CVE-2013-6449
First published: Fri Dec 20 2013(Updated: )
A flaw was reported for OpenSSL 1.0.1e, that can cause application using OpenSSL to crash when using TLS version 1.2. Issue was reported via the following OpenSSL upstream ticket: <a href="http://rt.openssl.org/Ticket/Display.html?id=3200&user=guest&pass=guest">http://rt.openssl.org/Ticket/Display.html?id=3200&user=guest&pass=guest</a> and also as bug for Apache Traffic Server: <a href="https://issues.apache.org/jira/browse/TS-2355">https://issues.apache.org/jira/browse/TS-2355</a> Fix is now committed in upstream git: <a href="http://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=ca98926">http://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=ca98926</a> Related to the above ticket, upstream also added this fix to improve error checks in OpenSSL: <a href="http://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=0294b2b">http://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=0294b2b</a>
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/openssl | <1.0.1 | 1.0.1 |
| OpenSSL OpenSSL | <=1.0.1e | |
| OpenSSL OpenSSL | =1.0.0 | |
| OpenSSL OpenSSL | =1.0.0-beta1 | |
| OpenSSL OpenSSL | =1.0.0-beta2 | |
| OpenSSL OpenSSL | =1.0.0-beta3 | |
| OpenSSL OpenSSL | =1.0.0-beta4 | |
| OpenSSL OpenSSL | =1.0.0-beta5 | |
| OpenSSL OpenSSL | =1.0.0a | |
| OpenSSL OpenSSL | =1.0.0b | |
| OpenSSL OpenSSL | =1.0.0c | |
| OpenSSL OpenSSL | =1.0.0d | |
| OpenSSL OpenSSL | =1.0.0e | |
| OpenSSL OpenSSL | =1.0.0f | |
| OpenSSL OpenSSL | =1.0.0g | |
| OpenSSL OpenSSL | =1.0.0h | |
| OpenSSL OpenSSL | =1.0.0i | |
| OpenSSL OpenSSL | =1.0.0j | |
| OpenSSL OpenSSL | =1.0.1 | |
| OpenSSL OpenSSL | =1.0.1-beta1 | |
| OpenSSL OpenSSL | =1.0.1-beta2 | |
| OpenSSL OpenSSL | =1.0.1-beta3 | |
| OpenSSL OpenSSL | =1.0.1a | |
| OpenSSL OpenSSL | =1.0.1b | |
| OpenSSL OpenSSL | =1.0.1c | |
| OpenSSL OpenSSL | =1.0.1d |
Remedy
http://git.openssl.org/gitweb/?p=openssl.git;a=commit;h=ca989269a2876bae79393bd54c3e72d49975fc75
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://rt.openssl.org/Ticket/Display.html?id=3200&user=guest&pass=guest
- https://issues.apache.org/jira/browse/TS-2355
- http://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=ca98926
- http://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=0294b2b
- https://rhn.redhat.com/errata/RHBA-2013-1585.html
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1045443
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1045444
- http://www.openssl.org/news/vulnerabilities.html#2013-6449
- http://www.openssl.org/news/openssl-1.0.1-notes.html
- https://rhn.redhat.com/errata/RHSA-2014-0015.html
- http://www.mail-archive.com/openssl-dev@openssl.org/msg33547.html
- https://rhn.redhat.com/errata/RHSA-2014-0041.html
- https://bugzilla.redhat.com/show_bug.cgi?id=1045363
- http://git.openssl.org/gitweb/?p=openssl.git;a=commit;h=ca989269a2876bae79393bd54c3e72d49975fc75
- http://lists.fedoraproject.org/pipermail/package-announce/2013-December/124833.html
- http://lists.fedoraproject.org/pipermail/package-announce/2013-December/124854.html
- http://lists.fedoraproject.org/pipermail/package-announce/2013-December/124858.html
- http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136470.html
- http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136473.html
- http://lists.opensuse.org/opensuse-updates/2014-01/msg00006.html
- http://lists.opensuse.org/opensuse-updates/2014-01/msg00009.html
- http://lists.opensuse.org/opensuse-updates/2014-01/msg00012.html
- http://lists.opensuse.org/opensuse-updates/2014-01/msg00031.html
- http://rhn.redhat.com/errata/RHSA-2014-0015.html
- http://rhn.redhat.com/errata/RHSA-2014-0041.html
- http://seclists.org/fulldisclosure/2014/Dec/23
- http://security.gentoo.org/glsa/glsa-201412-39.xml
- http://www-01.ibm.com/support/docview.wss?uid=isg400001841
- http://www-01.ibm.com/support/docview.wss?uid=isg400001843
- http://www.debian.org/security/2014/dsa-2833
- http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html
- http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html
- http://www.securityfocus.com/archive/1/534161/100/0/threaded
- http://www.securityfocus.com/bid/64530
- http://www.securitytracker.com/id/1029548
- http://www.ubuntu.com/usn/USN-2079-1
- http://www.vmware.com/security/advisories/VMSA-2014-0012.html
- http://git.openssl.org/gitweb/?p=openssl.git%3Ba=commit%3Bh=ca989269a2876bae79393bd54c3e72d49975fc75
- collector/nvd-index
- agent/type
- agent/softwarecombine
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/last-modified-date
- agent/weakness
- agent/references
- agent/author
- agent/remedy
- agent/description
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2013-6449
- agent/software-canonical-lookup
- agent/tags
- agent/event
- vendor/openssl
- canonical/openssl openssl
- version/openssl openssl/1.0.1e
- version/openssl openssl/1.0.0
- version/openssl openssl/1.0.0-beta1
- version/openssl openssl/1.0.0-beta2
- version/openssl openssl/1.0.0-beta3
- version/openssl openssl/1.0.0-beta4
- version/openssl openssl/1.0.0-beta5
- version/openssl openssl/1.0.0a
- version/openssl openssl/1.0.0b
- version/openssl openssl/1.0.0c
- version/openssl openssl/1.0.0d
- version/openssl openssl/1.0.0e
- version/openssl openssl/1.0.0f
- version/openssl openssl/1.0.0g
- version/openssl openssl/1.0.0h
- version/openssl openssl/1.0.0i
- version/openssl openssl/1.0.0j
- version/openssl openssl/1.0.1
- version/openssl openssl/1.0.1-beta1
- version/openssl openssl/1.0.1-beta2
- version/openssl openssl/1.0.1-beta3
- version/openssl openssl/1.0.1a
- version/openssl openssl/1.0.1b
- version/openssl openssl/1.0.1c
- version/openssl openssl/1.0.1d
- package-manager/redhat