSSL OpenSSL=0.9.7m

OpenSSL OpenSSL=0.9.8

OpenSSL OpenSSL=0.9.8a

OpenSSL OpenSSL=0.9.8b

OpenSSL OpenSSL=0.9.8c

OpenSSL OpenSSL=0.9.8d

OpenSSL OpenSSL=0.9.8e

OpenSSL OpenSSL=0.9.8f

OpenSSL OpenSSL=0.9.8g

OpenSSL OpenSSL=0.9.8h

OpenSSL OpenSSL=0.9.8i

OpenSSL OpenSSL=0.9.8j

OpenSSL OpenSSL=0.9.8k

OpenSSL OpenSSL=0.9.8l

OpenSSL OpenSSL=0.9.8m

OpenSSL OpenSSL=0.9.8n

OpenSSL OpenSSL=0.9.8o

OpenSSL OpenSSL=0.9.8p

OpenSSL OpenSSL=0.9.8q

OpenSSL OpenSSL=0.9.8r

OpenSSL OpenSSL=0.9.8s

OpenSSL OpenSSL=1.0.0

OpenSSL OpenSSL=1.0.0-beta1

OpenSSL OpenSSL=1.0.0-beta2

OpenSSL OpenSSL=1.0.0-beta3

OpenSSL OpenSSL=1.0.0-beta4

OpenSSL OpenSSL=1.0.0-beta5

OpenSSL OpenSSL=1.0.0a

OpenSSL OpenSSL=1.0.0b

OpenSSL OpenSSL=1.0.0c

OpenSSL OpenSSL=1.0.0d

Event History

Jan 6, 2012

CVE Published

via MITRE·01:00 AM

Data Sourced

via MITRE·01:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2012-0027?

CVE-2012-0027 has a severity rating that indicates it can lead to a denial of service due to the inability of OpenSSL to properly handle invalid parameters.

How do I fix CVE-2012-0027?

To fix CVE-2012-0027, upgrade to OpenSSL version 1.0.0f or later that includes fixes for the vulnerability.

Which versions of OpenSSL are affected by CVE-2012-0027?