CVE-2014-3567: Input Validation
Memory leak in the tlsdecryptticket function in t1lib.c in OpenSSL before 0.9.8zc, 1.0.0 before 1.0.0o, and 1.0.1 before 1.0.1j allows remote attackers to cause a denial of service (memory consumption) via a crafted session ticket that triggers an integrity-check failure.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2014-3567?
CVE-2014-3567 has a severity rating of medium and can lead to a denial of service due to memory consumption.
How do I fix CVE-2014-3567?
To mitigate CVE-2014-3567, upgrade to OpenSSL version 0.9.8zc or higher, or 1.0.0o and later.
Who is affected by CVE-2014-3567?
CVE-2014-3567 affects various versions of OpenSSL, specifically those before 0.9.8zc, 1.0.0 before 1.0.0o, and 1.0.1 before 1.0.1j.
Can CVE-2014-3567 be exploited remotely?
Yes, CVE-2014-3567 can be exploited remotely through crafted session tickets triggered during the TLS handshake.
What are the implications of not addressing CVE-2014-3567?
Failure to address CVE-2014-3567 may result in service downtime and increased resource consumption on affected systems.